CVEs published July 29, 2019
87 CVEs were published on July 29, 2019: 3 critical, 5 high. 3 are now in CISA KEV.
- Published
- 87
- Critical
- 3
- High
- 5
- Medium
- 2
- Low
- 0
- Unrated
- 77
- Now in CISA KEV
- 3
- Fix available
- 24
Most affected products
- Microsoft Windows
- 19
- Apache VCL
- 3
- Microsoft Edge · Microsoft ChakraCore +1
- 3
- Discourse
- 2
- dolibarr/dolibarr
- 2
- Microsoft Excel · Microsoft Office
- 2
- Microsoft Exchange Server
- 2
- Microsoft Office
- 2
- parse-server
- 2
- ASH-AIO
- 1
Critical 3
- CVE-2019-14431In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-based buffer overflow of
- CVE-2019-14418An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1.
- CVE-2019-1020011SmokeDetector intentionally does automatic deployments of updated copies of SmokeDetector without server operator authority.SmokeDetector
High 5
- CVE-2019-14417An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1.
- CVE-2019-14416An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1.
- CVE-2019-1132An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-1130An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows ElMicrosoft Windows Server · Microsoft Windows
- CVE-2019-1129An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows ElMicrosoft Windows
Medium, low and unrated 79
- CVE-2018-18570Planon before Live Build 41 has XSS.
- CVE-2019-3948The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.0.R, Dahua DH-IPC HX8Dahua IPC-XXBXX · Dahua IPC HX5X3X and HX4X3X +6
- CVE-2019-14415An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1.
- CVE-2019-13655Imgix through 2019-06-19 allows remote attackers to cause a denial of service (resource consumption) by manipulating a small JPEG file to sp
- CVE-2018-11772Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node (if any) was previously selected in theApache VCL
- CVE-2018-11774Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts.Apache VCL
- CVE-2018-11773Apache VCL versions 2.1 through 2.5 do not properly validate form input when processing a submitted block allocation.Apache VCL
- CVE-2018-17213An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4.
- CVE-2018-17211An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4.
- CVE-2019-13571A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress.
- CVE-2019-14271In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamicalgithub.com/docker/docker · github.com/moby/moby
- CVE-2019-11868See.sys, up to version 4.25, in SoftEther VPN Server versions 4.29 or older, allows a user to call an IOCTL specifying any kernel address to
- CVE-2016-10766edx-platform before 2016-06-06 allows CSRF.
- CVE-2016-10765edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.
- CVE-2019-13126An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request.github.com/nats-io/nats-server · github.com/nats-io/nats-se…
- CVE-2019-13498One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security (HSTS), which may allow man-in-the-middle (MITM) attacks
- CVE-2015-5601edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files.
- CVE-2019-11201Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor.dolibarr/dolibarr
- CVE-2019-11200Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file.dolibarr/dolibarr
- CVE-2019-11199Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files.
- CVE-2015-6253edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.
- CVE-2015-6960edx-platform before 2015-09-17 allows XSS via a team name.
- CVE-2015-9288The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim's
- CVE-2019-12743HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social Network Kits (includin
- CVE-2019-6726The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fas
- CVE-2019-12948A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC S
- CVE-2019-14267PDFResurrect 0.15 has a buffer overflow via a crafted PDF file because data associated with startxref and %%EOF is mishandled.
- CVE-2019-13103A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the sta
- CVE-2019-1020002Pterodactyl before 0.7.14 with 2FA allows credential sniffing.Pterodactyl Panel · pterodactyl/panel
- CVE-2019-1020004Tridactyl before 1.16.0 allows fake key events.Tridactyl
- CVE-2019-1020007Dependency-Track before 3.5.1 allows XSS.Dependency-Track
- CVE-2019-1020009Fleet before 2.1.2 allows exposure of SMTP credentials.Fleet
- CVE-2019-1020008stacktable.js before 1.0.4 allows XSS.stacktable.js
- CVE-2019-1137A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request Microsoft Exchange Server
- CVE-2019-1136An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege VulnerabiMicrosoft Exchange Server
- CVE-2019-1134A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2019-1128A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution VMicrosoft Windows
- CVE-2019-1127A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution VMicrosoft Windows
- CVE-2019-1126A security feature bypass vulnerability exists in Active Directory Federation Services (ADFS) which could allow an attacker to bypass the exMicrosoft Windows Server · Microsoft Windows Server,
- CVE-2019-1124A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution VMicrosoft Windows
- CVE-2019-1123A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution VMicrosoft Windows
- CVE-2019-1122A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution VMicrosoft Windows
- CVE-2019-1121A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution VMicrosoft Windows
- CVE-2019-1120A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution VMicrosoft Windows
- CVE-2019-1119A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution VMicrosoft Windows
- CVE-2019-1118A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution VMicrosoft Windows
- CVE-2019-1117A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution VMicrosoft Windows
- CVE-2019-1116An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-1020006invenio-app before 1.1.1 allows host header injection.invenio-app
- CVE-2019-1113A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who sMicrosoft .NET Framework · Microsoft Visual Studio
- CVE-2019-1112An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel InMicrosoft Office
- CVE-2019-1111A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel · Microsoft Office
- CVE-2019-1110A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel · Microsoft Office
- CVE-2019-1109A spoofing vulnerability exists when Microsoft Office Javascript does not check the validity of the web page making a request to Office docuMicrosoft Office
- CVE-2019-1108An information disclosure vulnerability exists when the Windows RDP client improperly discloses the contents of its memory, aka 'Remote DeskMicrosoft Windows
- CVE-2019-1107A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-1106A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-1105Outlook for Android Spoofing VulnerabilityMicrosoft Outlook for Android
- CVE-2019-1020005invenio-communities before 1.0.0a20 allows XSS.invenio-communities
- CVE-2019-1104A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory CorrMicrosoft Internet Explorer · Microsoft Edge
- CVE-2019-1020003invenio-records before 1.2.2 allows XSS.invenio-records
- CVE-2019-1103A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge · Microsoft ChakraCore +1
- CVE-2019-1102A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka Microsoft Windows
- CVE-2019-1101An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-1100An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-1099An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-1098An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-1020019invenio-previewer before 1.0.0a12 allows XSS.invenio-previewer
- CVE-2019-1020018Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link.Discourse
- CVE-2019-1020017Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via a user-api OTP.Discourse
- CVE-2019-1020016ASH-AIO before 2.0.0.3 allows an open redirect.ASH-AIO
- CVE-2019-1020015graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.graphql-engine
- CVE-2019-1020014docker-credential-helpers before 0.6.3 has a double free in the List functions.docker-credential-helpers
- CVE-2019-1020013parse-server before 3.6.0 allows account enumeration.parse-server
- CVE-2019-1020012parse-server before 3.4.1 allows DoS after any POST to a volatile class.parse-server
- CVE-2019-1020010Misskey before 10.102.4 allows hijacking a user's token.Misskey
- CVE-2019-14379SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcachecom.fasterxml.jackson.core:jackson-databind
- CVE-2019-14378ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the firs
- CVE-2019-1020001yard before 0.9.20 allows path traversal.yard