# CVEs published 2019-07-31 62 CVEs were published on July 31, 2019: 0 critical, 8 high. Days are UTC. - [CVE-2019-14465](https://cve.now/CVE-2019-14465.md): fmt\_mtm\_load\_song in fmt/mtm.c in Schism Tracker 20190722 has a heap-based buffer overflow. (no CVSS) - [CVE-2019-14464](https://cve.now/CVE-2019-14464.md): XMFile::read in XMFile.cpp in milkyplay in MilkyTracker 1.02.00 has a heap-based buffer overflow. (no CVSS) - [CVE-2015-5297](https://cve.now/CVE-2015-5297.md): An integer overflow issue has been reported in the general\_composite\_rect() function in pixman prior to version 0.32.8. (CVSS 6.7, The pixman Project pixman) - [CVE-2019-14463](https://cve.now/CVE-2019-14463.md): An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. (no CVSS) - [CVE-2019-14462](https://cve.now/CVE-2019-14462.md): An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. (no CVSS) - [CVE-2019-10181](https://cve.now/CVE-2019-10181.md): It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising th (CVSS 6.3, icedtea-web) - [CVE-2019-10182](https://cve.now/CVE-2019-10182.md): It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from \ elements in JNLP files. (CVSS 8.2, icedtea-web) - [CVE-2019-10185](https://cve.now/CVE-2019-10185.md): It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. (CVSS 8.2, icedtea-web) - [CVE-2019-10198](https://cve.now/CVE-2019-10198.md): An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. (CVSS 6.5, The Foreman Project foreman-tasks) - [CVE-2019-7000](https://cve.now/CVE-2019-7000.md): Avaya Aura Conferencing XSS (CVSS 5.9, Avaya Aura Conferencing) - [CVE-2019-10186](https://cve.now/CVE-2019-10186.md): A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. (CVSS 6.5, The Moodle Project moodle · moodle/moodle) - [CVE-2019-10187](https://cve.now/CVE-2019-10187.md): A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. (CVSS 4.0, The Moodle Project moodle · moodle/moodle) - [CVE-2019-10188](https://cve.now/CVE-2019-10188.md): A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. (CVSS 4.0, The Moodle Project moodle · moodle/moodle) - [CVE-2019-10189](https://cve.now/CVE-2019-10189.md): A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. (CVSS 4.0, The Moodle Project moodle · moodle/moodle) - [CVE-2019-14459](https://cve.now/CVE-2019-14459.md): nfdump 1.6.17 and earlier is affected by an integer overflow in the function Process\_ipfix\_template\_withdraw in ipfix.c that can be abused i (no CVSS) - [CVE-2019-14456](https://cve.now/CVE-2019-14456.md): Opengear console server firmware releases prior to 4.5.0 have a stored XSS vulnerability related to serial port logging. (no CVSS) - [CVE-2019-12797](https://cve.now/CVE-2019-12797.md): A clone version of an ELM327 OBD2 Bluetooth device has a hardcoded PIN, leading to arbitrary commands to an OBD-II bus of a vehicle. (no CVSS) - [CVE-2019-12750](https://cve.now/CVE-2019-12750.md): Symantec Endpoint Protection, prior to 14.2 RU1 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition, prior to 12.1 RU6 M (no CVSS, Symantec Endpoint Protection, Symantec Endpoint Protection…) - [CVE-2019-3958](https://cve.now/CVE-2019-3958.md): Insufficient output sanitization in WallacePOS 1.4.3 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS (no CVSS, WallacePOS) - [CVE-2019-1901](https://cve.now/CVE-2019-1901.md): Cisco Nexus 9000 Series ACI Mode Switch Software Link Layer Discovery Protocol Buffer Overflow Vulnerability (CVSS 8.8, Cisco NX-OS System Software) - [CVE-2019-3959](https://cve.now/CVE-2019-3959.md): Cross-site request forgery in WallacePOS 1.4.3 allows a remote attacker to perform sensitive application actions by tricking legitimate user (no CVSS, WallacePOS) - [CVE-2019-3960](https://cve.now/CVE-2019-3960.md): Unrestricted upload of file with dangerous type in WallacePOS 1.4.3 allows a remote, authenticated attacker to execute arbitrary code by upl (no CVSS, WallacePOS) - [CVE-2018-20872](https://cve.now/CVE-2018-20872.md): DrayTek routers before 2018-05-23 allow CSRF attacks to change DNS or DHCP settings, a related issue to CVE-2017-11649. (no CVSS) - [CVE-2007-6763](https://cve.now/CVE-2007-6763.md): SAS Drug Development (SDD) before 32DRG02 mishandles logout actions, which allows a user (who was previously logged in) to access resources (no CVSS) - [CVE-2019-5060](https://cve.now/CVE-2019-5060.md): An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2\_image 2.0.4. (CVSS 8.8, SDL) - [CVE-2019-5059](https://cve.now/CVE-2019-5059.md): An exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2\_image 2.0.4. (CVSS 8.8, SDL) - [CVE-2019-5058](https://cve.now/CVE-2019-5058.md): An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2\_image 2.0.4. (CVSS 8.8, SDL) - [CVE-2019-5057](https://cve.now/CVE-2019-5057.md): An exploitable code execution vulnerability exists in the PCX image-rendering functionality of SDL2\_image 2.0.4. (CVSS 8.8, SDL) - [CVE-2019-5020](https://cve.now/CVE-2019-5020.md): An exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. (CVSS 6.5, Yara Object) - [CVE-2019-4165](https://cve.now/CVE-2019-4165.md): IBM StoreIQ 7.6.0.0. (CVSS 5.3, IBM StoredIQ) - [CVE-2019-4163](https://cve.now/CVE-2019-4163.md): IBM StoreIQ 7.6.0.0. (CVSS 4.3, IBM StoredIQ) - [CVE-2018-16860](https://cve.now/CVE-2018-16860.md): A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up t (CVSS 7.5, samba) - [CVE-2019-13568](https://cve.now/CVE-2019-13568.md): CImg through 2.6.7 has a heap-based buffer overflow in \_load\_bmp in CImg.h because of erroneous memory allocation for a malformed BMP image. (no CVSS) - [CVE-2019-10344](https://cve.now/CVE-2019-10344.md): Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read (no CVSS, Jenkins project Jenkins Configuration as Code Plugin · io.j…) - [CVE-2019-10345](https://cve.now/CVE-2019-10345.md): Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted fo (no CVSS, Jenkins project Jenkins Configuration as Code Plugin · io.j…) - [CVE-2019-10355](https://cve.now/CVE-2019-10355.md): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…) - [CVE-2019-10356](https://cve.now/CVE-2019-10356.md): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allo (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…) - [CVE-2019-10357](https://cve.now/CVE-2019-10357.md): A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to ob (no CVSS, Jenkins project Jenkins Pipeline: Shared Groovy Libraries P…) - [CVE-2019-10358](https://cve.now/CVE-2019-10358.md): Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build (no CVSS, Jenkins project Jenkins Maven Integration Plugin · org.jenk…) - [CVE-2019-10359](https://cve.now/CVE-2019-10359.md): A cross-site request forgery vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier in the M2ReleaseAction#doSubmit method allowed (no CVSS, Jenkins project Jenkins Maven Release Plugin · org.jenkins-…) - [CVE-2019-10360](https://cve.now/CVE-2019-10360.md): A stored cross site scripting vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier allowed attackers to inject arbitrary HTML an (no CVSS, Jenkins project Jenkins Maven Release Plugin · org.jenkins-…) - [CVE-2019-10361](https://cve.now/CVE-2019-10361.md): Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users wit (no CVSS, Jenkins project Jenkins Maven Release Plugin · org.jenkins-…) - [CVE-2019-10362](https://cve.now/CVE-2019-10362.md): Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import (no CVSS, Jenkins project Jenkins Configuration as Code Plugin · io.j…) - [CVE-2019-10363](https://cve.now/CVE-2019-10363.md): Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted (no CVSS, Jenkins project Jenkins Configuration as Code Plugin · io.j…) - [CVE-2019-10364](https://cve.now/CVE-2019-10364.md): Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log. (no CVSS, Jenkins project Jenkins Amazon EC2 Plugin · org.jenkins-ci.…) - [CVE-2019-10365](https://cve.now/CVE-2019-10365.md): Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project worksp (no CVSS, Jenkins project Jenkins Google Kubernetes Engine Plugin · o…) - [CVE-2019-10366](https://cve.now/CVE-2019-10366.md): Jenkins Skytap Cloud CI Plugin 2.06 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they coul (no CVSS, Jenkins project Jenkins Skytap Cloud CI Plugin · org.jenkin…) - [CVE-2019-10343](https://cve.now/CVE-2019-10343.md): Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the config (no CVSS, Jenkins project Jenkins Configuration as Code Plugin · io.j…) - [CVE-2019-14193](https://cve.now/CVE-2019-14193.md): An issue was discovered in Das U-Boot through 2019.07. (no CVSS) - [CVE-2019-14199](https://cve.now/CVE-2019-14199.md): An issue was discovered in Das U-Boot through 2019.07. (no CVSS) - [CVE-2019-14196](https://cve.now/CVE-2019-14196.md): An issue was discovered in Das U-Boot through 2019.07. (no CVSS) - [CVE-2019-14197](https://cve.now/CVE-2019-14197.md): An issue was discovered in Das U-Boot through 2019.07. (no CVSS) - [CVE-2019-14198](https://cve.now/CVE-2019-14198.md): An issue was discovered in Das U-Boot through 2019.07. (no CVSS) - [CVE-2019-14195](https://cve.now/CVE-2019-14195.md): An issue was discovered in Das U-Boot through 2019.07. (no CVSS) - [CVE-2019-14194](https://cve.now/CVE-2019-14194.md): An issue was discovered in Das U-Boot through 2019.07. (no CVSS) - [CVE-2019-14192](https://cve.now/CVE-2019-14192.md): An issue was discovered in Das U-Boot through 2019.07. (no CVSS) - [CVE-2019-14200](https://cve.now/CVE-2019-14200.md): An issue was discovered in Das U-Boot through 2019.07. (no CVSS) - [CVE-2019-14201](https://cve.now/CVE-2019-14201.md): An issue was discovered in Das U-Boot through 2019.07. (no CVSS) - [CVE-2019-14202](https://cve.now/CVE-2019-14202.md): An issue was discovered in Das U-Boot through 2019.07. (no CVSS) - [CVE-2019-14203](https://cve.now/CVE-2019-14203.md): An issue was discovered in Das U-Boot through 2019.07. (no CVSS) - [CVE-2019-14204](https://cve.now/CVE-2019-14204.md): An issue was discovered in Das U-Boot through 2019.07. (no CVSS) - [CVE-2019-14452](https://cve.now/CVE-2019-14452.md): Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP a (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-07-31 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.