# CVEs published 2019-07-22

36 CVEs were published on July 22, 2019: 1 critical, 4 high. Days are UTC.

- [CVE-2019-12552](https://cve.now/CVE-2019-12552.md): In SweetScape 010 Editor 9.0.1, an integer overflow during the initialization of variables could allow an attacker to cause a denial of serv (no CVSS)
- [CVE-2019-12551](https://cve.now/CVE-2019-12551.md): In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the Memcpy function (provided by the scri (no CVSS)
- [CVE-2019-3414](https://cve.now/CVE-2019-3414.md): All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. (no CVSS, ZTE OTCP)
- [CVE-2019-12328](https://cve.now/CVE-2019-12328.md): A command injection (missing input validation) issue in the remote phonebook configuration URI in the web interface of the Atcom A10W VoIP p (CVSS 9.0)
- [CVE-2019-12327](https://cve.now/CVE-2019-12327.md): Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get access to the device via telnet. (CVSS 7.2)
- [CVE-2019-1010218](https://cve.now/CVE-2019-1010218.md): Cherokee Webserver Latest Cherokee Web server Upto Version 1.2.103 (Current stable) is affected by: Buffer Overflow - CWE-120. (no CVSS, Cherokee Webserver Latest Cherokee Web server)
- [CVE-2019-1010220](https://cve.now/CVE-2019-1010220.md): tcpdump.org tcpdump 4.9.2 is affected by: CWE-126: Buffer Over-read. (no CVSS, tcpdump.org tcpdump)
- [CVE-2019-1010228](https://cve.now/CVE-2019-1010228.md): OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. (no CVSS, OFFIS.de DCMTK)
- [CVE-2019-13096](https://cve.now/CVE-2019-13096.md): TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure storage. (no CVSS)
- [CVE-2019-12326](https://cve.now/CVE-2019-12326.md): Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a man (CVSS 7.2)
- [CVE-2019-13097](https://cve.now/CVE-2019-13097.md): The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are assumed to be immutab (no CVSS)
- [CVE-2019-12325](https://cve.now/CVE-2019-12325.md): The Htek UC902 VoIP phone web management interface contains several buffer overflow vulnerabilities in the firmware version 2.0.4.4.46, whic (CVSS 8.2)
- [CVE-2019-13098](https://cve.now/CVE-2019-13098.md): The user password via the registration form of TronLink Wallet 2.2.0 is stored in the log when the class CreateWalletTwoActivity is called. (no CVSS)
- [CVE-2019-13099](https://cve.now/CVE-2019-13099.md): The Momo application 2.1.9 for Android stores confidential information insecurely on the system (i.e., in cleartext), which allows a non-roo (no CVSS)
- [CVE-2019-12324](https://cve.now/CVE-2019-12324.md): A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on th (CVSS 7.2)
- [CVE-2019-13100](https://cve.now/CVE-2019-13100.md): The Send Anywhere application 9.4.18 for Android stores confidential information insecurely on the system (i.e., in cleartext), which allows (no CVSS)
- [CVE-2019-1010232](https://cve.now/CVE-2019-1010232.md): Juniper juniper/libslax libslax latest version (as of commit 084ddf6ab4a55b59dfa9a53f9c5f14d192c4f8e5 Commits on Sep 1, 2018) is affected by (no CVSS, juniper/libslax)
- [CVE-2019-1010234](https://cve.now/CVE-2019-1010234.md): The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. (no CVSS, The Linux Foundation ONOS)
- [CVE-2019-1010235](https://cve.now/CVE-2019-1010235.md): Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). (no CVSS, Frog CMS)
- [CVE-2019-1010237](https://cve.now/CVE-2019-1010237.md): Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). (no CVSS, Ilias)
- [CVE-2019-9959](https://cve.now/CVE-2019-9959.md): The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflo (no CVSS)
- [CVE-2018-13924](https://cve.now/CVE-2018-13924.md): Lack of check to prevent the buffer length taking negative values can lead to stack overflow. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-13927](https://cve.now/CVE-2018-13927.md): Debug policy with invalid signature can be loaded when the debug policy functionality is disabled by using the parallel image loading in Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2243](https://cve.now/CVE-2019-2243.md): Possible buffer overflow at the end of iterating loop while getting the version info and lead to information disclosure. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2260](https://cve.now/CVE-2019-2260.md): A race condition occurs while processing perf-event which can lead to a use after free condition in Snapdragon Auto, Snapdragon Compute, Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2261](https://cve.now/CVE-2019-2261.md): Unauthorized access from GPU subsystem to HLOS or other non secure subsystem memory can lead to information disclosure in Snapdragon Auto, S (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2264](https://cve.now/CVE-2019-2264.md): Null pointer dereference occurs for channel context while opening glink channel in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobi (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-2269](https://cve.now/CVE-2019-2269.md): Possible buffer overflow while processing the high level lim process action frame due to improper buffer length validation in Snapdragon Aut (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2277](https://cve.now/CVE-2019-2277.md): Out of bound read can happen due to lack of NULL termination on user controlled data in WLAN in Snapdragon Auto, Snapdragon Compute, Snapdra (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2279](https://cve.now/CVE-2019-2279.md): Shared memory gets updated with invalid data and may lead to access beyond the allocated memory. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2019-2287](https://cve.now/CVE-2019-2287.md): Improper validation for inputs received from firmware can lead to an out of bound write issue in video driver. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2292](https://cve.now/CVE-2019-2292.md): Out of bound access can occur due to buffer copy without checking size of input received from WLAN firmware in Snapdragon Auto, Snapdragon C (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2018-13896](https://cve.now/CVE-2018-13896.md): XBL\_SEC image authentication and other crypto related validations are accessible to a compromised OEM XBL Loader due to missing lock at XBL\_ (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-4267](https://cve.now/CVE-2019-4267.md): The IBM Spectrum Protect 7.1 and 8.1 Backup-Archive Client is vulnerable to a buffer overflow. (CVSS 4.9, IBM Spectrum Protect)
- [CVE-2019-4236](https://cve.now/CVE-2019-4236.md): A IBM Spectrum Protect 7.l client backup or archive operation running for an HP-UX VxFS object is silently skipping Access Control List (ACL (CVSS 5.1, IBM Spectrum Protect)
- [CVE-2018-2024](https://cve.now/CVE-2018-2024.md): IBM QRadar SIEM 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified (CVSS 4.2, IBM QRadar SIEM)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-07-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.