# CVEs published 2019-07-17

68 CVEs were published on July 17, 2019: 1 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-5222](https://cve.now/CVE-2019-5222.md): There is an information disclosure vulnerability on Secure Input of certain Huawei smartphones in Versions earlier than Tony-AL00B 9.1.0.216 (no CVSS, Honor Magic)
- [CVE-2019-13640](https://cve.now/CVE-2019-13640.md): In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shel (no CVSS)
- [CVE-2019-3973](https://cve.now/CVE-2019-3973.md): Comodo Antivirus versions 11.0.0.6582 and below are vulnerable to Denial of Service affecting CmdGuard.sys via its filter port "cmdServicePo (no CVSS, Comodo Antivirus)
- [CVE-2019-3972](https://cve.now/CVE-2019-3972.md): Comodo Antivirus versions 12.0.0.6810 and below are vulnerable to Denial of Service affecting CmdAgent.exe via an unprotected section object (no CVSS, Comodo Antivirus)
- [CVE-2019-3971](https://cve.now/CVE-2019-3971.md): Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to a local Denial of Service affecting CmdVirth.exe via its LPC port "cmdvrtLPCSe (no CVSS, Comodo Antivirus)
- [CVE-2019-3970](https://cve.now/CVE-2019-3970.md): Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to Arbitrary File Write due to Cavwp.exe handling of Comodo's Antivirus database. (no CVSS, Comodo Antivirus)
- [CVE-2019-3969](https://cve.now/CVE-2019-3969.md): Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to Local Privilege Escalation due to CmdAgent's handling of COM clients. (no CVSS, Comodo Antivirus)
- [CVE-2019-1010263](https://cve.now/CVE-2019-1010263.md): Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. (no CVSS, Perl Crypt::JWT)
- [CVE-2019-1943](https://cve.now/CVE-2019-1943.md): Cisco Small Business Series Switches Open Redirect Vulnerability (CVSS 4.7, Cisco Small Business 300 Series Managed Switches)
- [CVE-2019-1923](https://cve.now/CVE-2019-1923.md): Cisco Small Business SPA500 Series IP Phones Local Command Execution Vulnerability (CVSS 6.6, Cisco SPA525G2 5-line IP Phone)
- [CVE-2019-1010266](https://cve.now/CVE-2019-1010266.md): lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. (no CVSS, lodash · lodash-es +2)
- [CVE-2019-1940](https://cve.now/CVE-2019-1940.md): Cisco Industrial Network Director Web Services Management Agent Unauthorized Information Disclosure Vulnerability (CVSS 5.3, Cisco Industrial Network Director)
- [CVE-2019-1941](https://cve.now/CVE-2019-1941.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2019-1942](https://cve.now/CVE-2019-1942.md): Cisco Identity Services Engine Blind SQL Injection Vulnerability (CVSS 4.3, Cisco Identity Services Engine Software)
- [CVE-2019-1919](https://cve.now/CVE-2019-1919.md): Cisco FindIT Network Management Software Static Credentials Vulnerability (CVSS 8.4, Cisco FindIT Network Manager)
- [CVE-2019-1920](https://cve.now/CVE-2019-1920.md): Cisco IOS Access Points Software 802.11r Fast Transition Denial of Service Vulnerability (CVSS 7.4, Cisco Aironet Access Point Software)
- [CVE-2019-12913](https://cve.now/CVE-2019-12913.md): Redbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail, Outlook, etc.) used in the application. (no CVSS)
- [CVE-2019-13637](https://cve.now/CVE-2019-13637.md): In LogMeIn join.me before 3.16.0.5505, an attacker could execute arbitrary commands on a targeted system. (no CVSS)
- [CVE-2019-11772](https://cve.now/CVE-2019-11772.md): In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte\[\], int) method does not verify that the provided byte array is non-null (no CVSS, The Eclipse Foundation Eclipse OpenJ9)
- [CVE-2019-11771](https://cve.now/CVE-2019-11771.md): AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users. (no CVSS, The Eclipse Foundation Eclipse OpenJ9)
- [CVE-2019-12912](https://cve.now/CVE-2019-12912.md): Redbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail, Outlook, etc.) used in the application. (no CVSS)
- [CVE-2019-1917](https://cve.now/CVE-2019-1917.md): Cisco Vision Dynamic Signage Director REST API Authentication Bypass Vulnerability (CVSS 9.1, Cisco Vision Dynamic Signage Director)
- [CVE-2019-1010275](https://cve.now/CVE-2019-1010275.md): helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. (no CVSS, helm · helm.sh/helm)
- [CVE-2019-8931](https://cve.now/CVE-2019-8931.md): Redbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail, Outlook, etc.) used in the application. (no CVSS)
- [CVE-2019-8932](https://cve.now/CVE-2019-8932.md): Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the appl (no CVSS)
- [CVE-2019-12914](https://cve.now/CVE-2019-12914.md): Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the appl (no CVSS)
- [CVE-2019-12911](https://cve.now/CVE-2019-12911.md): Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the appl (no CVSS)
- [CVE-2019-1010283](https://cve.now/CVE-2019-1010283.md): Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure. (no CVSS, Univention Corporate Server univention-directory-notifier)
- [CVE-2019-13636](https://cve.now/CVE-2019-13636.md): In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. (no CVSS)
- [CVE-2019-1010287](https://cve.now/CVE-2019-1010287.md): Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). (no CVSS, Timesheet Next Gen)
- [CVE-2019-12876](https://cve.now/CVE-2019-12876.md): Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege (no CVSS)
- [CVE-2019-11535](https://cve.now/CVE-2019-11535.md): Unsanitized user input in the web interface for Linksys WiFi extender products (RE6400 and RE6300 through 1.2.04.022) allows for remote comm (no CVSS)
- [CVE-2019-13619](https://cve.now/CVE-2019-13619.md): In Wireshark 3.0.0 to 3.0.2, 2.6.0 to 2.6.9, and 2.4.0 to 2.4.15, the ASN.1 BER dissector and related dissectors could crash. (no CVSS)
- [CVE-2019-13447](https://cve.now/CVE-2019-13447.md): An issue was discovered in Sertek Xpare 3.67. (no CVSS)
- [CVE-2019-13448](https://cve.now/CVE-2019-13448.md): An issue was discovered in Sertek Xpare 3.67. (no CVSS)
- [CVE-2019-13493](https://cve.now/CVE-2019-13493.md): In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. (no CVSS)
- [CVE-2019-13577](https://cve.now/CVE-2019-13577.md): SnmpAdm.exe in MAPLE WBT SNMP Administrator v2.0.195.15 has an Unauthenticated Remote Buffer Overflow via a long string to the CE Remote fea (no CVSS)
- [CVE-2019-13584](https://cve.now/CVE-2019-13584.md): The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 allows Directory Traversal via a forged HTTP request. (no CVSS)
- [CVE-2019-13585](https://cve.now/CVE-2019-13585.md): The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 has a Buffer Overflow via a forged HTTP request. (no CVSS)
- [CVE-2019-13631](https://cve.now/CVE-2019-13631.md): In parse\_hid\_report\_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an HID repo (no CVSS)
- [CVE-2019-13614](https://cve.now/CVE-2019-13614.md): CMD\_SET\_CONFIG\_COUNTRY in the TP-Link Device Debug protocol in TP-Link Archer C1200 1.0.0 Build 20180502 rel.45702 and earlier is prone to a (no CVSS)
- [CVE-2019-13613](https://cve.now/CVE-2019-13613.md): CMD\_FTEST\_CONFIG in the TP-Link Device Debug protocol in TP-Link Wireless Router Archer Router version 1.0.0 Build 20180502 rel.45702 (EU) a (no CVSS)
- [CVE-2019-12175](https://cve.now/CVE-2019-12175.md): In Zeek Network Security Monitor (formerly known as Bro) before 2.6.2, a NULL pointer dereference in the Kerberos (aka KRB) protocol parser (no CVSS)
- [CVE-2019-1010091](https://cve.now/CVE-2019-1010091.md): tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. (no CVSS, tinymce)
- [CVE-2019-13346](https://cve.now/CVE-2019-13346.md): In MyT 1.5.1, the User\[username\] parameter has XSS. (no CVSS)
- [CVE-2019-12475](https://cve.now/CVE-2019-12475.md): In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation. (no CVSS)
- [CVE-2019-13403](https://cve.now/CVE-2019-13403.md): Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit2.aspx, leading to the viewing of (no CVSS)
- [CVE-2019-13573](https://cve.now/CVE-2019-13573.md): A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. (no CVSS)
- [CVE-2019-10352](https://cve.now/CVE-2019-10352.md): A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.j (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2019-10353](https://cve.now/CVE-2019-10353.md): CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass C (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2019-10354](https://cve.now/CVE-2019-10354.md): A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fra (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-co… +1)
- [CVE-2019-13453](https://cve.now/CVE-2019-13453.md): Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. (no CVSS)
- [CVE-2019-4430](https://cve.now/CVE-2019-4430.md): IBM Maximo Asset Management 7.6 could allow a remote attacker to traverse directories on the system. (CVSS 4.3, IBM Maximo Asset Management)
- [CVE-2019-4211](https://cve.now/CVE-2019-4211.md): IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. (CVSS 5.4, IBM QRadar SIEM)
- [CVE-2019-4194](https://cve.now/CVE-2019-4194.md): IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 is missing function level access control that could allow a user to delete autho (CVSS 5.3, IBM Jazz for Service Management)
- [CVE-2019-4054](https://cve.now/CVE-2019-4054.md): IBM QRadar SIEM 7.2 and 7.3 could allow a local user to obtain sensitive information when exporting content that could aid an attacker in fu (CVSS 4.0, IBM QRadar SIEM)
- [CVE-2018-2022](https://cve.now/CVE-2018-2022.md): IBM QRadar SIEM 7.2 and 7.3 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM QRadar SIEM)
- [CVE-2018-2021](https://cve.now/CVE-2018-2021.md): IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. (CVSS 6.1, IBM QRadar SIEM)
- [CVE-2018-1921](https://cve.now/CVE-2018-1921.md): IBM Campaign 9.1.0, 9.1.2, 10.1, and 11.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Campaign)
- [CVE-2019-1010083](https://cve.now/CVE-2019-1010083.md): The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. (no CVSS, The Pallets Project Flask · flask)
- [CVE-2019-1010084](https://cve.now/CVE-2019-1010084.md): Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control. (no CVSS, Dancer::Plugin::SimpleCRUD)
- [CVE-2019-13272](https://cve.now/CVE-2019-13272.md): In the Linux kernel before 5.1.17, ptrace\_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to cre (CVSS 7.8, KEV)
- [CVE-2019-9849](https://cve.now/CVE-2019-9849.md): LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. (no CVSS, Document Foundation LibreOffice)
- [CVE-2019-9848](https://cve.now/CVE-2019-9848.md): LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-ov (no CVSS, Document Foundation LibreOffice)
- [CVE-2019-13625](https://cve.now/CVE-2019-13625.md): NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file. (no CVSS)
- [CVE-2019-13624](https://cve.now/CVE-2019-13624.md): In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within strings tha (no CVSS)
- [CVE-2019-13623](https://cve.now/CVE-2019-13623.md): In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with (no CVSS)
- [CVE-2019-13626](https://cve.now/CVE-2019-13626.md): SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a heap-based buffer over-read in Fill\_IMA\_ADPCM\_block, caused by an integer overflow in (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-07-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.