# CVEs published 2019-09-12

42 CVEs were published on September 12, 2019: 2 critical, 2 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-16275](https://cve.now/CVE-2019-16275.md): hostapd before 2.10 and wpa\_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source… (no CVSS)
- [CVE-2019-13530](https://cve.now/CVE-2019-13530.md): Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #… (no CVSS, Philips IntelliVue WLAN, portable patient monitors)
- [CVE-2019-13534](https://cve.now/CVE-2019-13534.md): Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #… (no CVSS, Philips IntelliVue WLAN, portable patient monitors)
- [CVE-2019-11899](https://cve.now/CVE-2019-11899.md): An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a client installation. (CVSS 8.8, Bosch Access Professional Edition)
- [CVE-2019-11898](https://cve.now/CVE-2019-11898.md): Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. (CVSS 9.9, Bosch Access Professional Edition)
- [CVE-2019-8070](https://cve.now/CVE-2019-8070.md): Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use after free vulnerability. (no CVSS, Adobe Flash Player)
- [CVE-2019-8076](https://cve.now/CVE-2019-8076.md): Adobe application manager installer version 10.0 have an Insecure Library Loading (DLL hijacking) vulnerability. (no CVSS, Adobe Application Manager)
- [CVE-2019-8069](https://cve.now/CVE-2019-8069.md): Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Same Origin Method Execution vulnerability. (no CVSS, Adobe Flash Player)
- [CVE-2019-14237](https://cve.now/CVE-2019-14237.md): On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only… (no CVSS)
- [CVE-2019-14236](https://cve.now/CVE-2019-14236.md): On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a… (no CVSS)
- [CVE-2019-11773](https://cve.now/CVE-2019-11773.md): Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users. (no CVSS, The Eclipse Foundation Eclipse OMR)
- [CVE-2019-11774](https://cve.now/CVE-2019-11774.md): Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the… (no CVSS, The Eclipse Foundation Eclipse OMR)
- [CVE-2019-5956](https://cve.now/CVE-2019-5956.md): Directory traversal vulnerability in WonderCMS 2.6.0 and earlier allows remote attackers to delete arbitrary files via unspecified vectors. (no CVSS, WonderCMS 2.6.0 and earlier)
- [CVE-2019-5975](https://cve.now/CVE-2019-5975.md): DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary… (no CVSS, Inc." Cybozu Garoon)
- [CVE-2019-5976](https://cve.now/CVE-2019-5976.md): Cybozu Garoon 4.0.0 to 4.10.2 allows an attacker with administrative rights to cause a denial of service condition via unspecified vectors. (no CVSS, Inc." Cybozu Garoon)
- [CVE-2019-5977](https://cve.now/CVE-2019-5977.md): Mail header injection vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 may allow a remote authenticated attackers to alter mail header via… (no CVSS, Inc." Cybozu Garoon)
- [CVE-2019-5978](https://cve.now/CVE-2019-5978.md): Open redirect vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 allows remote attackers to redirect users to arbitrary web sites and conduct… (no CVSS, Cybozu Garoon)
- [CVE-2019-5985](https://cve.now/CVE-2019-5985.md): Cross-site scripting vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND… (no CVSS, Hikari Denwa router/Home GateWay provided by NIPPON TELEGRA…)
- [CVE-2019-5986](https://cve.now/CVE-2019-5986.md): Cross-site request forgery (CSRF) vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON… (no CVSS, Hikari Denwa router/Home GateWay provided by NIPPON TELEGRA…)
- [CVE-2019-5991](https://cve.now/CVE-2019-5991.md): SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.3 allows remote authenticated attackers to execute arbitrary SQL commands… (no CVSS, Inc." Cybozu Garoon)
- [CVE-2019-5992](https://cve.now/CVE-2019-5992.md): Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to… (no CVSS, WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier)
- [CVE-2019-5993](https://cve.now/CVE-2019-5993.md): Cross-site request forgery (CSRF) vulnerability in Category Specific RSS feed Subscription version v2.0 and earlier allows remote… (no CVSS, Category Specific RSS feed Subscription)
- [CVE-2019-5996](https://cve.now/CVE-2019-5996.md): SQL injection vulnerability in the Video Insight VMS 7.3.2.5 and earlier allows remote authenticated attackers to execute arbitrary SQL… (no CVSS, Video Insight VMS 7.3.2.5 and earlier)
- [CVE-2019-6003](https://cve.now/CVE-2019-6003.md): Cross-site scripting vulnerability in EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13' version 2.4.2 and earlier allows remote attackers to… (no CVSS, LTD." EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13')
- [CVE-2019-6004](https://cve.now/CVE-2019-6004.md): Open redirect vulnerability in ApeosWare Management Suite Ver.1.4.0.18 and earlier, and ApeosWare Management Suite 2 Ver.2.1.2.4 and… (no CVSS, Fuji Xerox Co. ApeosWare Management Suite and ApeosWare Man…)
- [CVE-2019-6005](https://cve.now/CVE-2019-6005.md): Smart TV Box firmware version prior to 1300 allows remote attackers to bypass access restriction to conduct arbitrary operations on the… (no CVSS, Smart TV Box firmware)
- [CVE-2019-6007](https://cve.now/CVE-2019-6007.md): Integer overflow vulnerability in apng-drawable 1.0.0 to 1.6.0 allows an attacker to cause a denial of service (DoS) condition or execute… (no CVSS, apng-drawable 1.0.0 to)
- [CVE-2019-6009](https://cve.now/CVE-2019-6009.md): Open redirect vulnerability in SHIRASAGI v1.7.0 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct… (no CVSS, SHIRASAGI Project SHIRASAGI)
- [CVE-2019-16238](https://cve.now/CVE-2019-16238.md): Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the… (no CVSS)
- [CVE-2019-3638](https://cve.now/CVE-2019-3638.md): Web Gateway (MWG) - Reflected Cross Site Scripting vulnerability (CVSS 8.1, McAfee Web Gateway)
- [CVE-2019-16261](https://cve.now/CVE-2019-16261.md): Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as… (no CVSS)
- [CVE-2019-10392](https://cve.now/CVE-2019-10392.md): Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git… (no CVSS, Jenkins project Jenkins Git Client Plugin · org.jenkins-ci.…)
- [CVE-2019-10393](https://cve.now/CVE-2019-10393.md): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call… (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2019-10394](https://cve.now/CVE-2019-10394.md): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property… (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2019-10395](https://cve.now/CVE-2019-10395.md): Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting… (no CVSS, Jenkins project Jenkins Build Environment Plugin · org.jenk…)
- [CVE-2019-10396](https://cve.now/CVE-2019-10396.md): Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability… (no CVSS, Jenkins project Jenkins Dashboard View Plugin · org.jenkins…)
- [CVE-2019-10397](https://cve.now/CVE-2019-10397.md): Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job… (no CVSS, Jenkins project Jenkins Aqua Security Serverless Scanner Pl…)
- [CVE-2019-10398](https://cve.now/CVE-2019-10398.md): Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where… (no CVSS, Jenkins project Jenkins Beaker Builder Plugin · org.jenkins…)
- [CVE-2019-10399](https://cve.now/CVE-2019-10399.md): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property… (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2019-10400](https://cve.now/CVE-2019-10400.md): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment… (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2019-16256](https://cve.now/CVE-2019-16256.md): Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve l (CVSS 9.8, KEV)
- [CVE-2019-16257](https://cve.now/CVE-2019-16257.md): Some Motorola devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2019-09-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.