Skip to content
OpenAdvisories

Archive

July 2019

Vulnerabilities first published in this month (UTC), newest first.

← June 2019 2019 / July August 2019 →
  1. 160
  2. 268
  3. 397
  4. 448
  5. 561
  6. 619
  7. 74
  8. 833
  9. 937
  10. 1090
  11. 1184
  12. 1211
  13. 132
  14. 146
  15. 1585
  16. 1636
  17. 1768
  18. 1860
  19. 1950
  20. 20 
  21. 2113
  22. 2236
  23. 23244
  24. 2422
  25. 2569
  26. 2636
  27. 2720
  28. 2820
  29. 2987
  30. 3095
  31. 3162
All Critical High Medium Low Exploited only Public exploit

120 results · Clear filters · Feed

  • High 7.8
    CVE-2019-13574 Public exploit

    OS Command Injection in MiniMagick

    In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.

    mini_magick ruby-mini-magick ruby-mini-magick Debian Ubuntu RubyGems
  • Unscored —
    CVE-2019-10915 Public exploit

    A vulnerability has been identified in TIA Administrator (All versions < V1.0 SP1 Upd1). The integrated configuration w…

    Siemens TIA Administrator ICS / OT
  • High 7.8
    CVE-2019-0053 Public exploit

    Junos OS: Insufficient validation of environment variables in telnet client may lead to stack-based buffer overflow

    Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffer overflows, which can be exploited to bypass veriexec restrictions on Junos OS. A stack-based overflow is present in the handling of envir…

    Juniper Networks Junos OS inetutils inetutils Network devices Debian Ubuntu
  • Unscored —
    CVE-2019-13029 Public exploit

    Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9…

  • Medium 5.4
    CVE-2019-10349 Public exploit

    Jenkins Dependency Graph Viewer Plugin contains Cross-site Scripting

    A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.

    Jenkins Project Jenkins Dependency Graph Viewer Plugin org.jenkins-ci.plugins:depgraph-view Web / CMS Maven
  • Unscored —
    CVE-2018-19571 Public exploit EPSS 32%

    GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an…

  • Unscored —
    CVE-2019-13396 Public exploit Scanner template EPSS 63%

    FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an i…

  • Unscored —
    CVE-2019-13132 Public exploit EPSS 42%

    In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting …

    zeromq3 zeromq3 zeromq Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-2107 Public exploit

    In ihevcd_parse_pps of ihevcd_parse_headers.c, there is a possible out of bounds write due to a missing bounds check. T…

    Android
  • Unscored —
    CVE-2019-13373 Public exploit EPSS 68%

    An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validat…

  • Unscored —
    CVE-2019-13372 Public exploit Scanner template EPSS 82%

    /web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote att…

  • Unscored —
    CVE-2019-13358 Public exploit EPSS 24%

    lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying oper…

  • Unscored —
    CVE-2019-13344 Public exploit EPSS 45%

    An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthen…

  • Unscored —
    CVE-2019-13144 Public exploit

    myTinyTodo 1.3.3 through 1.4.3 allows CSV Injection. This is fixed in 1.5.

  • Unscored —
    CVE-2019-13294 Public exploit EPSS 19%

    AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session con…

  • Unscored —
    CVE-2019-13292 Public exploit

    A SQL Injection issue was discovered in webERP 4.15. Payments.php accepts payment data in base64 format. After this is …

  • Unscored —
    CVE-2019-13288 Public exploit

    In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote a…

  • Unscored —
    CVE-2019-5602 Public exploit

    In FreeBSD 12.0-STABLE before r349628, 12.0-RELEASE before 12.0-RELEASE-p7, 11.3-PRERELEASE before r349629, 11.3-RC3 be…

    FreeBSD FreeBSD
  • Medium 5.9
    CVE-2019-5630 Public exploit

    Rapid7 Nexpose/InsightVM Security Console CSRF

    A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attackers to exploit CSRF vulnerabilities on API endpoints using Flash to circumvent a cross-domain pre-f…

    Rapid7 Nexpose/InsightVM Security Console
  • High 7.5
    CVE-2018-18326 Public exploit EPSS 54%

    Insufficient Entropy in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.

    DotNetNuke.Core NuGet
  • High 7.5
    CVE-2018-18325 Exploited Public exploit Scanner template EPSS 74%

    Inadequate Encryption Strength in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.

    DotNetNuke.Core NuGet
    KEV Nov 3, 2021
  • High 7.5
    CVE-2018-15812 Public exploit EPSS 47%

    Insufficient Entropy in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.

    DotNetNuke.Core NuGet
  • Unscored —
    CVE-2018-11686 Public exploit Scanner template EPSS 53%

    The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_…

  • High 7.5
    CVE-2018-15811 Exploited Public exploit Scanner template EPSS 76%

    Inadequate Encryption Strength in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

    DotNetNuke.Core NuGet
    KEV Nov 3, 2021
  • Unscored —
    CVE-2019-7254 Public exploit Scanner template EPSS 82%

    Linear eMerge E3-Series devices allow File Inclusion.

  • Unscored —
    CVE-2019-7255 Public exploit Scanner template EPSS 56%

    Linear eMerge E3-Series devices allow XSS.

  • Unscored —
    CVE-2019-7257 Public exploit EPSS 70%

    Linear eMerge E3-Series devices allow Unrestricted File Upload.

  • Unscored —
    CVE-2019-7262 Public exploit EPSS 16%

    Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).

  • Unscored —
    CVE-2019-7265 Public exploit EPSS 23%

    Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH).

  • Unscored —
    CVE-2019-7269 Public exploit EPSS 40%

    Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution.

  • Unscored —
    CVE-2019-12594 Public exploit

    DOSBox 0.74-2 has Incorrect Access Control.

    dosbox dosbox Debian Ubuntu
  • Critical 9.8
    CVE-2019-7256 Exploited Public exploit Scanner template EPSS 97%

    Linear eMerge E3-Series devices allow Command Injections.

    KEV Mar 25, 2024
  • Unscored —
    CVE-2019-9702 Public exploit

    Symantec Endpoint Encryption, prior to SEE 11.3.0, may be susceptible to a privilege escalation vulnerability, which is…

    Symantec Endpoint Encryption
  • Unscored —
    CVE-2019-7272 Public exploit EPSS 10%

    Optergy Proton/Enterprise devices allow Username Disclosure.

  • Unscored —
    CVE-2019-7273 Public exploit

    Optergy Proton/Enterprise devices allow Cross-Site Request Forgery (CSRF).

  • Unscored —
    CVE-2019-7274 Public exploit EPSS 29%

    Optergy Proton/Enterprise devices allow Authenticated File Upload with Code Execution as root.

  • Unscored —
    CVE-2019-7666 Public exploit EPSS 15%

    Prima Systems FlexAir, Versions 2.3.38 and prior. The application allows improper authentication using the MD5 hash val…

  • Unscored —
    CVE-2019-13024 Public exploit EPSS 32%

    Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitr…

  • Unscored —
    CVE-2019-7670 Public exploit EPSS 18%

    Prima Systems FlexAir, Versions 2.3.38 and prior. The application incorrectly neutralizes special elements that could m…

  • Unscored —
    CVE-2019-7276 Public exploit Scanner template EPSS 93%

    Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console.