CVEs published July 30, 2019
95 CVEs were published on July 30, 2019: 0 critical, 8 high.
- Published
- 95
- Critical
- 0
- High
- 8
- Medium
- 4
- Low
- 4
- Unrated
- 79
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- com.nextcloud.client
- 6
- PostgreSQL Project postgresql
- 2
- PowerDNS pdns
- 2
- ClusterLabs fence-agents
- 1
- com.fasterxml.jackson.core:jackson-databind
- 1
- Elastic APM agent for Ruby · elastic-apm
- 1
- Elastic Kibana
- 1
- Elasticsearch · org.elasticsearch:elasticsearch
- 1
- github.com/rancher/rancher
- 1
- http-file-server
- 1
High 8
- CVE-2019-10161It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() APlibvirt
- CVE-2019-10152A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers.podman · github.com/containers/podman
- CVE-2019-10142A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17.RedHat kernel
- CVE-2019-10141A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1.RedHat openstack-ironic-inspector · ironic-inspector
- CVE-2018-16871A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20.Red Hat kernel:
- CVE-2019-10138A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform.Red Hat python-novajoin · novajoin
- CVE-2019-4456IBM Daeja ViewONE Professional, Standard & Virtual 5.0.5 and 5.0.6 is vulnerable to an XML External Entity Injection (XXE) attack when proceIBM Daeja ViewONE
- CVE-2019-4062IBM i2 Intelligent Analyis Platform 9.0.0 through 9.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML dIBM i2 Analyst's Notebook
Medium, low and unrated 87
- CVE-2019-10165OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenSRed Hat openshift
- CVE-2019-10163A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authorized master server to PowerDNS pdns
- CVE-2019-10162A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the servePowerDNS pdns
- CVE-2019-10156A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of Red Hat ansible · ansible
- CVE-2019-10153A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields woulClusterLabs fence-agents
- CVE-2019-7614A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request.Elasticsearch · org.elasticsearch:elasticsearch
- CVE-2019-7615A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0.Elastic APM agent for Ruby · elastic-apm
- CVE-2019-7616Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizerElastic Kibana
- CVE-2019-5460Double Free in VLC versions <= 3.0.6 leads to a crash.VLC Media Player
- CVE-2019-5449A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidentialNextcloud Server
- CVE-2019-5450Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in com.nextcloud.client
- CVE-2019-5451Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing thcom.nextcloud.client
- CVE-2019-5452Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content com.nextcloud.client
- CVE-2019-5453Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protecticom.nextcloud.client
- CVE-2019-5454SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query is executed requiringcom.nextcloud.client
- CVE-2019-5455Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process.com.nextcloud.client
- CVE-2019-5459An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.VLC
- CVE-2019-5457Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execumin-http-server
- CVE-2019-5458Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to exechttp-file-server
- CVE-2019-5456SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version <= 5.10.21 and their actual SMTP UniFi
- CVE-2019-5448Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication datyarn
- CVE-2019-13026OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows SQL Injection via a crafted URL, leading to full access by an attacker.
- CVE-2018-20859edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.
- CVE-2017-18381The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials.
- CVE-2019-14380libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files.
- CVE-2019-14382DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.
- CVE-2019-14383J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.
- CVE-2018-20860libopenmpt before 0.3.13 allows a crash with malformed MED files.
- CVE-2018-20861libopenmpt before 0.3.11 allows a crash with certain malformed custom tunings in MPTM files.
- CVE-2018-20871In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on root_squash, weak file permissions ("other" write a
- CVE-2019-14242An issue was discovered in Bitdefender products for Windows (Bitdefender Endpoint Security Tool versions prior to 6.6.8.115; and Bitdefender
- CVE-2019-14313A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress.
- CVE-2019-1552Windows builds with insecure path defaultsOpenSSL
- CVE-2019-14318Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation.
- CVE-2019-10130A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x PostgreSQL Project postgresql
- CVE-2019-10129A vulnerability was found in postgresql versions 11.x prior to 11.3.PostgreSQL Project postgresql
- CVE-2019-11202An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.github.com/rancher/rancher
- CVE-2018-20870The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467).
- CVE-2018-20869cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465).
- CVE-2018-20862cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366).
- CVE-2018-20868cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).
- CVE-2018-20866cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461).
- CVE-2018-20865cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).
- CVE-2018-20864cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454).
- CVE-2018-20863cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452).
- CVE-2019-14414In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478).
- CVE-2019-14413cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476).
- CVE-2019-14412Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474).
- CVE-2019-14411cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473).
- CVE-2019-14410Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).
- CVE-2019-14409cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466).
- CVE-2019-14408cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460).
- CVE-2019-14407cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415).
- CVE-2019-14406cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).
- CVE-2019-14405cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487).
- CVE-2019-14404cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484)
- CVE-2019-14403cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483).
- CVE-2019-14402cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481).
- CVE-2019-14401cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480).
- CVE-2019-14400cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479).
- CVE-2019-14399The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477).
- CVE-2019-14398cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498).
- CVE-2019-14397cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496).
- CVE-2019-14396API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495).
- CVE-2019-14395cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494).
- CVE-2019-14394cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489)
- CVE-2019-14393cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486).
- CVE-2019-14392cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501).
- CVE-2018-20867cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462).
- CVE-2019-11775All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loThe Eclipse Foundation Eclipse OpenJ9
- CVE-2019-4285IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of the victim.IBM WebSphere Application Server
- CVE-2019-14391cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514).
- CVE-2019-14390cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).
- CVE-2019-14389cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510).
- CVE-2019-14388cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507).
- CVE-2019-14387cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).
- CVE-2019-14381libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL instrument to an empty instrume
- CVE-2019-14386cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).
- CVE-2015-9290In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new
- CVE-2017-18380edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled
- CVE-2019-14327A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings.
- CVE-2019-13635The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal.
- CVE-2019-14444apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to trigger a write access violation (
- CVE-2019-14443An issue was discovered in Libav 12.3.
- CVE-2019-14442In mpc8_read_header in libavformat/mpc8.c in Libav 12.3, an input file can result in an avio_seek infinite loop and hang, with 100% CPU cons
- CVE-2019-14441An issue was discovered in Libav 12.3.
- CVE-2019-14439A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2.com.fasterxml.jackson.core:jackson-databind