CVE-2019-13390: In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
Published Jul 7, 2019 · Updated Aug 4, 2024
CVE archive
July 2019
Browse CVE records published in July 2019, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 1520 matching CVEs · Page 16 of 31.
CVE-2019-13447: An issue was discovered in Sertek Xpare 3.67.
An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could access the backend database via SQL injection.
Published Jul 17, 2019 · Updated Aug 4, 2024
CVE-2019-13362: Codedoc v3.2 has a stack-based buffer overflow in add_variable in codedoc.c, related to codedoc_strlcpy.
Codedoc v3.2 has a stack-based buffer overflow in add_variable in codedoc.c, related to codedoc_strlcpy.
Published Jul 6, 2019 · Updated Aug 4, 2024
CVE-2019-13453: Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loo...
Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().
Published Jul 17, 2019 · Updated Aug 4, 2024
CVE-2019-13403: Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit...
Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit2.aspx, leading to the viewing of user information.
Published Jul 17, 2019 · Updated Aug 4, 2024
CVE-2019-13402: /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2...
/usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of services is reset.
Published Jul 8, 2019 · Updated Aug 4, 2024
CVE-2019-13379: On AVTECH Room Alert 3E devices before 2.2.5, an attacker with access to the device's web interface may esc...
On AVTECH Room Alert 3E devices before 2.2.5, an attacker with access to the device's web interface may escalate privileges from an unauthenticated user to administrator by performing a cmd.cgi?action=ResetDefaults&src=RA reset and using the default credentials to get in.
Published Jul 7, 2019 · Updated Aug 4, 2024
CVE-2019-13391: In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read becaus...
In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels.
Published Jul 7, 2019 · Updated Aug 4, 2024
CVE-2019-13400: Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials i...
Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via cgi-bin/getuserinfo.cgi?mode=info.
Published Jul 8, 2019 · Updated Aug 4, 2024
CVE-2019-13404: The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes i...
The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendor's position is that it is the user's responsibility to ensure C:\Python27 access control or choose a different directory, because backwards compatibility requires that C:\Python27 remain the default for 2.7.x
Published Jul 8, 2019 · Updated Aug 4, 2024
CVE-2019-13373: An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6.
An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the /web/Public/Conn.php parameter dbSQL.
Published Jul 6, 2019 · Updated Aug 4, 2024
CVE-2019-13341: In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user'...
In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13339: In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a...
In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a user's cookie.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13383: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check wh...
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP response.
Published Jul 16, 2019 · Updated Aug 4, 2024
CVE-2019-13301: ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13352: WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs fo...
WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature. By knowing this static secret and the corresponding algorithm for calculating support PINs, an attacker can reset the ADMIN password and thus gain remote access.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13351: posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 (as distributed with alsa-plugins 1.1.7 and l...
posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 (as distributed with alsa-plugins 1.1.7 and later) has a "double file descriptor close" issue during a failed connection attempt when jackd2 is not running. Exploitation success depends on multithreaded timing of that double close, which can result in unintended information disclosure, crashes, or file corruption due to having the wrong file associated with the file descriptor.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13372: /web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allow...
/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arbitrary PHP code via a cookie because a cookie's username field allows eval injection, and an empty password bypasses authentication.
Published Jul 6, 2019 · Updated Aug 4, 2024
CVE-2019-13294: AROX School-ERP Pro has a command execution vulnerability.
AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session control. Therefore an unauthenticated user can execute a command on the system.
Published Jul 4, 2019 · Updated Aug 4, 2024
CVE-2019-13287: In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust() l...
In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust() located at splash/SplashXPath.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure. This is related to CVE-2018-16368.
Published Jul 4, 2019 · Updated Aug 4, 2024
CVE-2019-13303: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/composite.c in CompositeImage.
ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/composite.c in CompositeImage.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13359: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to cr...
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user.
Published Jul 16, 2019 · Updated Aug 4, 2024
CVE-2019-13374: A cross-site scripting (XSS) vulnerability in resource view in PayAction.class.php in D-Link Central WiFi M...
A cross-site scripting (XSS) vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to inject arbitrary web script or HTML via the index.php/Pay/passcodeAuth passcode parameter.
Published Jul 6, 2019 · Updated Aug 4, 2024
CVE-2019-13386: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php...
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a shell command, i.e., obtain a reverse shell with user privilege.
Published Jul 26, 2019 · Updated Aug 4, 2024
CVE-2019-13314: virt-bootstrap 1.1.0 allows local users to discover a root password by listing a process, because this pass...
virt-bootstrap 1.1.0 allows local users to discover a root password by listing a process, because this password may be present in the --root-password option to virt_bootstrap.py.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13354: The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor...
The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 0.0.6.
Published Jul 8, 2019 · Updated Aug 4, 2024
CVE-2019-13382: UploaderService in SnagIT 2019.1.2 allows elevation of privilege by placing an invalid presentation file in...
UploaderService in SnagIT 2019.1.2 allows elevation of privilege by placing an invalid presentation file in %PROGRAMDATA%\TechSmith\TechSmith Recorder\QueuedPresentations and then creating a symbolic link in %PROGRAMDATA%\Techsmith\TechSmith Recorder\InvalidPresentations that points to an arbitrary folder with an arbitrary file name. TechSmith Relay Classic Recorder prior to 5.2.1 on Windows is vulnerable. The vulnerability was introduced in SnagIT Windows 12.4.1.
Published Jul 26, 2019 · Updated Aug 4, 2024
CVE-2019-13358: lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the und...
lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13292: A SQL Injection issue was discovered in webERP 4.15.
A SQL Injection issue was discovered in webERP 4.15. Payments.php accepts payment data in base64 format. After this is decoded, it is deserialized. Then, this deserialized data goes directly into a SQL query, with no sanitizing checks.
Published Jul 4, 2019 · Updated Aug 4, 2024
CVE-2019-13291: In Xpdf 4.01.01, there is a heap-based buffer over-read in the function DCTStream::readScan() located at St...
In Xpdf 4.01.01, there is a heap-based buffer over-read in the function DCTStream::readScan() located at Stream.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftops tool. It might allow an attacker to cause Information Disclosure.
Published Jul 4, 2019 · Updated Aug 4, 2024
CVE-2019-13278: TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple command injections when pro...
TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple command injections when processing user input for the setup wizard, allowing an unauthenticated user to run arbitrary commands on the device. The vulnerability can be exercised on the local intranet or remotely if remote administration is enabled.
Published Jul 10, 2019 · Updated Aug 4, 2024
CVE-2019-13340: In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box.
In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, CVE-2018-20520, and CVE-2019-13186.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13387: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter f...
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter fm_current_dir) allows attackers to steal a cookie or session, or redirect to a phishing website.
Published Jul 26, 2019 · Updated Aug 4, 2024
CVE-2019-13305: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a mi...
ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13302: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/fourier.c in ComplexImages.
ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/fourier.c in ComplexImages.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13337: In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter...
In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token (this is the parameter used by the API). No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is required.
Published Jul 9, 2019 · Updated Aug 4, 2024
CVE-2019-13345: The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.
The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13385: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in fil...
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to enumerate users and check for active users of the application by reading /tmp/login.log.
Published Jul 26, 2019 · Updated Aug 4, 2024
CVE-2019-13375: A SQL Injection was discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 in PayAction...
A SQL Injection was discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 in PayAction.class.php with the index.php/Pay/passcodeAuth parameter passcode. The vulnerability does not need any authentication.
Published Jul 6, 2019 · Updated Aug 4, 2024
CVE-2019-13312: block_cmp() in libavcodec/zmbvenc.c in FFmpeg 4.1.3 has a heap-based buffer over-read.
block_cmp() in libavcodec/zmbvenc.c in FFmpeg 4.1.3 has a heap-based buffer over-read.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13346: In MyT 1.5.1, the User[username] parameter has XSS.
In MyT 1.5.1, the User[username] parameter has XSS.
Published Jul 17, 2019 · Updated Aug 4, 2024
CVE-2019-13308: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow in MagickCore/fourier.c in ComplexImage.
ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow in MagickCore/fourier.c in ComplexImage.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13370: index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator.
index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator.
Published Jul 6, 2019 · Updated Aug 4, 2024
CVE-2019-13296: ImageMagick 7.0.8-50 Q16 has direct memory leaks in AcquireMagickMemory because of an error in CLIListOpera...
ImageMagick 7.0.8-50 Q16 has direct memory leaks in AcquireMagickMemory because of an error in CLIListOperatorImages in MagickWand/operation.c for a NULL value.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13290: Artifex MuPDF 1.15.0 has a heap-based buffer overflow in fz_append_display_node located at fitz/list-device...
Artifex MuPDF 1.15.0 has a heap-based buffer overflow in fz_append_display_node located at fitz/list-device.c, allowing remote attackers to execute arbitrary code via a crafted PDF file. This occurs with a large BDC property name that overflows the allocated size of a display list node.
Published Jul 4, 2019 · Updated Aug 4, 2024
CVE-2019-13311: ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13344: An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress all...
An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings. The contains() function in wp_like_button.php did not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update settings, as demonstrated by the wp-admin/admin.php?page=facebook-like-button each_page_url or code_snippet parameter.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13309: ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage err...
ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage error in CLIListOperatorImages in MagickWand/operation.c.
Published Jul 5, 2019 · Updated Aug 4, 2024
CVE-2019-13286: In Xpdf 4.01.01, there is a heap-based buffer over-read in the function JBIG2Stream::readTextRegionSeg() lo...
In Xpdf 4.01.01, there is a heap-based buffer over-read in the function JBIG2Stream::readTextRegionSeg() located at JBIG2Stream.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool. It might allow an attacker to cause Information Disclosure.
Published Jul 4, 2019 · Updated Aug 4, 2024
CVE-2019-13306: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-...
ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.
Published Jul 5, 2019 · Updated Aug 4, 2024