CVEs published July 19, 2019
50 CVEs were published on July 19, 2019: 0 critical, 2 high. 1 is now in CISA KEV.
- Published
- 50
- Critical
- 0
- High
- 2
- Medium
- 1
- Low
- 0
- Unrated
- 47
- Now in CISA KEV
- 1
- Fix available
- 3
Most affected products
- Akeo Consulting Rufus
- 2
- antsword
- 1
- ChinaMobile GPN2.4P21-C-CN
- 1
- DaveGamble/cJSON cJSON
- 1
- Exacq Technologies exacqVision Server
- 1
- Gnome Pango
- 1
- HPE IOT and GCP
- 1
- IceWall SSO Agent Option; HPE IceWall MFA 4.0EE MFA. Server…
- 1
- Jenkins Credentials Binding Plugin Jenkins · org.jenkins-ci…
- 1
- Microsoft PowerShell Core · System.Management.Automation
- 1
High 2
- CVE-2019-1579Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or Palo Alto Networks GlobalProtect Portal/Gateway Interface
- CVE-2015-7882Authentication bypass when using LDAP authentication in MongoDB Enterprise Server
Medium, low and unrated 48
- CVE-2019-12934An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress.
- CVE-2018-17210An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4.
- CVE-2019-9229An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.
- CVE-2019-12815An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without
- CVE-2019-9228An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A at least t
- CVE-2019-13569A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress.
- CVE-2019-12725Zeroshell 3.9.0 is prone to a remote command execution vulnerability.
- CVE-2019-11990Security vulnerabilities in HPE UIoT versions 1.6, 1.5, 1.4.2, 1.4.1, 1.4.0, and 1.2.4.2 could allow unauthorized remote access and access tHPE IOT and GCP
- CVE-2019-11989A security vulnerability in HPE IceWall SSO Agent Option and IceWall MFA (Agent module ) could be exploited remotely to cause a denial of seIceWall SSO Agent Option; HPE IceWall MFA 4.0EE MFA. Server…
- CVE-2019-7590exacqVision Server Unquoted Service PathExacq Technologies exacqVision Server
- CVE-2019-13991Embedded systems based on Arduino before Rev3 allow remote attackers to send data to LEDs (directly connected to GPIO pins) via a laser, bec
- CVE-2019-5680In NVIDIA Jetson TX1 L4T R32 version branch prior to R32.2, Tegra bootloader contains a vulnerability in nvtboot in which the nvtboot-cpu imNVIDIA Jetson TX1
- CVE-2019-13989dpic 2019.06.20 has a Stack-based Buffer Overflow in the wfloat() function in main.c.
- CVE-2019-12821A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-co
- CVE-2019-12820A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner.
- CVE-2019-12453In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input validation.
- CVE-2018-17792MDaemon Webmail (formerly WorldClient) has CSRF.
- CVE-2019-11553In Code42 for Enterprise through 6.8.4, an administrator without web restore permission but with the ability to manage users in an organizat
- CVE-2019-1010238Gnome Pango 1.42 and later is affected by: Buffer Overflow.Gnome Pango
- CVE-2019-1010239DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions.DaveGamble/cJSON cJSON
- CVE-2019-1010241Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format.Jenkins Credentials Binding Plugin Jenkins · org.jenkins-ci…
- CVE-2019-12193H3C H3Cloud OS all versions allows SQL injection via the ear/grid_event sidx parameter.
- CVE-2019-1010142scapy 2.4.0 is affected by: Denial of Service.SecDev scapy · scapy
- CVE-2019-1010136ChinaMobile GPN2.4P21-C-CN W2001EN-00 is affected by: Incorrect Access Control - Unauthenticated Remote Reboot.ChinaMobile GPN2.4P21-C-CN
- CVE-2019-1010101Akeo Consulting Rufus 3.0 and earlier is affected by: Insecure Permissions.Akeo Consulting Rufus
- CVE-2019-1010100Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking.Akeo Consulting Rufus
- CVE-2019-1010113Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting (XSS).Premium Software CLEditor · CLEditor
- CVE-2019-1167A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC eMicrosoft PowerShell Core · System.Management.Automation
- CVE-2019-1010245The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation.The Linux Foundation ONOS SDN Controller
- CVE-2019-13979In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/_/originals remote code execution.
- CVE-2019-13980In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads/_/originals
- CVE-2019-13981In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ di
- CVE-2019-13982interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview.
- CVE-2019-13983Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php
- CVE-2019-13984Directus 7 API before 2.3.0 does not validate uploaded files.
- CVE-2019-1010247ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS).ZmartZone IAM mod_auth_openidc
- CVE-2019-12946Elcom CMS before 10.7 has SQL Injection via EventSearchByState.aspx and EventSearchAdv.aspx.
- CVE-2019-1010151zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell.zzcms zzmcms
- CVE-2019-11552Code42 Enterprise and Crashplan for Small Business Client version 6.7 before 6.7.5, 6.8 before 6.8.8, and 6.9 before 6.9.4 allows eval injec
- CVE-2019-13648In the Linux kernel through 5.2.1 on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial o
- CVE-2019-13978Ovidentia 8.4.3 has SQL Injection via the id parameter in an index.php?tg=delegat&idx=mem request.
- CVE-2019-13977index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=create, tg=site&item=4,
- CVE-2019-13974LayerBB 1.1.3 allows conversations.php/cmd/new CSRF.
- CVE-2019-13973LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the custom_logo filename suffix is not restricted, and .php may be used
- CVE-2019-13972LayerBB 1.1.3 allows XSS via the application/commands/new.php pm_title variable, a related issue to CVE-2019-17997.
- CVE-2019-13971OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request.
- CVE-2019-13970In antSword before 2.1.0, self-XSS in the database configuration leads to code execution via modules/database/asp/index.js, modules/databaseantsword
- CVE-2019-13969Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=ui_set&m=admin&c=index&a=doget_text_content&table=lang&field=1