# CVEs published 2019-10-01

47 CVEs were published on October 1, 2019: 1 critical, 1 high. Days are UTC.

- [CVE-2019-17075](https://cve.now/CVE-2019-17075.md): An issue was discovered in write\_tpt\_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. (no CVSS)
- [CVE-2019-8288](https://cve.now/CVE-2019-8288.md): Vulnerability in Online Store v1.0, Stored XSS in user\_view.php where adidas\_member\_user variable is not sanitized. (no CVSS, abcprintf Online Store)
- [CVE-2019-8289](https://cve.now/CVE-2019-8289.md): Vulnerability in Online Store v1.0, stored XSS in admin/user\_view.php adidas\_member\_email variable (no CVSS, abcprintf Online Store)
- [CVE-2019-8290](https://cve.now/CVE-2019-8290.md): Vulnerability in Online Store v1.0, The registration form requirements for the member email format can be bypassed by posting directly to… (no CVSS, abcprintf Online Store)
- [CVE-2019-8291](https://cve.now/CVE-2019-8291.md): Online Store System v1.0 delete\_file.php doesn't check to see if a user has administrative rights nor does it check for path traversal. (no CVSS, abcprintf Online Store)
- [CVE-2019-8292](https://cve.now/CVE-2019-8292.md): Online Store System v1.0 delete\_product.php doesn't check to see if a user authtenticated or has administrative rights allowing arbitrary… (no CVSS, abcprintf Online Store)
- [CVE-2019-0231](https://cve.now/CVE-2019-0231.md): Apache MINA SSLFilter security Issue (no CVSS, Apache Software Foundation Apache MINA · org.apache.mina:mi…)
- [CVE-2019-15041](https://cve.now/CVE-2019-15041.md): JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted… (no CVSS)
- [CVE-2019-15035](https://cve.now/CVE-2019-15035.md): An issue was discovered in JetBrains TeamCity 2018.2.4. (no CVSS)
- [CVE-2019-17073](https://cve.now/CVE-2019-17073.md): emlog through 6.0.0beta allows remote authenticated users to delete arbitrary files via admin/template.php?action=del&tpl=../ directory… (no CVSS)
- [CVE-2019-17074](https://cve.now/CVE-2019-17074.md): An issue was discovered in XunRuiCMS 4.3.1. (no CVSS)
- [CVE-2019-7618](https://cve.now/CVE-2019-7618.md): A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. (no CVSS, Elastic Code)
- [CVE-2019-17067](https://cve.now/CVE-2019-17067.md): PuTTY before 0.73 on Windows improperly opens port-forwarding listening sockets, which allows attackers to listen on the same port to… (no CVSS)
- [CVE-2019-17068](https://cve.now/CVE-2019-17068.md): PuTTY before 0.73 mishandles the "bracketed paste mode" protection mechanism, which may allow a session to be affected by malicious… (no CVSS)
- [CVE-2019-14961](https://cve.now/CVE-2019-14961.md): JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS. (no CVSS)
- [CVE-2019-15042](https://cve.now/CVE-2019-15042.md): An issue was discovered in JetBrains TeamCity 2018.2.4. (no CVSS)
- [CVE-2019-16943](https://cve.now/CVE-2019-16943.md): A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. (CVSS 9.8, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2019-16942](https://cve.now/CVE-2019-16942.md): A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2019-14960](https://cve.now/CVE-2019-14960.md): JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file. (no CVSS)
- [CVE-2019-14955](https://cve.now/CVE-2019-14955.md): In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration… (no CVSS)
- [CVE-2019-14953](https://cve.now/CVE-2019-14953.md): JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser. (no CVSS)
- [CVE-2019-15038](https://cve.now/CVE-2019-15038.md): An issue was discovered in JetBrains TeamCity 2018.2.4. (no CVSS)
- [CVE-2019-14957](https://cve.now/CVE-2019-14957.md): The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vim\_settings.xml file. (no CVSS)
- [CVE-2019-17064](https://cve.now/CVE-2019-17064.md): Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor. (no CVSS)
- [CVE-2019-17063](https://cve.now/CVE-2019-17063.md): In Snowtide PDFxStream before 3.7.1 (for Java), a crafted PDF file can trigger an extremely long running computation because of page-tree… (no CVSS)
- [CVE-2019-4497](https://cve.now/CVE-2019-4497.md): IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Jazz Reporting Service)
- [CVE-2019-4495](https://cve.now/CVE-2019-4495.md): IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Jazz Reporting Service)
- [CVE-2019-4494](https://cve.now/CVE-2019-4494.md): IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Jazz Reporting Service)
- [CVE-2019-4246](https://cve.now/CVE-2019-4246.md): IBM Daeja ViewONE Virtual 5.0 through 5.0.6 could expose internal parameters to ViewONE clients that could be used in further attacks… (CVSS 3.7, IBM Daeja ViewONE Virtual)
- [CVE-2019-10202](https://cve.now/CVE-2019-10202.md): A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. (CVSS 8.1, RedHat codehaus · org.codehaus.jackson:jackson-mapper-asl)
- [CVE-2019-11275](https://cve.now/CVE-2019-11275.md): CSV Injection in usage report downloaded from Pivotal Application Manager (CVSS 3.5, Pivotal Apps Manager)
- [CVE-2019-10433](https://cve.now/CVE-2019-10433.md): Jenkins Dingding\[钉钉\] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users… (no CVSS, Jenkins project Jenkins Dingding\[钉钉\] Plugin · io.jenkins.pl…)
- [CVE-2019-10434](https://cve.now/CVE-2019-10434.md): Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially… (no CVSS, Jenkins project Jenkins LDAP Email Plugin · com.mtvi.platen…)
- [CVE-2019-10435](https://cve.now/CVE-2019-10435.md): Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting… (no CVSS, Jenkins project Jenkins SourceGear Vault Plugin · org.jenki…)
- [CVE-2019-10431](https://cve.now/CVE-2019-10431.md): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions… (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2019-10432](https://cve.now/CVE-2019-10432.md): Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a… (no CVSS, Jenkins project Jenkins HTML Publisher Plugin · org.jenkins…)
- [CVE-2019-14952](https://cve.now/CVE-2019-14952.md): JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles. (no CVSS)
- [CVE-2019-14954](https://cve.now/CVE-2019-14954.md): JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection. (no CVSS)
- [CVE-2019-15039](https://cve.now/CVE-2019-15039.md): An issue was discovered in JetBrains TeamCity 2018.2.4. (no CVSS)
- [CVE-2019-17052](https://cve.now/CVE-2019-17052.md): ax25\_create in net/ax25/af\_ax25.c in the AF\_AX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAP\_NET\_RAW, which… (no CVSS)
- [CVE-2019-17053](https://cve.now/CVE-2019-17053.md): ieee802154\_create in net/ieee802154/socket.c in the AF\_IEEE802154 network module in the Linux kernel through 5.3.2 does not enforce… (no CVSS)
- [CVE-2019-17054](https://cve.now/CVE-2019-17054.md): atalk\_create in net/appletalk/ddp.c in the AF\_APPLETALK network module in the Linux kernel through 5.3.2 does not enforce CAP\_NET\_RAW… (no CVSS)
- [CVE-2019-17055](https://cve.now/CVE-2019-17055.md): base\_sock\_create in drivers/isdn/mISDN/socket.c in the AF\_ISDN network module in the Linux kernel through 5.3.2 does not enforce… (no CVSS)
- [CVE-2019-17056](https://cve.now/CVE-2019-17056.md): llcp\_sock\_create in net/nfc/llcp\_sock.c in the AF\_NFC network module in the Linux kernel through 5.3.2 does not enforce CAP\_NET\_RAW, which… (no CVSS)
- [CVE-2019-15940](https://cve.now/CVE-2019-15940.md): Victure PC530 devices allow unauthenticated TELNET access as root. (no CVSS)
- [CVE-2019-16508](https://cve.now/CVE-2019-16508.md): The Imagination Technologies driver for Chrome OS before R74-11895.B, R75 before R75-12105.B, and R76 before R76-12208.0.0 allows… (no CVSS)
- [CVE-2019-17069](https://cve.now/CVE-2019-17069.md): PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2019-10-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.