# CVEs published 2019-07-30

95 CVEs were published on July 30, 2019: 0 critical, 8 high. Days are UTC.

- [CVE-2019-10165](https://cve.now/CVE-2019-10165.md): OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenS (CVSS 2.3, Red Hat openshift)
- [CVE-2019-10163](https://cve.now/CVE-2019-10163.md): A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authorized master server to (CVSS 3.5, PowerDNS pdns)
- [CVE-2019-10162](https://cve.now/CVE-2019-10162.md): A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the serve (CVSS 3.5, PowerDNS pdns)
- [CVE-2019-10161](https://cve.now/CVE-2019-10161.md): It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() AP (CVSS 8.8, libvirt)
- [CVE-2019-10156](https://cve.now/CVE-2019-10156.md): A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of (CVSS 4.6, Red Hat ansible · ansible)
- [CVE-2019-10153](https://cve.now/CVE-2019-10153.md): A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields woul (CVSS 5.0, ClusterLabs fence-agents)
- [CVE-2019-10152](https://cve.now/CVE-2019-10152.md): A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. (CVSS 7.5, podman · github.com/containers/podman)
- [CVE-2019-7614](https://cve.now/CVE-2019-7614.md): A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2019-7615](https://cve.now/CVE-2019-7615.md): A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. (no CVSS, Elastic APM agent for Ruby · elastic-apm)
- [CVE-2019-7616](https://cve.now/CVE-2019-7616.md): Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer (no CVSS, Elastic Kibana)
- [CVE-2019-5460](https://cve.now/CVE-2019-5460.md): Double Free in VLC versions \<= 3.0.6 leads to a crash. (no CVSS, VLC Media Player)
- [CVE-2019-5449](https://cve.now/CVE-2019-5449.md): A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential (no CVSS, Nextcloud Server)
- [CVE-2019-5450](https://cve.now/CVE-2019-5450.md): Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in (no CVSS, com.nextcloud.client)
- [CVE-2019-5451](https://cve.now/CVE-2019-5451.md): Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing th (no CVSS, com.nextcloud.client)
- [CVE-2019-5452](https://cve.now/CVE-2019-5452.md): Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content (no CVSS, com.nextcloud.client)
- [CVE-2019-5453](https://cve.now/CVE-2019-5453.md): Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protecti (no CVSS, com.nextcloud.client)
- [CVE-2019-5454](https://cve.now/CVE-2019-5454.md): SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query is executed requiring (no CVSS, com.nextcloud.client)
- [CVE-2019-5455](https://cve.now/CVE-2019-5455.md): Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process. (no CVSS, com.nextcloud.client)
- [CVE-2019-5459](https://cve.now/CVE-2019-5459.md): An Integer underflow in VLC Media Player versions \< 3.0.7 leads to an out-of-band read. (no CVSS, VLC)
- [CVE-2019-5457](https://cve.now/CVE-2019-5457.md): Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execu (no CVSS, min-http-server)
- [CVE-2019-5458](https://cve.now/CVE-2019-5458.md): Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to exec (no CVSS, http-file-server)
- [CVE-2019-5456](https://cve.now/CVE-2019-5456.md): SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version \<= 5.10.21 and their actual SMTP (no CVSS, UniFi)
- [CVE-2019-5448](https://cve.now/CVE-2019-5448.md): Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication dat (no CVSS, yarn)
- [CVE-2019-13026](https://cve.now/CVE-2019-13026.md): OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows SQL Injection via a crafted URL, leading to full access by an attacker. (no CVSS)
- [CVE-2018-20859](https://cve.now/CVE-2018-20859.md): edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem. (no CVSS)
- [CVE-2017-18381](https://cve.now/CVE-2017-18381.md): The installation process in Open edX before 2017-01-10 exposes a MongoDB instance to external connections with default credentials. (no CVSS)
- [CVE-2019-14380](https://cve.now/CVE-2019-14380.md): libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files. (no CVSS)
- [CVE-2019-14382](https://cve.now/CVE-2019-14382.md): DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs. (no CVSS)
- [CVE-2019-14383](https://cve.now/CVE-2019-14383.md): J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs. (no CVSS)
- [CVE-2018-20860](https://cve.now/CVE-2018-20860.md): libopenmpt before 0.3.13 allows a crash with malformed MED files. (no CVSS)
- [CVE-2018-20861](https://cve.now/CVE-2018-20861.md): libopenmpt before 0.3.11 allows a crash with certain malformed custom tunings in MPTM files. (no CVSS)
- [CVE-2018-20871](https://cve.now/CVE-2018-20871.md): In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on root\_squash, weak file permissions ("other" write a (no CVSS)
- [CVE-2019-14242](https://cve.now/CVE-2019-14242.md): An issue was discovered in Bitdefender products for Windows (Bitdefender Endpoint Security Tool versions prior to 6.6.8.115; and Bitdefender (no CVSS)
- [CVE-2019-14313](https://cve.now/CVE-2019-14313.md): A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. (no CVSS)
- [CVE-2019-1552](https://cve.now/CVE-2019-1552.md): Windows builds with insecure path defaults (no CVSS, OpenSSL)
- [CVE-2019-14318](https://cve.now/CVE-2019-14318.md): Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. (no CVSS)
- [CVE-2019-10142](https://cve.now/CVE-2019-10142.md): A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17. (CVSS 7.1, RedHat kernel)
- [CVE-2019-10141](https://cve.now/CVE-2019-10141.md): A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. (CVSS 8.3, RedHat openstack-ironic-inspector · ironic-inspector)
- [CVE-2018-16871](https://cve.now/CVE-2018-16871.md): A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. (CVSS 7.5, Red Hat kernel:)
- [CVE-2019-10138](https://cve.now/CVE-2019-10138.md): A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. (CVSS 7.1, Red Hat python-novajoin · novajoin)
- [CVE-2019-10130](https://cve.now/CVE-2019-10130.md): A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x (CVSS 3.1, PostgreSQL Project postgresql)
- [CVE-2019-10129](https://cve.now/CVE-2019-10129.md): A vulnerability was found in postgresql versions 11.x prior to 11.3. (CVSS 6.5, PostgreSQL Project postgresql)
- [CVE-2019-11202](https://cve.now/CVE-2019-11202.md): An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2. (no CVSS, github.com/rancher/rancher)
- [CVE-2018-20870](https://cve.now/CVE-2018-20870.md): The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467). (no CVSS)
- [CVE-2018-20869](https://cve.now/CVE-2018-20869.md): cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465). (no CVSS)
- [CVE-2018-20862](https://cve.now/CVE-2018-20862.md): cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366). (no CVSS)
- [CVE-2018-20868](https://cve.now/CVE-2018-20868.md): cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464). (no CVSS)
- [CVE-2018-20866](https://cve.now/CVE-2018-20866.md): cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461). (no CVSS)
- [CVE-2018-20865](https://cve.now/CVE-2018-20865.md): cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459). (no CVSS)
- [CVE-2018-20864](https://cve.now/CVE-2018-20864.md): cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454). (no CVSS)
- [CVE-2018-20863](https://cve.now/CVE-2018-20863.md): cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452). (no CVSS)
- [CVE-2019-14414](https://cve.now/CVE-2019-14414.md): In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478). (no CVSS)
- [CVE-2019-14413](https://cve.now/CVE-2019-14413.md): cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476). (no CVSS)
- [CVE-2019-14412](https://cve.now/CVE-2019-14412.md): Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check\_domains\_via\_dns UAPI (SEC-474). (no CVSS)
- [CVE-2019-14411](https://cve.now/CVE-2019-14411.md): cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473). (no CVSS)
- [CVE-2019-14410](https://cve.now/CVE-2019-14410.md): Maketext in cPanel before 78.0.2 allows format-string injection in the Email store\_filter UAPI (SEC-472). (no CVSS)
- [CVE-2019-14409](https://cve.now/CVE-2019-14409.md): cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466). (no CVSS)
- [CVE-2019-14408](https://cve.now/CVE-2019-14408.md): cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460). (no CVSS)
- [CVE-2019-14407](https://cve.now/CVE-2019-14407.md): cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415). (no CVSS)
- [CVE-2019-14406](https://cve.now/CVE-2019-14406.md): cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493). (no CVSS)
- [CVE-2019-14405](https://cve.now/CVE-2019-14405.md): cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487). (no CVSS)
- [CVE-2019-14404](https://cve.now/CVE-2019-14404.md): cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual\_user\_spam router (SEC-484) (no CVSS)
- [CVE-2019-14403](https://cve.now/CVE-2019-14403.md): cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483). (no CVSS)
- [CVE-2019-14402](https://cve.now/CVE-2019-14402.md): cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481). (no CVSS)
- [CVE-2019-14401](https://cve.now/CVE-2019-14401.md): cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480). (no CVSS)
- [CVE-2019-14400](https://cve.now/CVE-2019-14400.md): cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479). (no CVSS)
- [CVE-2019-14399](https://cve.now/CVE-2019-14399.md): The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477). (no CVSS)
- [CVE-2019-14398](https://cve.now/CVE-2019-14398.md): cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax\_maketext\_syntax\_util.pl (SEC-498). (no CVSS)
- [CVE-2019-14397](https://cve.now/CVE-2019-14397.md): cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496). (no CVSS)
- [CVE-2019-14396](https://cve.now/CVE-2019-14396.md): API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495). (no CVSS)
- [CVE-2019-14395](https://cve.now/CVE-2019-14395.md): cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494). (no CVSS)
- [CVE-2019-14394](https://cve.now/CVE-2019-14394.md): cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch\_ssl\_certificates\_for\_fqdns API (SEC-489) (no CVSS)
- [CVE-2019-14393](https://cve.now/CVE-2019-14393.md): cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486). (no CVSS)
- [CVE-2019-14392](https://cve.now/CVE-2019-14392.md): cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501). (no CVSS)
- [CVE-2018-20867](https://cve.now/CVE-2018-20867.md): cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462). (no CVSS)
- [CVE-2019-11775](https://cve.now/CVE-2019-11775.md): All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the lo (no CVSS, The Eclipse Foundation Eclipse OpenJ9)
- [CVE-2019-4456](https://cve.now/CVE-2019-4456.md): IBM Daeja ViewONE Professional, Standard & Virtual 5.0.5 and 5.0.6 is vulnerable to an XML External Entity Injection (XXE) attack when proce (CVSS 7.1, IBM Daeja ViewONE)
- [CVE-2019-4285](https://cve.now/CVE-2019-4285.md): IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of the victim. (CVSS 5.4, IBM WebSphere Application Server)
- [CVE-2019-4062](https://cve.now/CVE-2019-4062.md): IBM i2 Intelligent Analyis Platform 9.0.0 through 9.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML d (CVSS 7.1, IBM i2 Analyst's Notebook)
- [CVE-2019-14391](https://cve.now/CVE-2019-14391.md): cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514). (no CVSS)
- [CVE-2019-14390](https://cve.now/CVE-2019-14390.md): cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512). (no CVSS)
- [CVE-2019-14389](https://cve.now/CVE-2019-14389.md): cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510). (no CVSS)
- [CVE-2019-14388](https://cve.now/CVE-2019-14388.md): cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507). (no CVSS)
- [CVE-2019-14387](https://cve.now/CVE-2019-14387.md): cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506). (no CVSS)
- [CVE-2019-14381](https://cve.now/CVE-2019-14381.md): libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL instrument to an empty instrume (no CVSS)
- [CVE-2019-14386](https://cve.now/CVE-2019-14386.md): cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504). (no CVSS)
- [CVE-2015-9290](https://cve.now/CVE-2015-9290.md): In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1\_Get\_Private\_Dict where there is no check that the new (no CVSS)
- [CVE-2017-18380](https://cve.now/CVE-2017-18380.md): edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an attacker-controlled (no CVSS)
- [CVE-2019-14327](https://cve.now/CVE-2019-14327.md): A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings. (no CVSS)
- [CVE-2019-13635](https://cve.now/CVE-2019-13635.md): The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal. (no CVSS)
- [CVE-2019-14444](https://cve.now/CVE-2019-14444.md): apply\_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to trigger a write access violation ( (no CVSS)
- [CVE-2019-14443](https://cve.now/CVE-2019-14443.md): An issue was discovered in Libav 12.3. (no CVSS)
- [CVE-2019-14442](https://cve.now/CVE-2019-14442.md): In mpc8\_read\_header in libavformat/mpc8.c in Libav 12.3, an input file can result in an avio\_seek infinite loop and hang, with 100% CPU cons (no CVSS)
- [CVE-2019-14441](https://cve.now/CVE-2019-14441.md): An issue was discovered in Libav 12.3. (no CVSS)
- [CVE-2019-14439](https://cve.now/CVE-2019-14439.md): A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. (no CVSS, com.fasterxml.jackson.core:jackson-databind)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-07-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.