CVEs published July 31, 2019
62 CVEs were published on July 31, 2019: 0 critical, 8 high.
- Published
- 62
- Critical
- 0
- High
- 8
- Medium
- 11
- Low
- 0
- Unrated
- 43
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- Jenkins project Jenkins Configuration as Code Plugin · io.j…
- 5
- SDL
- 4
- The Moodle Project moodle · moodle/moodle
- 4
- icedtea-web
- 3
- Jenkins project Jenkins Maven Release Plugin · org.jenkins-…
- 3
- WallacePOS
- 3
- IBM StoredIQ
- 2
- Jenkins project Jenkins Script Security Plugin · org.jenkin…
- 2
- Avaya Aura Conferencing
- 1
- Cisco NX-OS System Software
- 1
High 8
- CVE-2019-10182It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files.icedtea-web
- CVE-2019-10185It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file.icedtea-web
- CVE-2019-1901Cisco Nexus 9000 Series ACI Mode Switch Software Link Layer Discovery Protocol Buffer Overflow VulnerabilityCisco NX-OS System Software
- CVE-2019-5060An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4.SDL
- CVE-2019-5059An exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2_image 2.0.4.SDL
- CVE-2019-5058An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4.SDL
- CVE-2019-5057An exploitable code execution vulnerability exists in the PCX image-rendering functionality of SDL2_image 2.0.4.SDL
- CVE-2018-16860A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up tsamba
Medium, low and unrated 54
- CVE-2019-14465fmt_mtm_load_song in fmt/mtm.c in Schism Tracker 20190722 has a heap-based buffer overflow.
- CVE-2019-14464XMFile::read in XMFile.cpp in milkyplay in MilkyTracker 1.02.00 has a heap-based buffer overflow.
- CVE-2015-5297An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8.The pixman Project pixman
- CVE-2019-14463An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5.
- CVE-2019-14462An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5.
- CVE-2019-10181It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising thicedtea-web
- CVE-2019-10198An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7.The Foreman Project foreman-tasks
- CVE-2019-7000Avaya Aura Conferencing XSSAvaya Aura Conferencing
- CVE-2019-10186A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7.The Moodle Project moodle · moodle/moodle
- CVE-2019-10187A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7.The Moodle Project moodle · moodle/moodle
- CVE-2019-10188A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7.The Moodle Project moodle · moodle/moodle
- CVE-2019-10189A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7.The Moodle Project moodle · moodle/moodle
- CVE-2019-14459nfdump 1.6.17 and earlier is affected by an integer overflow in the function Process_ipfix_template_withdraw in ipfix.c that can be abused i
- CVE-2019-14456Opengear console server firmware releases prior to 4.5.0 have a stored XSS vulnerability related to serial port logging.
- CVE-2019-12797A clone version of an ELM327 OBD2 Bluetooth device has a hardcoded PIN, leading to arbitrary commands to an OBD-II bus of a vehicle.
- CVE-2019-12750Symantec Endpoint Protection, prior to 14.2 RU1 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition, prior to 12.1 RU6 MSymantec Endpoint Protection, Symantec Endpoint Protection…
- CVE-2019-3958Insufficient output sanitization in WallacePOS 1.4.3 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSSWallacePOS
- CVE-2019-3959Cross-site request forgery in WallacePOS 1.4.3 allows a remote attacker to perform sensitive application actions by tricking legitimate userWallacePOS
- CVE-2019-3960Unrestricted upload of file with dangerous type in WallacePOS 1.4.3 allows a remote, authenticated attacker to execute arbitrary code by uplWallacePOS
- CVE-2018-20872DrayTek routers before 2018-05-23 allow CSRF attacks to change DNS or DHCP settings, a related issue to CVE-2017-11649.
- CVE-2007-6763SAS Drug Development (SDD) before 32DRG02 mishandles logout actions, which allows a user (who was previously logged in) to access resources
- CVE-2019-5020An exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1.Yara Object
- CVE-2019-4165IBM StoreIQ 7.6.0.0.IBM StoredIQ
- CVE-2019-4163IBM StoreIQ 7.6.0.0.IBM StoredIQ
- CVE-2019-13568CImg through 2.6.7 has a heap-based buffer overflow in _load_bmp in CImg.h because of erroneous memory allocation for a malformed BMP image.
- CVE-2019-10344Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/ReadJenkins project Jenkins Configuration as Code Plugin · io.j…
- CVE-2019-10345Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted foJenkins project Jenkins Configuration as Code Plugin · io.j…
- CVE-2019-10355A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers toJenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2019-10356A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions alloJenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2019-10357A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obJenkins project Jenkins Pipeline: Shared Groovy Libraries P…
- CVE-2019-10358Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build Jenkins project Jenkins Maven Integration Plugin · org.jenk…
- CVE-2019-10359A cross-site request forgery vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier in the M2ReleaseAction#doSubmit method allowedJenkins project Jenkins Maven Release Plugin · org.jenkins-…
- CVE-2019-10360A stored cross site scripting vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier allowed attackers to inject arbitrary HTML anJenkins project Jenkins Maven Release Plugin · org.jenkins-…
- CVE-2019-10361Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users witJenkins project Jenkins Maven Release Plugin · org.jenkins-…
- CVE-2019-10362Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import Jenkins project Jenkins Configuration as Code Plugin · io.j…
- CVE-2019-10363Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted Jenkins project Jenkins Configuration as Code Plugin · io.j…
- CVE-2019-10364Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log.Jenkins project Jenkins Amazon EC2 Plugin · org.jenkins-ci.…
- CVE-2019-10365Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspJenkins project Jenkins Google Kubernetes Engine Plugin · o…
- CVE-2019-10366Jenkins Skytap Cloud CI Plugin 2.06 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they coulJenkins project Jenkins Skytap Cloud CI Plugin · org.jenkin…
- CVE-2019-10343Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the configJenkins project Jenkins Configuration as Code Plugin · io.j…
- CVE-2019-14193An issue was discovered in Das U-Boot through 2019.07.
- CVE-2019-14199An issue was discovered in Das U-Boot through 2019.07.
- CVE-2019-14196An issue was discovered in Das U-Boot through 2019.07.
- CVE-2019-14197An issue was discovered in Das U-Boot through 2019.07.
- CVE-2019-14198An issue was discovered in Das U-Boot through 2019.07.
- CVE-2019-14195An issue was discovered in Das U-Boot through 2019.07.
- CVE-2019-14194An issue was discovered in Das U-Boot through 2019.07.
- CVE-2019-14192An issue was discovered in Das U-Boot through 2019.07.
- CVE-2019-14200An issue was discovered in Das U-Boot through 2019.07.
- CVE-2019-14201An issue was discovered in Das U-Boot through 2019.07.
- CVE-2019-14202An issue was discovered in Das U-Boot through 2019.07.
- CVE-2019-14203An issue was discovered in Das U-Boot through 2019.07.
- CVE-2019-14204An issue was discovered in Das U-Boot through 2019.07.
- CVE-2019-14452Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP a