CVEs published July 25, 2019

69 CVEs were published on July 25, 2019: 2 critical, 0 high.

Published: 69
Critical: 2
High: 0
Medium: 7
Low: 0
Unrated: 60
Now in CISA KEV: 0
Fix available: 13

Most affected products

Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…: 18
Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…: 6
Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…: 6
Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…: 4
IBM Cloud Private: 3
BroadLearning eclass: 2
Mitsubishi Electric FR Configurator2: 2
Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…: 2
Apache Storm · org.apache.storm:storm-core: 1
Apache Storm · org.apache.storm:storm-kafka +1: 1

Critical 2

CVE-2019-9885eClass platform contains a SQL injection vulnerabilityBroadLearning eclassCritical · 9.8Fix availableJul 25, 2019
CVE-2019-9884eClass platform contains a Broken Access Control vulnerabilityBroadLearning eclassCritical · 9.8Fix availableJul 25, 2019

Medium, low and unrated 67

CVE-2019-10744Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution.Snyk lodash · lodash +4UnratedFix availableJul 25, 2019
CVE-2019-10974NREL EnergyPlus, Versions 8.6.0 and possibly prior versions, The application fails to prevent an exception handler from being overwritten wiNational Renewable Energy Laboratory (NREL) EnergyPlusUnratedJul 25, 2019
CVE-2019-10972Mitsubishi Electric FR Configurator2, Version 1.16S and prior.Mitsubishi Electric FR Configurator2UnratedJul 25, 2019
CVE-2019-10976Mitsubishi Electric FR Configurator2, Version 1.16S and prior.Mitsubishi Electric FR Configurator2UnratedJul 25, 2019
CVE-2018-11779In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the SApache Storm · org.apache.storm:storm-kafka +1UnratedFix availableJul 25, 2019
CVE-2019-0202The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm.Apache Storm · org.apache.storm:storm-coreUnratedFix availableJul 25, 2019
CVE-2019-1010147Yellowfin Smart Reporting All Versions Prior to 7.3 is affected by: Incorrect Access Control - Privileges Escalation.Yellowfin Smart ReportingUnratedJul 25, 2019
CVE-2019-11921An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 wFacebook ProxygenUnratedFix availableJul 25, 2019
CVE-2019-10184undertow before version 2.0.23.Final is vulnerable to an information leak issue.undertow-io undertow · io.undertow:undertow-servletMedium · 5.3Fix availableJul 25, 2019
CVE-2019-11922A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bouFacebook ZstandardUnratedFix availableJul 25, 2019
CVE-2019-13483Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing.passport-sharepointUnratedFix availableJul 25, 2019
CVE-2019-13917Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansionUnratedJul 25, 2019
CVE-2019-1010127VCFTools vcftools prior to version 0.1.15 is affected by: Use-after-free.vcftoolsUnratedFix availableJul 25, 2019
CVE-2019-2343Out of bound read and information disclosure in firmware due to insufficient checking of an embedded structure that can be sent from a kerneQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2019-2345Race condition while accessing DMA buffer in jpeg driver in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon InQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…UnratedJul 25, 2019
CVE-2019-2346Firmware is getting into loop of overwriting memory when scan command is given from host because of improper validation.Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…UnratedJul 25, 2019
CVE-2019-2278User keystore signature is ignored in boot and can lead to bypass boot image signature verification in Snapdragon Auto, Snapdragon Consumer Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…UnratedJul 25, 2019
CVE-2019-2281An unauthenticated bitmap image can be loaded in to memory and subsequently cause execution of unverified code.Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…UnratedJul 25, 2019
CVE-2019-2290Multiple open and close from multiple threads will lead camera driver to access destroyed session data pointer in Snapdragon Auto, SnapdragoQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…UnratedJul 25, 2019
CVE-2019-2293Pointer dereference while freeing IFE resources due to lack of length check of in port resource.Qualcomm Snapdragon Consumer IOT, Snapdragon Industrial IOT…UnratedJul 25, 2019
CVE-2019-2298Protection is missing while accessing md sessions info via macro which can lead to use-after-free in Snapdragon Auto, Snapdragon Compute, SnQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2019-2299An out-of-bound write can be triggered by a specially-crafted command supplied by a userspace application.Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…UnratedJul 25, 2019
CVE-2019-2301Possibility of out-of-bound read if id received from SPI is not in range of FIFO in Snapdragon Auto, Snapdragon Compute, Snapdragon ConsumerQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2019-2305Out of bound access when reason code is extracted from frame data without validating the frame length in Snapdragon Auto, Snapdragon ConsumeQualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…UnratedJul 25, 2019
CVE-2019-2306Improper casting of structure while handling the buffer leads to out of bound read in display in Snapdragon Auto, Snapdragon Connectivity, SQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…UnratedJul 25, 2019
CVE-2019-2307Possible integer underflow due to lack of validation before calculation of data length in 802.11 Rx management configuration in Snapdragon AQualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…UnratedJul 25, 2019
CVE-2019-2308User application could potentially make RPC call to the fastrpc driver and the driver will allow the message to go through to the remote subQualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…UnratedJul 25, 2019
CVE-2019-2309While storing calibrated data from firmware in cache, An integer overflow may occur since data length received may exceed real data length.Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…UnratedJul 25, 2019
CVE-2019-2312When handling the vendor command there exists a potential buffer overflow due to lack of input validation of data buffer received in SnapdraQualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…UnratedJul 25, 2019
CVE-2019-2314Possible race condition that will cause a use-after-free when writing to two sysfs entries at nearly the same time in Snapdragon Compute, SnQualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…UnratedJul 25, 2019
CVE-2019-2316When computing the digest a local variable is used after going out of scope in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…UnratedJul 25, 2019
CVE-2019-2322Buffer overflow can occur when playing specific clip which is non-standard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2019-2326Data token is received from ADSP and is used without validation as an index into the array leads to out of bound access in Snapdragon Auto, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2019-2327Possible buffer overflow can occur when playing clip with incorrect element size in Snapdragon Auto, Snapdragon Compute, Snapdragon ConsumerQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2019-2328Possible buffer overflow when number of channels passed is more than size of channel mapping array in Snapdragon Auto, Snapdragon Compute, SQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2019-2330improper input validation in allocation request for secure allocations can lead to page fault.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2019-2334Null pointer dereferencing can happen when playing the clip with wrong block group id in Snapdragon Auto, Snapdragon Compute, Snapdragon ConQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2018-13897Clients hostname gets added to DNS record on device which is running dnsmasq resulting in an information exposure in Snapdragon Auto, SnapdrQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…UnratedJul 25, 2019
CVE-2019-2235Buffer overflow occurs when emulated RPMB is used due to sector size assumptions in the TA rollback protection logic.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2019-2236Null pointer dereference during secure application termination using specific application ids.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2019-2237Failure in taking appropriate action to handle the error case If keypad gpio deactivation fails leads to silent failure scenario and subsequQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2019-2238Lack of check of data type can lead to subsequent loop-expression potentially go negative and the condition will still evaluate to true leadQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2019-2239Sanity checks are missing in layout which can lead to SUI Corruption or can lead to Denial of Service in Snapdragon Auto, Snapdragon ComputeQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2019-2240While sending the rendered surface content to the screen, Error handling is not properly checked results in an unpredictable behaviour in SnQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2019-2241While rendering the layout background, Error status check is not caught properly and also incorrect status handling is being done leading toQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2019-2253Buffer over-read can occur while parsing an ogg file with a corrupted comment block.Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…UnratedJul 25, 2019
CVE-2019-2254Position determination accuracy may be degraded due to wrongly decoded information in Snapdragon Auto, Snapdragon Compute, Snapdragon ConsumQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2019-2263Access to freed memory can happen while reading from diag driver due to use after free issue in Snapdragon Auto, Snapdragon Connectivity, SnQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…UnratedJul 25, 2019
CVE-2019-2272Buffer overflow can occur in display function due to lack of validation of header block size set by user.Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…UnratedJul 25, 2019
CVE-2019-2273IOMMU page fault while playing h265 video file leads to denial of service issue in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectivQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…UnratedJul 25, 2019
CVE-2019-2276Possible out of bound read occurs while processing beaconing request due to lack of check on action frames received from user controlled spaQualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…UnratedJul 25, 2019
CVE-2019-14270Comodo Antivirus through 12.0.0.6870, Comodo Firewall through 12.0.0.6870, and Comodo Internet Security Premium through 12.0.0.6870, with thUnratedJul 25, 2019
CVE-2019-3621DLP Endpoint Windows lock screen bypass with physical accessMcAfee Data Loss Prevention (DLPe) for WindowsMedium · 6.8Fix availableJul 25, 2019
CVE-2019-14268In Octopus Deploy versions 3.0.19 to 2019.7.2, when a web request proxy is configured, an authenticated user (in certain limited circumstancUnratedJul 25, 2019
CVE-2019-14266OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in ApplicatiUnratedJul 25, 2019
CVE-2019-4439IBM Cloud Private 3.1.0, 3.1.1, and 3.1.2 does not invalidate session after logout which could allow a local user to impersonate another useIBM Cloud PrivateMedium · 5.9Jul 25, 2019
CVE-2019-4415IBM Cloud Private 3.1.1 and 3.1.2 could allow a local user to obtain elevated privileges due to improper security context constraints.IBM Cloud PrivateMedium · 4.9Jul 25, 2019
CVE-2019-4212IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized IBM QRadar SIEMMedium · 4.3Jul 25, 2019
CVE-2019-4116IBM Cloud Private 2.1.0, 3.1.0, and 3.1.1 could disclose highly sensitive information in installer logs that could be use for further attackIBM Cloud PrivateMedium · 5.5Jul 25, 2019
CVE-2019-3486ArcSight Security Management Center stored cross site script issue in version prior to 2.9.1Micro Focus Arcsight Security Management CenterMedium · 4.6Fix availableJul 25, 2019
CVE-2019-1010161perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control.perl-CRYPT-JWTUnratedJul 25, 2019
CVE-2019-1010172Jsish 2.4.84 2.0484 is affected by: Uncontrolled Resource Consumption.JsishUnratedJul 25, 2019
CVE-2019-1010174CImg The CImg Library v.2.3.3 and earlier is affected by: command injection.The CImg LibraryUnratedJul 25, 2019
CVE-2019-1010176JerryScript commit 4e58ccf68070671e1fff5cd6673f0c1d5b80b166 is affected by: Buffer Overflow.JerryScriptUnratedJul 25, 2019
CVE-2019-1010182yaml-rust 0.4.0 and earlier is affected by: Uncontrolled Recursion.yaml-rustUnratedJul 25, 2019
CVE-2019-1010183serde serde_yaml 0.6.0 to 0.8.3 is affected by: Uncontrolled Recursion.serde_yamlUnratedJul 25, 2019
CVE-2019-14262MetadataExtractor 2.1.0 allows stack consumption.MetadataExtractorUnratedFix availableJul 25, 2019