CVEs published July 18, 2019
60 CVEs were published on July 18, 2019: 0 critical, 2 high.
- Published
- 60
- Critical
- 0
- High
- 2
- Medium
- 3
- Low
- 0
- Unrated
- 55
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- Adobe Campaign
- 6
- grumpydictator/firefly-iii
- 4
- Adobe Experience Manager
- 3
- DomainMOD
- 3
- The Linux Foundation ONOS
- 3
- DELL EMC Unity
- 2
- Open Information Security Foundation Suricata
- 2
- Adobe Bridge CC
- 1
- Adobe Dreamweaver
- 1
- Cloud Foundry UAA Release
- 1
High 2
Medium, low and unrated 58
- CVE-2019-7963Adobe Bridge CC version 9.0.2 and earlier versions have an out of bound read vulnerability.Adobe Bridge CC
- CVE-2019-7953Adobe Experience Manager version 6.4 and ealier have a Cross-Site Request Forgery vulnerability.Adobe Experience Manager
- CVE-2019-7954Adobe Experience Manager version 6.4 and ealier have a Stored Cross-site Scripting vulnerability.Adobe Experience Manager
- CVE-2019-7955Adobe Experience Manager version 6.4 and ealier have a Reflected Cross-site Scripting vulnerability.Adobe Experience Manager
- CVE-2019-7956Adobe Dreamweaver direct download installer versions 19.0 and below, 18.0 and below have an Insecure Library Loading (DLL hijacking) vulneraAdobe Dreamweaver
- CVE-2019-7843Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Insufficient input validation vulnerability.Adobe Campaign
- CVE-2019-7941Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Information Exposure Through an Error Message vulnerability.Adobe Campaign
- CVE-2019-7846Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper error handling vulnerability.Adobe Campaign
- CVE-2019-7847Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper Restriction of XML External Entity Reference ('XXE') vulneAdobe Campaign
- CVE-2019-7848Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Inadequate access control vulnerability.Adobe Campaign
- CVE-2019-7850Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability.Adobe Campaign
- CVE-2019-13962lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it do
- CVE-2019-13961A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files.upload-script.php.
- CVE-2019-13960In libjpeg-turbo 2.0.2, a large amount of memory can be used during processing of an invalid progressive JPEG image containing incorrect wid
- CVE-2019-13959In Bento4 1.5.1-627, AP4_DataBuffer::SetDataSize does not handle reallocation failures, leading to a memory copy into a NULL pointer.
- CVE-2019-8286Information Disclosure in Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security versions up to 2019 could potentially Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersk…
- CVE-2019-1010112OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery (CSRF).OECMS
- CVE-2019-1010279Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass.Open Information Security Foundation Suricata
- CVE-2019-1010246MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure.MailCleaner
- CVE-2019-1010248Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection.Synetics I-doit
- CVE-2019-1010249The Linux Foundation ONOS 2.0.0 and earlier is affected by: Integer Overflow.The Linux Foundation ONOS
- CVE-2019-1010250The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation.The Linux Foundation ONOS
- CVE-2019-1010251Open Information Security Foundation Suricata prior to version 4.1.2 is affected by: Denial of Service - DNS detection bypass.Open Information Security Foundation Suricata
- CVE-2019-1010252The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation.The Linux Foundation ONOS
- CVE-2019-13956Discuz!ML 3.2 through 3.4 allows remote attackers to execute arbitrary PHP code via a modified language cookie, as demonstrated by changing
- CVE-2019-11230In Avast Antivirus before 19.4, a local administrator can trick the product into renaming arbitrary files by replacing the Logs\Update.log f
- CVE-2019-1010259SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection.SaltStack Salt · salt
- CVE-2019-1010261Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS).Gitea · code.gitea.io/gitea
- CVE-2019-13952The set_ipv6() function in zscan_rfc1035.rl in gdnsd before 2.4.3 and 3.x before 3.2.1 has a stack-based buffer overflow via a long and malf
- CVE-2019-13951The set_ipv4() function in zscan_rfc1035.rl in gdnsd 3.x before 3.2.1 has a stack-based buffer overflow via a long and malformed IPv4 addres
- CVE-2019-1010065The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow.The Sleuth Kit
- CVE-2019-1010268Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE).Ladon
- CVE-2019-13950index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment.
- CVE-2019-13949SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin passwor
- CVE-2019-13948SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does not properly block XSS payloads,
- CVE-2019-1010104TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection.TechyTalk Quick Chat WordPress Plugin
- CVE-2019-3794UAA - Login app subject to clickjacking attackCloud Foundry UAA Release
- CVE-2019-3734Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain an improper authorization vulnerability in NAS Server quotas configuratiDELL EMC Unity
- CVE-2019-3570Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p).Facebook HHVM
- CVE-2019-13509In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode magithub.com/docker/docker
- CVE-2019-9231An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions before 7.20A.202.
- CVE-2019-13575A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9.
- CVE-2019-9230An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.
- CVE-2019-13607The Opera Mini application through 16.0.14 for iOS has a UXSS vulnerability that can be triggered by performing navigation to a javascript:
- CVE-2019-13915b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files.github.com/b3log/wide
- CVE-2019-1010069moinejf abcm2ps 8.13.20 is affected by: Incorrect Access Control.moinejf abcm2ps
- CVE-2019-1010066Lawrence Livermore National Laboratory msr-safe v1.1.0 is affected by: Incorrect Access Control.Lawrence Livermore National Laboratory msr-safe
- CVE-2019-1010054Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF).Dolibarr ERP & CRM Dolibarr · dolibarr/dolibarr
- CVE-2019-1010096DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF).DomainMOD
- CVE-2019-1010095DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF).DomainMOD
- CVE-2019-1010094domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF).DomainMOD
- CVE-2016-10762The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used.
- CVE-2016-10763The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body.
- CVE-2019-13647Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content.grumpydictator/firefly-iii
- CVE-2019-13646Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query.grumpydictator/firefly-iii
- CVE-2019-13645Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names.grumpydictator/firefly-iii
- CVE-2019-13644Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name.grumpydictator/firefly-iii
- CVE-2019-13643Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target