# CVEs published 2019-07-25

69 CVEs were published on July 25, 2019: 2 critical, 0 high. Days are UTC.

- [CVE-2019-10744](https://cve.now/CVE-2019-10744.md): Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. (no CVSS, Snyk lodash · lodash +4)
- [CVE-2019-10974](https://cve.now/CVE-2019-10974.md): NREL EnergyPlus, Versions 8.6.0 and possibly prior versions, The application fails to prevent an exception handler from being overwritten wi (no CVSS, National Renewable Energy Laboratory (NREL) EnergyPlus)
- [CVE-2019-10972](https://cve.now/CVE-2019-10972.md): Mitsubishi Electric FR Configurator2, Version 1.16S and prior. (no CVSS, Mitsubishi Electric FR Configurator2)
- [CVE-2019-10976](https://cve.now/CVE-2019-10976.md): Mitsubishi Electric FR Configurator2, Version 1.16S and prior. (no CVSS, Mitsubishi Electric FR Configurator2)
- [CVE-2018-11779](https://cve.now/CVE-2018-11779.md): In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the S (no CVSS, Apache Storm · org.apache.storm:storm-kafka +1)
- [CVE-2019-0202](https://cve.now/CVE-2019-0202.md): The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. (no CVSS, Apache Storm · org.apache.storm:storm-core)
- [CVE-2019-1010147](https://cve.now/CVE-2019-1010147.md): Yellowfin Smart Reporting All Versions Prior to 7.3 is affected by: Incorrect Access Control - Privileges Escalation. (no CVSS, Yellowfin Smart Reporting)
- [CVE-2019-11921](https://cve.now/CVE-2019-11921.md): An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 w (no CVSS, Facebook Proxygen)
- [CVE-2019-10184](https://cve.now/CVE-2019-10184.md): undertow before version 2.0.23.Final is vulnerable to an information leak issue. (CVSS 5.3, undertow-io undertow · io.undertow:undertow-servlet)
- [CVE-2019-11922](https://cve.now/CVE-2019-11922.md): A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bou (no CVSS, Facebook Zstandard)
- [CVE-2019-13483](https://cve.now/CVE-2019-13483.md): Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. (no CVSS, passport-sharepoint)
- [CVE-2019-13917](https://cve.now/CVE-2019-13917.md): Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion (no CVSS)
- [CVE-2019-1010127](https://cve.now/CVE-2019-1010127.md): VCFTools vcftools prior to version 0.1.15 is affected by: Use-after-free. (no CVSS, vcftools)
- [CVE-2019-2343](https://cve.now/CVE-2019-2343.md): Out of bound read and information disclosure in firmware due to insufficient checking of an embedded structure that can be sent from a kerne (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2345](https://cve.now/CVE-2019-2345.md): Race condition while accessing DMA buffer in jpeg driver in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon In (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2019-2346](https://cve.now/CVE-2019-2346.md): Firmware is getting into loop of overwriting memory when scan command is given from host because of improper validation. (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…)
- [CVE-2019-2278](https://cve.now/CVE-2019-2278.md): User keystore signature is ignored in boot and can lead to bypass boot image signature verification in Snapdragon Auto, Snapdragon Consumer (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-2281](https://cve.now/CVE-2019-2281.md): An unauthenticated bitmap image can be loaded in to memory and subsequently cause execution of unverified code. (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…)
- [CVE-2019-2290](https://cve.now/CVE-2019-2290.md): Multiple open and close from multiple threads will lead camera driver to access destroyed session data pointer in Snapdragon Auto, Snapdrago (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2019-2293](https://cve.now/CVE-2019-2293.md): Pointer dereference while freeing IFE resources due to lack of length check of in port resource. (no CVSS, Qualcomm Snapdragon Consumer IOT, Snapdragon Industrial IOT…)
- [CVE-2019-2298](https://cve.now/CVE-2019-2298.md): Protection is missing while accessing md sessions info via macro which can lead to use-after-free in Snapdragon Auto, Snapdragon Compute, Sn (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2299](https://cve.now/CVE-2019-2299.md): An out-of-bound write can be triggered by a specially-crafted command supplied by a userspace application. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-2301](https://cve.now/CVE-2019-2301.md): Possibility of out-of-bound read if id received from SPI is not in range of FIFO in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2305](https://cve.now/CVE-2019-2305.md): Out of bound access when reason code is extracted from frame data without validating the frame length in Snapdragon Auto, Snapdragon Consume (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-2306](https://cve.now/CVE-2019-2306.md): Improper casting of structure while handling the buffer leads to out of bound read in display in Snapdragon Auto, Snapdragon Connectivity, S (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2019-2307](https://cve.now/CVE-2019-2307.md): Possible integer underflow due to lack of validation before calculation of data length in 802.11 Rx management configuration in Snapdragon A (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-2308](https://cve.now/CVE-2019-2308.md): User application could potentially make RPC call to the fastrpc driver and the driver will allow the message to go through to the remote sub (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-2309](https://cve.now/CVE-2019-2309.md): While storing calibrated data from firmware in cache, An integer overflow may occur since data length received may exceed real data length. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-2312](https://cve.now/CVE-2019-2312.md): When handling the vendor command there exists a potential buffer overflow due to lack of input validation of data buffer received in Snapdra (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-2314](https://cve.now/CVE-2019-2314.md): Possible race condition that will cause a use-after-free when writing to two sysfs entries at nearly the same time in Snapdragon Compute, Sn (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…)
- [CVE-2019-2316](https://cve.now/CVE-2019-2316.md): When computing the digest a local variable is used after going out of scope in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-2322](https://cve.now/CVE-2019-2322.md): Buffer overflow can occur when playing specific clip which is non-standard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2326](https://cve.now/CVE-2019-2326.md): Data token is received from ADSP and is used without validation as an index into the array leads to out of bound access in Snapdragon Auto, (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2327](https://cve.now/CVE-2019-2327.md): Possible buffer overflow can occur when playing clip with incorrect element size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2328](https://cve.now/CVE-2019-2328.md): Possible buffer overflow when number of channels passed is more than size of channel mapping array in Snapdragon Auto, Snapdragon Compute, S (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2330](https://cve.now/CVE-2019-2330.md): improper input validation in allocation request for secure allocations can lead to page fault. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2334](https://cve.now/CVE-2019-2334.md): Null pointer dereferencing can happen when playing the clip with wrong block group id in Snapdragon Auto, Snapdragon Compute, Snapdragon Con (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-13897](https://cve.now/CVE-2018-13897.md): Clients hostname gets added to DNS record on device which is running dnsmasq resulting in an information exposure in Snapdragon Auto, Snapdr (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2019-2235](https://cve.now/CVE-2019-2235.md): Buffer overflow occurs when emulated RPMB is used due to sector size assumptions in the TA rollback protection logic. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2236](https://cve.now/CVE-2019-2236.md): Null pointer dereference during secure application termination using specific application ids. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2237](https://cve.now/CVE-2019-2237.md): Failure in taking appropriate action to handle the error case If keypad gpio deactivation fails leads to silent failure scenario and subsequ (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2238](https://cve.now/CVE-2019-2238.md): Lack of check of data type can lead to subsequent loop-expression potentially go negative and the condition will still evaluate to true lead (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2239](https://cve.now/CVE-2019-2239.md): Sanity checks are missing in layout which can lead to SUI Corruption or can lead to Denial of Service in Snapdragon Auto, Snapdragon Compute (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2240](https://cve.now/CVE-2019-2240.md): While sending the rendered surface content to the screen, Error handling is not properly checked results in an unpredictable behaviour in Sn (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2241](https://cve.now/CVE-2019-2241.md): While rendering the layout background, Error status check is not caught properly and also incorrect status handling is being done leading to (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2253](https://cve.now/CVE-2019-2253.md): Buffer over-read can occur while parsing an ogg file with a corrupted comment block. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2019-2254](https://cve.now/CVE-2019-2254.md): Position determination accuracy may be degraded due to wrongly decoded information in Snapdragon Auto, Snapdragon Compute, Snapdragon Consum (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2263](https://cve.now/CVE-2019-2263.md): Access to freed memory can happen while reading from diag driver due to use after free issue in Snapdragon Auto, Snapdragon Connectivity, Sn (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2019-2272](https://cve.now/CVE-2019-2272.md): Buffer overflow can occur in display function due to lack of validation of header block size set by user. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-2273](https://cve.now/CVE-2019-2273.md): IOMMU page fault while playing h265 video file leads to denial of service issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectiv (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2276](https://cve.now/CVE-2019-2276.md): Possible out of bound read occurs while processing beaconing request due to lack of check on action frames received from user controlled spa (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-14270](https://cve.now/CVE-2019-14270.md): Comodo Antivirus through 12.0.0.6870, Comodo Firewall through 12.0.0.6870, and Comodo Internet Security Premium through 12.0.0.6870, with th (no CVSS)
- [CVE-2019-9885](https://cve.now/CVE-2019-9885.md): eClass platform contains a SQL injection vulnerability (CVSS 9.8, BroadLearning eclass)
- [CVE-2019-9884](https://cve.now/CVE-2019-9884.md): eClass platform contains a Broken Access Control vulnerability (CVSS 9.8, BroadLearning eclass)
- [CVE-2019-3621](https://cve.now/CVE-2019-3621.md): DLP Endpoint Windows lock screen bypass with physical access (CVSS 6.8, McAfee Data Loss Prevention (DLPe) for Windows)
- [CVE-2019-14268](https://cve.now/CVE-2019-14268.md): In Octopus Deploy versions 3.0.19 to 2019.7.2, when a web request proxy is configured, an authenticated user (in certain limited circumstanc (no CVSS)
- [CVE-2019-14266](https://cve.now/CVE-2019-14266.md): OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Applicati (no CVSS)
- [CVE-2019-4439](https://cve.now/CVE-2019-4439.md): IBM Cloud Private 3.1.0, 3.1.1, and 3.1.2 does not invalidate session after logout which could allow a local user to impersonate another use (CVSS 5.9, IBM Cloud Private)
- [CVE-2019-4415](https://cve.now/CVE-2019-4415.md): IBM Cloud Private 3.1.1 and 3.1.2 could allow a local user to obtain elevated privileges due to improper security context constraints. (CVSS 4.9, IBM Cloud Private)
- [CVE-2019-4212](https://cve.now/CVE-2019-4212.md): IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized (CVSS 4.3, IBM QRadar SIEM)
- [CVE-2019-4116](https://cve.now/CVE-2019-4116.md): IBM Cloud Private 2.1.0, 3.1.0, and 3.1.1 could disclose highly sensitive information in installer logs that could be use for further attack (CVSS 5.5, IBM Cloud Private)
- [CVE-2019-3486](https://cve.now/CVE-2019-3486.md): ArcSight Security Management Center stored cross site script issue in version prior to 2.9.1 (CVSS 4.6, Micro Focus Arcsight Security Management Center)
- [CVE-2019-1010161](https://cve.now/CVE-2019-1010161.md): perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. (no CVSS, perl-CRYPT-JWT)
- [CVE-2019-1010172](https://cve.now/CVE-2019-1010172.md): Jsish 2.4.84 2.0484 is affected by: Uncontrolled Resource Consumption. (no CVSS, Jsish)
- [CVE-2019-1010174](https://cve.now/CVE-2019-1010174.md): CImg The CImg Library v.2.3.3 and earlier is affected by: command injection. (no CVSS, The CImg Library)
- [CVE-2019-1010176](https://cve.now/CVE-2019-1010176.md): JerryScript commit 4e58ccf68070671e1fff5cd6673f0c1d5b80b166 is affected by: Buffer Overflow. (no CVSS, JerryScript)
- [CVE-2019-1010182](https://cve.now/CVE-2019-1010182.md): yaml-rust 0.4.0 and earlier is affected by: Uncontrolled Recursion. (no CVSS, yaml-rust)
- [CVE-2019-1010183](https://cve.now/CVE-2019-1010183.md): serde serde\_yaml 0.6.0 to 0.8.3 is affected by: Uncontrolled Recursion. (no CVSS, serde\_yaml)
- [CVE-2019-14262](https://cve.now/CVE-2019-14262.md): MetadataExtractor 2.1.0 allows stack consumption. (no CVSS, MetadataExtractor)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-07-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.