# CVEs published 2019-07-18

60 CVEs were published on July 18, 2019: 0 critical, 2 high. Days are UTC.

- [CVE-2019-7963](https://cve.now/CVE-2019-7963.md): Adobe Bridge CC version 9.0.2 and earlier versions have an out of bound read vulnerability. (no CVSS, Adobe Bridge CC)
- [CVE-2019-7953](https://cve.now/CVE-2019-7953.md): Adobe Experience Manager version 6.4 and ealier have a Cross-Site Request Forgery vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2019-7954](https://cve.now/CVE-2019-7954.md): Adobe Experience Manager version 6.4 and ealier have a Stored Cross-site Scripting vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2019-7955](https://cve.now/CVE-2019-7955.md): Adobe Experience Manager version 6.4 and ealier have a Reflected Cross-site Scripting vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2019-7956](https://cve.now/CVE-2019-7956.md): Adobe Dreamweaver direct download installer versions 19.0 and below, 18.0 and below have an Insecure Library Loading (DLL hijacking) vulnera (no CVSS, Adobe Dreamweaver)
- [CVE-2019-7843](https://cve.now/CVE-2019-7843.md): Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Insufficient input validation vulnerability. (no CVSS, Adobe Campaign)
- [CVE-2019-7941](https://cve.now/CVE-2019-7941.md): Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Information Exposure Through an Error Message vulnerability. (no CVSS, Adobe Campaign)
- [CVE-2019-7846](https://cve.now/CVE-2019-7846.md): Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper error handling vulnerability. (no CVSS, Adobe Campaign)
- [CVE-2019-7847](https://cve.now/CVE-2019-7847.md): Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper Restriction of XML External Entity Reference ('XXE') vulne (no CVSS, Adobe Campaign)
- [CVE-2019-7848](https://cve.now/CVE-2019-7848.md): Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Inadequate access control vulnerability. (no CVSS, Adobe Campaign)
- [CVE-2019-7850](https://cve.now/CVE-2019-7850.md): Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. (no CVSS, Adobe Campaign)
- [CVE-2019-13962](https://cve.now/CVE-2019-13962.md): lavc\_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it do (no CVSS)
- [CVE-2019-13961](https://cve.now/CVE-2019-13961.md): A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files.upload-script.php. (no CVSS)
- [CVE-2019-13960](https://cve.now/CVE-2019-13960.md): In libjpeg-turbo 2.0.2, a large amount of memory can be used during processing of an invalid progressive JPEG image containing incorrect wid (no CVSS)
- [CVE-2019-13959](https://cve.now/CVE-2019-13959.md): In Bento4 1.5.1-627, AP4\_DataBuffer::SetDataSize does not handle reallocation failures, leading to a memory copy into a NULL pointer. (no CVSS)
- [CVE-2019-8286](https://cve.now/CVE-2019-8286.md): Information Disclosure in Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security versions up to 2019 could potentially (no CVSS, Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersk…)
- [CVE-2019-1010112](https://cve.now/CVE-2019-1010112.md): OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery (CSRF). (no CVSS, OECMS)
- [CVE-2019-1010279](https://cve.now/CVE-2019-1010279.md): Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass. (no CVSS, Open Information Security Foundation Suricata)
- [CVE-2019-1010246](https://cve.now/CVE-2019-1010246.md): MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. (no CVSS, MailCleaner)
- [CVE-2019-3592](https://cve.now/CVE-2019-3592.md): MA for Windows update addresses weak directory permissions (CVSS 7.2, McAfee Agent)
- [CVE-2019-1010248](https://cve.now/CVE-2019-1010248.md): Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. (no CVSS, Synetics I-doit)
- [CVE-2019-1010249](https://cve.now/CVE-2019-1010249.md): The Linux Foundation ONOS 2.0.0 and earlier is affected by: Integer Overflow. (no CVSS, The Linux Foundation ONOS)
- [CVE-2019-1010250](https://cve.now/CVE-2019-1010250.md): The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. (no CVSS, The Linux Foundation ONOS)
- [CVE-2019-1010251](https://cve.now/CVE-2019-1010251.md): Open Information Security Foundation Suricata prior to version 4.1.2 is affected by: Denial of Service - DNS detection bypass. (no CVSS, Open Information Security Foundation Suricata)
- [CVE-2019-1010252](https://cve.now/CVE-2019-1010252.md): The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. (no CVSS, The Linux Foundation ONOS)
- [CVE-2019-13956](https://cve.now/CVE-2019-13956.md): Discuz!ML 3.2 through 3.4 allows remote attackers to execute arbitrary PHP code via a modified language cookie, as demonstrated by changing (no CVSS)
- [CVE-2019-11230](https://cve.now/CVE-2019-11230.md): In Avast Antivirus before 19.4, a local administrator can trick the product into renaming arbitrary files by replacing the Logs\\Update.log f (no CVSS)
- [CVE-2019-1010259](https://cve.now/CVE-2019-1010259.md): SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. (no CVSS, SaltStack Salt · salt)
- [CVE-2019-1010261](https://cve.now/CVE-2019-1010261.md): Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). (no CVSS, Gitea · code.gitea.io/gitea)
- [CVE-2019-13952](https://cve.now/CVE-2019-13952.md): The set\_ipv6() function in zscan\_rfc1035.rl in gdnsd before 2.4.3 and 3.x before 3.2.1 has a stack-based buffer overflow via a long and malf (no CVSS)
- [CVE-2019-13951](https://cve.now/CVE-2019-13951.md): The set\_ipv4() function in zscan\_rfc1035.rl in gdnsd 3.x before 3.2.1 has a stack-based buffer overflow via a long and malformed IPv4 addres (no CVSS)
- [CVE-2019-1010065](https://cve.now/CVE-2019-1010065.md): The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. (no CVSS, The Sleuth Kit)
- [CVE-2019-1010268](https://cve.now/CVE-2019-1010268.md): Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). (no CVSS, Ladon)
- [CVE-2019-13950](https://cve.now/CVE-2019-13950.md): index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment. (no CVSS)
- [CVE-2019-13949](https://cve.now/CVE-2019-13949.md): SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin passwor (no CVSS)
- [CVE-2019-13948](https://cve.now/CVE-2019-13948.md): SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does not properly block XSS payloads, (no CVSS)
- [CVE-2019-1010104](https://cve.now/CVE-2019-1010104.md): TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection. (no CVSS, TechyTalk Quick Chat WordPress Plugin)
- [CVE-2019-3794](https://cve.now/CVE-2019-3794.md): UAA - Login app subject to clickjacking attack (CVSS 6.5, Cloud Foundry UAA Release)
- [CVE-2019-3741](https://cve.now/CVE-2019-3741.md): Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain a plain-text password storage vulnerability. (CVSS 7.8, DELL EMC Unity)
- [CVE-2019-3734](https://cve.now/CVE-2019-3734.md): Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain an improper authorization vulnerability in NAS Server quotas configurati (CVSS 5.4, DELL EMC Unity)
- [CVE-2019-3570](https://cve.now/CVE-2019-3570.md): Call to the scrypt\_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p). (no CVSS, Facebook HHVM)
- [CVE-2019-13509](https://cve.now/CVE-2019-13509.md): In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode ma (no CVSS, github.com/docker/docker)
- [CVE-2019-9231](https://cve.now/CVE-2019-9231.md): An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions before 7.20A.202. (no CVSS)
- [CVE-2019-13575](https://cve.now/CVE-2019-13575.md): A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. (no CVSS)
- [CVE-2019-9230](https://cve.now/CVE-2019-9230.md): An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A. (no CVSS)
- [CVE-2019-13607](https://cve.now/CVE-2019-13607.md): The Opera Mini application through 16.0.14 for iOS has a UXSS vulnerability that can be triggered by performing navigation to a javascript: (no CVSS)
- [CVE-2019-13915](https://cve.now/CVE-2019-13915.md): b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files. (no CVSS, github.com/b3log/wide)
- [CVE-2019-1010069](https://cve.now/CVE-2019-1010069.md): moinejf abcm2ps 8.13.20 is affected by: Incorrect Access Control. (no CVSS, moinejf abcm2ps)
- [CVE-2019-1010066](https://cve.now/CVE-2019-1010066.md): Lawrence Livermore National Laboratory msr-safe v1.1.0 is affected by: Incorrect Access Control. (no CVSS, Lawrence Livermore National Laboratory msr-safe)
- [CVE-2019-1010054](https://cve.now/CVE-2019-1010054.md): Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). (no CVSS, Dolibarr ERP & CRM Dolibarr · dolibarr/dolibarr)
- [CVE-2019-1010096](https://cve.now/CVE-2019-1010096.md): DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). (no CVSS, DomainMOD)
- [CVE-2019-1010095](https://cve.now/CVE-2019-1010095.md): DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). (no CVSS, DomainMOD)
- [CVE-2019-1010094](https://cve.now/CVE-2019-1010094.md): domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). (no CVSS, DomainMOD)
- [CVE-2016-10762](https://cve.now/CVE-2016-10762.md): The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used. (no CVSS)
- [CVE-2016-10763](https://cve.now/CVE-2016-10763.md): The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body. (no CVSS)
- [CVE-2019-13647](https://cve.now/CVE-2019-13647.md): Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. (no CVSS, grumpydictator/firefly-iii)
- [CVE-2019-13646](https://cve.now/CVE-2019-13646.md): Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query. (no CVSS, grumpydictator/firefly-iii)
- [CVE-2019-13645](https://cve.now/CVE-2019-13645.md): Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. (no CVSS, grumpydictator/firefly-iii)
- [CVE-2019-13644](https://cve.now/CVE-2019-13644.md): Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. (CVSS 5.4, grumpydictator/firefly-iii)
- [CVE-2019-13643](https://cve.now/CVE-2019-13643.md): Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-07-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.