# CVEs published 2019-07-26

36 CVEs were published on July 26, 2019: 1 critical, 0 high. Days are UTC.

- [CVE-2019-13588](https://cve.now/CVE-2019-13588.md): A cross-site scripting (XSS) vulnerability in getPagingStart() in core/lists/PAGING.php in WIKINDX before 5.8.2 allows remote attackers to i (no CVSS)
- [CVE-2019-10267](https://cve.now/CVE-2019-10267.md): An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. (no CVSS)
- [CVE-2019-10266](https://cve.now/CVE-2019-10266.md): An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. (no CVSS)
- [CVE-2019-10265](https://cve.now/CVE-2019-10265.md): An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. (no CVSS)
- [CVE-2019-10264](https://cve.now/CVE-2019-10264.md): An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. (no CVSS)
- [CVE-2019-10263](https://cve.now/CVE-2019-10263.md): An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. (no CVSS)
- [CVE-2019-9492](https://cve.now/CVE-2019-9492.md): A DLL side-loading vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow an authenticated attacker to gain code execution and (no CVSS, Trend Micro OfficeScan)
- [CVE-2019-6002](https://cve.now/CVE-2019-6002.md): Cross-site scripting vulnerability in Central Dogma 0.17.0 to 0.40.1 allows remote attackers to inject arbitrary web script or HTML via unsp (no CVSS, LINE Central Dogma)
- [CVE-2019-14228](https://cve.now/CVE-2019-14228.md): Xavier PHP Management Panel 3.0 is vulnerable to Reflected POST-based XSS via the username parameter when registering a new user at admin/in (no CVSS)
- [CVE-2019-13565](https://cve.now/CVE-2019-13565.md): An issue was discovered in OpenLDAP 2.x before 2.4.48. (no CVSS)
- [CVE-2019-13382](https://cve.now/CVE-2019-13382.md): UploaderService in SnagIT 2019.1.2 allows elevation of privilege by placing an invalid presentation file in %PROGRAMDATA%\\TechSmith\\TechSmit (no CVSS)
- [CVE-2019-14284](https://cve.now/CVE-2019-14284.md): In the Linux kernel before 5.2.3, drivers/block/floppy.c allows a denial of service by setup\_format\_params division-by-zero. (no CVSS)
- [CVE-2019-14283](https://cve.now/CVE-2019-14283.md): In the Linux kernel before 5.2.3, set\_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an i (no CVSS)
- [CVE-2019-13638](https://cve.now/CVE-2019-13638.md): GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an e (no CVSS)
- [CVE-2019-13057](https://cve.now/CVE-2019-13057.md): An issue was discovered in the server in OpenLDAP before 2.4.48. (no CVSS)
- [CVE-2019-13954](https://cve.now/CVE-2019-13954.md): Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to memory exhaustion. (no CVSS)
- [CVE-2019-13955](https://cve.now/CVE-2019-13955.md): Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. (no CVSS)
- [CVE-2019-13387](https://cve.now/CVE-2019-13387.md): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter fm\_current\_dir) allows attackers t (no CVSS)
- [CVE-2019-13386](https://cve.now/CVE-2019-13386.md): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a she (no CVSS)
- [CVE-2019-13385](https://cve.now/CVE-2019-13385.md): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to enum (no CVSS)
- [CVE-2018-20857](https://cve.now/CVE-2018-20857.md): Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as a name\_id node with user@example.com followed by \<!----\>. (no CVSS, samlr)
- [CVE-2018-20856](https://cve.now/CVE-2018-20856.md): An issue was discovered in the Linux kernel before 4.18.7. (no CVSS)
- [CVE-2018-20855](https://cve.now/CVE-2018-20855.md): An issue was discovered in the Linux kernel before 4.18.7. (no CVSS)
- [CVE-2018-20854](https://cve.now/CVE-2018-20854.md): An issue was discovered in the Linux kernel before 4.20. (no CVSS)
- [CVE-2019-14282](https://cve.now/CVE-2019-14282.md): The simple\_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. (no CVSS, simple\_captcha2)
- [CVE-2019-14281](https://cve.now/CVE-2019-14281.md): The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. (no CVSS, datagrid)
- [CVE-2019-14280](https://cve.now/CVE-2019-14280.md): In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured (no CVSS)
- [CVE-2019-14277](https://cve.now/CVE-2019-14277.md): Axway SecureTransport 5.x through 5.3 (or 5.x through 5.5 with certain API configuration) is vulnerable to unauthenticated blind XML injecti (no CVSS)
- [CVE-2019-14275](https://cve.now/CVE-2019-14275.md): Xfig fig2dev 3.2.7a has a stack-based buffer overflow in the calc\_arrow function in bound.c. (no CVSS)
- [CVE-2019-14274](https://cve.now/CVE-2019-14274.md): MCPP 2.7.2 has a heap-based buffer overflow in the do\_msg() function in support.c. (no CVSS)
- [CVE-2019-5606](https://cve.now/CVE-2019-5606.md): In FreeBSD 12.0-STABLE before r349805, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r349806, 11.3-RELEASE before 11.3-RELEASE-p1, (no CVSS, FreeBSD)
- [CVE-2019-5607](https://cve.now/CVE-2019-5607.md): In FreeBSD 12.0-STABLE before r350222, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350223, 11.3-RELEASE before 11.3-RELEASE-p1, (no CVSS, FreeBSD)
- [CVE-2019-5604](https://cve.now/CVE-2019-5604.md): In FreeBSD 12.0-STABLE before r350246, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350247, 11.3-RELEASE before 11.3-RELEASE-p1, (no CVSS, FreeBSD)
- [CVE-2019-5603](https://cve.now/CVE-2019-5603.md): In FreeBSD 12.0-STABLE before r350261, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350263, 11.3-RELEASE before 11.3-RELEASE-p1, (no CVSS, FreeBSD)
- [CVE-2019-5605](https://cve.now/CVE-2019-5605.md): In FreeBSD 11.3-STABLE before r350217, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, due to insufficient in (no CVSS, FreeBSD)
- [CVE-2019-13990](https://cve.now/CVE-2019-13990.md): initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job descript (CVSS 9.8, org.quartz-scheduler:quartz)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-07-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.