# CVEs published 2019-07-19

50 CVEs were published on July 19, 2019: 0 critical, 2 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-12934](https://cve.now/CVE-2019-12934.md): An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. (no CVSS)
- [CVE-2018-17210](https://cve.now/CVE-2018-17210.md): An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. (no CVSS)
- [CVE-2019-9229](https://cve.now/CVE-2019-9229.md): An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A. (no CVSS)
- [CVE-2019-12815](https://cve.now/CVE-2019-12815.md): An arbitrary file copy vulnerability in mod\_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without (no CVSS)
- [CVE-2019-9228](https://cve.now/CVE-2019-9228.md): An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A at least t (no CVSS)
- [CVE-2019-13569](https://cve.now/CVE-2019-13569.md): A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. (no CVSS)
- [CVE-2019-12725](https://cve.now/CVE-2019-12725.md): Zeroshell 3.9.0 is prone to a remote command execution vulnerability. (no CVSS)
- [CVE-2019-11990](https://cve.now/CVE-2019-11990.md): Security vulnerabilities in HPE UIoT versions 1.6, 1.5, 1.4.2, 1.4.1, 1.4.0, and 1.2.4.2 could allow unauthorized remote access and access t (no CVSS, HPE IOT and GCP)
- [CVE-2019-11989](https://cve.now/CVE-2019-11989.md): A security vulnerability in HPE IceWall SSO Agent Option and IceWall MFA (Agent module ) could be exploited remotely to cause a denial of se (no CVSS, IceWall SSO Agent Option; HPE IceWall MFA 4.0EE MFA. Server…)
- [CVE-2019-1579](https://cve.now/CVE-2019-1579.md): Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or (CVSS 8.1, KEV, Palo Alto Networks GlobalProtect Portal/Gateway Interface)
- [CVE-2019-7590](https://cve.now/CVE-2019-7590.md): exacqVision Server Unquoted Service Path (CVSS 6.7, Exacq Technologies exacqVision Server)
- [CVE-2019-13991](https://cve.now/CVE-2019-13991.md): Embedded systems based on Arduino before Rev3 allow remote attackers to send data to LEDs (directly connected to GPIO pins) via a laser, bec (no CVSS)
- [CVE-2019-5680](https://cve.now/CVE-2019-5680.md): In NVIDIA Jetson TX1 L4T R32 version branch prior to R32.2, Tegra bootloader contains a vulnerability in nvtboot in which the nvtboot-cpu im (no CVSS, NVIDIA Jetson TX1)
- [CVE-2019-13989](https://cve.now/CVE-2019-13989.md): dpic 2019.06.20 has a Stack-based Buffer Overflow in the wfloat() function in main.c. (no CVSS)
- [CVE-2019-12821](https://cve.now/CVE-2019-12821.md): A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-co (no CVSS)
- [CVE-2019-12820](https://cve.now/CVE-2019-12820.md): A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. (no CVSS)
- [CVE-2019-12453](https://cve.now/CVE-2019-12453.md): In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input validation. (no CVSS)
- [CVE-2018-17792](https://cve.now/CVE-2018-17792.md): MDaemon Webmail (formerly WorldClient) has CSRF. (no CVSS)
- [CVE-2019-11553](https://cve.now/CVE-2019-11553.md): In Code42 for Enterprise through 6.8.4, an administrator without web restore permission but with the ability to manage users in an organizat (no CVSS)
- [CVE-2019-1010238](https://cve.now/CVE-2019-1010238.md): Gnome Pango 1.42 and later is affected by: Buffer Overflow. (no CVSS, Gnome Pango)
- [CVE-2019-1010239](https://cve.now/CVE-2019-1010239.md): DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. (no CVSS, DaveGamble/cJSON cJSON)
- [CVE-2019-1010241](https://cve.now/CVE-2019-1010241.md): Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. (no CVSS, Jenkins Credentials Binding Plugin Jenkins · org.jenkins-ci…)
- [CVE-2019-12193](https://cve.now/CVE-2019-12193.md): H3C H3Cloud OS all versions allows SQL injection via the ear/grid\_event sidx parameter. (no CVSS)
- [CVE-2019-1010142](https://cve.now/CVE-2019-1010142.md): scapy 2.4.0 is affected by: Denial of Service. (no CVSS, SecDev scapy · scapy)
- [CVE-2015-7882](https://cve.now/CVE-2015-7882.md): Authentication bypass when using LDAP authentication in MongoDB Enterprise Server (CVSS 8.1)
- [CVE-2019-1010136](https://cve.now/CVE-2019-1010136.md): ChinaMobile GPN2.4P21-C-CN W2001EN-00 is affected by: Incorrect Access Control - Unauthenticated Remote Reboot. (no CVSS, ChinaMobile GPN2.4P21-C-CN)
- [CVE-2019-1010101](https://cve.now/CVE-2019-1010101.md): Akeo Consulting Rufus 3.0 and earlier is affected by: Insecure Permissions. (no CVSS, Akeo Consulting Rufus)
- [CVE-2019-1010100](https://cve.now/CVE-2019-1010100.md): Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. (no CVSS, Akeo Consulting Rufus)
- [CVE-2019-1010113](https://cve.now/CVE-2019-1010113.md): Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting (XSS). (no CVSS, Premium Software CLEditor · CLEditor)
- [CVE-2019-1167](https://cve.now/CVE-2019-1167.md): A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC e (no CVSS, Microsoft PowerShell Core · System.Management.Automation)
- [CVE-2019-1010245](https://cve.now/CVE-2019-1010245.md): The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. (no CVSS, The Linux Foundation ONOS SDN Controller)
- [CVE-2019-13979](https://cve.now/CVE-2019-13979.md): In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/\_/originals remote code execution. (no CVSS)
- [CVE-2019-13980](https://cve.now/CVE-2019-13980.md): In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads/\_/originals (no CVSS)
- [CVE-2019-13981](https://cve.now/CVE-2019-13981.md): In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/\_/originals/ di (no CVSS)
- [CVE-2019-13982](https://cve.now/CVE-2019-13982.md): interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview. (no CVSS)
- [CVE-2019-13983](https://cve.now/CVE-2019-13983.md): Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php (no CVSS)
- [CVE-2019-13984](https://cve.now/CVE-2019-13984.md): Directus 7 API before 2.3.0 does not validate uploaded files. (no CVSS)
- [CVE-2019-1010247](https://cve.now/CVE-2019-1010247.md): ZmartZone IAM mod\_auth\_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). (no CVSS, ZmartZone IAM mod\_auth\_openidc)
- [CVE-2019-12946](https://cve.now/CVE-2019-12946.md): Elcom CMS before 10.7 has SQL Injection via EventSearchByState.aspx and EventSearchAdv.aspx. (no CVSS)
- [CVE-2019-1010151](https://cve.now/CVE-2019-1010151.md): zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. (no CVSS, zzcms zzmcms)
- [CVE-2019-11552](https://cve.now/CVE-2019-11552.md): Code42 Enterprise and Crashplan for Small Business Client version 6.7 before 6.7.5, 6.8 before 6.8.8, and 6.9 before 6.9.4 allows eval injec (no CVSS)
- [CVE-2019-13648](https://cve.now/CVE-2019-13648.md): In the Linux kernel through 5.2.1 on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial o (no CVSS)
- [CVE-2019-13978](https://cve.now/CVE-2019-13978.md): Ovidentia 8.4.3 has SQL Injection via the id parameter in an index.php?tg=delegat&idx=mem request. (no CVSS)
- [CVE-2019-13977](https://cve.now/CVE-2019-13977.md): index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=create, tg=site&item=4, (no CVSS)
- [CVE-2019-13974](https://cve.now/CVE-2019-13974.md): LayerBB 1.1.3 allows conversations.php/cmd/new CSRF. (no CVSS)
- [CVE-2019-13973](https://cve.now/CVE-2019-13973.md): LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the custom\_logo filename suffix is not restricted, and .php may be used (no CVSS)
- [CVE-2019-13972](https://cve.now/CVE-2019-13972.md): LayerBB 1.1.3 allows XSS via the application/commands/new.php pm\_title variable, a related issue to CVE-2019-17997. (no CVSS)
- [CVE-2019-13971](https://cve.now/CVE-2019-13971.md): OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request. (no CVSS)
- [CVE-2019-13970](https://cve.now/CVE-2019-13970.md): In antSword before 2.1.0, self-XSS in the database configuration leads to code execution via modules/database/asp/index.js, modules/database (no CVSS, antsword)
- [CVE-2019-13969](https://cve.now/CVE-2019-13969.md): Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=ui\_set&m=admin&c=index&a=doget\_text\_content&table=lang&field=1 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-07-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.