CVEs published July 26, 2019
36 CVEs were published on July 26, 2019: 1 critical, 0 high.
- Published
- 36
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 35
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- FreeBSD
- 5
- datagrid
- 1
- LINE Central Dogma
- 1
- org.quartz-scheduler:quartz
- 1
- samlr
- 1
- simple_captcha2
- 1
- Trend Micro OfficeScan
- 1
Critical 1
Medium, low and unrated 35
- CVE-2019-13588A cross-site scripting (XSS) vulnerability in getPagingStart() in core/lists/PAGING.php in WIKINDX before 5.8.2 allows remote attackers to i
- CVE-2019-10267An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50.
- CVE-2019-10266An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50.
- CVE-2019-10265An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50.
- CVE-2019-10264An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50.
- CVE-2019-10263An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50.
- CVE-2019-9492A DLL side-loading vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow an authenticated attacker to gain code execution and Trend Micro OfficeScan
- CVE-2019-6002Cross-site scripting vulnerability in Central Dogma 0.17.0 to 0.40.1 allows remote attackers to inject arbitrary web script or HTML via unspLINE Central Dogma
- CVE-2019-14228Xavier PHP Management Panel 3.0 is vulnerable to Reflected POST-based XSS via the username parameter when registering a new user at admin/in
- CVE-2019-13565An issue was discovered in OpenLDAP 2.x before 2.4.48.
- CVE-2019-13382UploaderService in SnagIT 2019.1.2 allows elevation of privilege by placing an invalid presentation file in %PROGRAMDATA%\TechSmith\TechSmit
- CVE-2019-14284In the Linux kernel before 5.2.3, drivers/block/floppy.c allows a denial of service by setup_format_params division-by-zero.
- CVE-2019-14283In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an i
- CVE-2019-13638GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an e
- CVE-2019-13057An issue was discovered in the server in OpenLDAP before 2.4.48.
- CVE-2019-13954Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to memory exhaustion.
- CVE-2019-13955Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion.
- CVE-2019-13387In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter fm_current_dir) allows attackers t
- CVE-2019-13386In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a she
- CVE-2019-13385In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to enum
- CVE-2018-20857Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as a name_id node with user@example.com followed by <!---->.samlr
- CVE-2018-20856An issue was discovered in the Linux kernel before 4.18.7.
- CVE-2018-20855An issue was discovered in the Linux kernel before 4.18.7.
- CVE-2018-20854An issue was discovered in the Linux kernel before 4.20.
- CVE-2019-14282The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.simple_captcha2
- CVE-2019-14281The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.datagrid
- CVE-2019-14280In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured
- CVE-2019-14277Axway SecureTransport 5.x through 5.3 (or 5.x through 5.5 with certain API configuration) is vulnerable to unauthenticated blind XML injecti
- CVE-2019-14275Xfig fig2dev 3.2.7a has a stack-based buffer overflow in the calc_arrow function in bound.c.
- CVE-2019-14274MCPP 2.7.2 has a heap-based buffer overflow in the do_msg() function in support.c.
- CVE-2019-5606In FreeBSD 12.0-STABLE before r349805, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r349806, 11.3-RELEASE before 11.3-RELEASE-p1,FreeBSD
- CVE-2019-5607In FreeBSD 12.0-STABLE before r350222, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350223, 11.3-RELEASE before 11.3-RELEASE-p1,FreeBSD
- CVE-2019-5604In FreeBSD 12.0-STABLE before r350246, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350247, 11.3-RELEASE before 11.3-RELEASE-p1,FreeBSD
- CVE-2019-5603In FreeBSD 12.0-STABLE before r350261, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350263, 11.3-RELEASE before 11.3-RELEASE-p1,FreeBSD
- CVE-2019-5605In FreeBSD 11.3-STABLE before r350217, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, due to insufficient inFreeBSD