# CVEs published 2019-10-02

74 CVEs were published on October 2, 2019: 2 critical, 25 high. Days are UTC.

- [CVE-2019-11651](https://cve.now/CVE-2019-11651.md): Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0… (no CVSS, Micro Focus Enterprise Developer and Enterprise Server)
- [CVE-2019-11929](https://cve.now/CVE-2019-11929.md): Insufficient boundary checks when formatting numbers in number\_format allows read/write access to out-of-bounds memory, potentially… (no CVSS, Facebook HHVM)
- [CVE-2019-1915](https://cve.now/CVE-2019-1915.md): Multiple Cisco Unified Communications Products Cross-Site Request Forgery Vulnerability (CVSS 6.5, Cisco Unified Communications Manager)
- [CVE-2019-15272](https://cve.now/CVE-2019-15272.md): Cisco Unified Communications Manager Security Bypass Vulnerability (CVSS 6.5, Cisco Unified Communications Manager)
- [CVE-2019-15259](https://cve.now/CVE-2019-15259.md): Cisco Unified Contact Center Express HTTP Response Splitting Vulnerability (CVSS 6.1, Cisco Unified Contact Center Express)
- [CVE-2019-15256](https://cve.now/CVE-2019-15256.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IKEv1 Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-12716](https://cve.now/CVE-2019-12716.md): Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unified Communications Manager)
- [CVE-2019-12715](https://cve.now/CVE-2019-12715.md): Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unified Communications Manager)
- [CVE-2019-12714](https://cve.now/CVE-2019-12714.md): Cisco IC3000 Industrial Compute Gateway Denial of Service Vulnerability (CVSS 6.5, Cisco IC3000 Industrial Compute Gateway)
- [CVE-2019-12713](https://cve.now/CVE-2019-12713.md): Cisco Prime Infrastructure Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Prime Infrastructure)
- [CVE-2019-12712](https://cve.now/CVE-2019-12712.md): Cisco Prime Infrastructure Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Prime Infrastructure)
- [CVE-2019-12711](https://cve.now/CVE-2019-12711.md): Cisco Unified Communications Manager XML External Expansion Vulnerability (CVSS 6.1, Cisco Unified Communications Manager)
- [CVE-2019-12710](https://cve.now/CVE-2019-12710.md): Cisco Unified Communications Manager SQL Injection Vulnerability (CVSS 4.9, Cisco Unified Communications Manager)
- [CVE-2019-12707](https://cve.now/CVE-2019-12707.md): Multiple Cisco Unified Communications Products Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unity Connection)
- [CVE-2019-12706](https://cve.now/CVE-2019-12706.md): Cisco Email Security Appliance Filter Bypass Vulnerability (CVSS 6.5, Cisco Email Security Appliance)
- [CVE-2019-12701](https://cve.now/CVE-2019-12701.md): Cisco Firepower Management Center Software File and Malware Policy Bypass Vulnerability (CVSS 5.8, Cisco Firepower Management Center)
- [CVE-2019-12700](https://cve.now/CVE-2019-12700.md): Cisco FTD, FMC, and FXOS Software Pluggable Authentication Module Denial of Service Vulnerability (CVSS 7.7, Cisco Firepower Management Center)
- [CVE-2019-12699](https://cve.now/CVE-2019-12699.md): Cisco FXOS Software and Firepower Threat Defense Software Command Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Extensible Operating System)
- [CVE-2019-12698](https://cve.now/CVE-2019-12698.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software WebVPN CPU Denial of Service Vulnerability (CVSS 5.3, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-12697](https://cve.now/CVE-2019-12697.md): Cisco Firepower System Software Detection Engine RTF and RAR Malware and File Policy Bypass Vulnerabilities (CVSS 5.8, Cisco FireSIGHT System Software)
- [CVE-2019-12696](https://cve.now/CVE-2019-12696.md): Cisco Firepower System Software Detection Engine RTF and RAR Malware and File Policy Bypass Vulnerabilities (CVSS 5.8, Cisco FireSIGHT System Software)
- [CVE-2019-12695](https://cve.now/CVE-2019-12695.md): Cisco Adaptive Security Appliance and Firepower Threat Defense Software WebVPN Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-12694](https://cve.now/CVE-2019-12694.md): Cisco Firepower Threat Defense Software Command Injection Vulnerability (CVSS 6.7, Cisco Firepower Threat Defense Software)
- [CVE-2019-12693](https://cve.now/CVE-2019-12693.md): Cisco Adaptive Security Appliance Software Secure Copy Denial of Service Vulnerability (CVSS 6.8, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-12691](https://cve.now/CVE-2019-12691.md): Cisco Firepower Management Center Directory Traversal Vulnerability (CVSS 4.1, Cisco Firepower Management Center)
- [CVE-2019-12690](https://cve.now/CVE-2019-12690.md): Cisco Firepower Management Center Command Injection Vulnerability (CVSS 7.2, Cisco Firepower Management Center)
- [CVE-2019-12689](https://cve.now/CVE-2019-12689.md): Cisco Firepower Management Center Remote Code Execution Vulnerability (CVSS 7.5, Cisco Firepower Management Center)
- [CVE-2019-12688](https://cve.now/CVE-2019-12688.md): Cisco Firepower Management Center Remote Code Execution Vulnerability (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12687](https://cve.now/CVE-2019-12687.md): Cisco Firepower Management Center Remote Code Execution Vulnerability (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12686](https://cve.now/CVE-2019-12686.md): Cisco Firepower Management Center SQL Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12685](https://cve.now/CVE-2019-12685.md): Cisco Firepower Management Center SQL Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12684](https://cve.now/CVE-2019-12684.md): Cisco Firepower Management Center SQL Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12683](https://cve.now/CVE-2019-12683.md): Cisco Firepower Management Center SQL Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12682](https://cve.now/CVE-2019-12682.md): Cisco Firepower Management Center SQL Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12681](https://cve.now/CVE-2019-12681.md): Cisco Firepower Management Center SQL Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12680](https://cve.now/CVE-2019-12680.md): Cisco Firepower Management Center SQL Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12679](https://cve.now/CVE-2019-12679.md): Cisco Firepower Management Center SQL Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12678](https://cve.now/CVE-2019-12678.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SIP Inspection Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-12677](https://cve.now/CVE-2019-12677.md): Cisco Adaptive Security Appliance Software SSL VPN Denial of Service Vulnerability (CVSS 7.7, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-12676](https://cve.now/CVE-2019-12676.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software OSPF LSA Processing Denial of Service Vulnerability (CVSS 7.4, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-12675](https://cve.now/CVE-2019-12675.md): Cisco Firepower Threat Defense Software Multi-instance Container Escape Vulnerabilities (CVSS 8.2, Cisco Firepower Threat Defense Software)
- [CVE-2019-12674](https://cve.now/CVE-2019-12674.md): Cisco Firepower Threat Defense Software Multi-instance Container Escape Vulnerabilities (CVSS 8.2, Cisco Firepower Threat Defense Software)
- [CVE-2019-12673](https://cve.now/CVE-2019-12673.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software FTP Inspection Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-12156](https://cve.now/CVE-2019-12156.md): Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity… (no CVSS)
- [CVE-2019-12157](https://cve.now/CVE-2019-12157.md): In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands. (no CVSS)
- [CVE-2019-12736](https://cve.now/CVE-2019-12736.md): JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command… (no CVSS)
- [CVE-2019-12737](https://cve.now/CVE-2019-12737.md): UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials. (no CVSS)
- [CVE-2019-13957](https://cve.now/CVE-2019-13957.md): In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter. (no CVSS)
- [CVE-2019-14956](https://cve.now/CVE-2019-14956.md): JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project… (no CVSS)
- [CVE-2019-14958](https://cve.now/CVE-2019-14958.md): JetBrains PyCharm before 2019.2 was allocating a buffer of unknown size for one of the connection processes. (no CVSS)
- [CVE-2019-14959](https://cve.now/CVE-2019-14959.md): JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection. (no CVSS)
- [CVE-2019-15036](https://cve.now/CVE-2019-15036.md): An issue was discovered in JetBrains TeamCity 2018.2.4. (no CVSS)
- [CVE-2019-15037](https://cve.now/CVE-2019-15037.md): An issue was discovered in JetBrains TeamCity 2018.2.4. (no CVSS)
- [CVE-2019-15040](https://cve.now/CVE-2019-15040.md): JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page. (no CVSS)
- [CVE-2019-16171](https://cve.now/CVE-2019-16171.md): In JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page. (no CVSS)
- [CVE-2019-10212](https://cve.now/CVE-2019-10212.md): A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. (CVSS 4.8, RedHat undertow · io.undertow:undertow-core)
- [CVE-2019-12631](https://cve.now/CVE-2019-12631.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2019-12630](https://cve.now/CVE-2019-12630.md): Cisco Security Manager Java Deserialization Vulnerability (CVSS 6.5, Cisco Security Manager)
- [CVE-2019-16407](https://cve.now/CVE-2019-16407.md): JetBrains ReSharper installers for versions before 2019.2 had a DLL Hijacking vulnerability. (no CVSS)
- [CVE-2019-8462](https://cve.now/CVE-2019-8462.md): In a rare scenario, Check Point R80.30 Security Gateway before JHF Take 50 managed by Check Point R80.30 Management crashes with a unique… (no CVSS, Check Point Security Gateway)
- [CVE-2019-13658](https://cve.now/CVE-2019-13658.md): CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary… (CVSS 9.8, CA Technologies, a Broadcom Company CA Network Flow Analysis)
- [CVE-2019-5031](https://cve.now/CVE-2019-5031.md): An exploitable memory corruption vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.4.1.16828. (CVSS 8.8, Foxit)
- [CVE-2019-13343](https://cve.now/CVE-2019-13343.md): Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. (CVSS 9.9)
- [CVE-2019-16116](https://cve.now/CVE-2019-16116.md): EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file. (no CVSS)
- [CVE-2019-13025](https://cve.now/CVE-2019-13025.md): Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices have Incorrect Access Control because of Improper Input Validation. (no CVSS)
- [CVE-2019-4549](https://cve.now/CVE-2019-4549.md): IBM Security Directory Server 6.4.0 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM Security Directory Server)
- [CVE-2019-4542](https://cve.now/CVE-2019-4542.md): IBM Security Directory Server 6.4.0 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Security Directory Server)
- [CVE-2019-4539](https://cve.now/CVE-2019-4539.md): IBM Security Directory Server 6.4.0 does not properly neutralize special elements that are used in XML, allowing attackers to modify the… (CVSS 7.1, IBM Security Directory Server)
- [CVE-2019-4538](https://cve.now/CVE-2019-4538.md): IBM Security Directory Server 6.4.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (CVSS 7.4, IBM Security Directory Server)
- [CVE-2019-4520](https://cve.now/CVE-2019-4520.md): IBM Security Directory Server 6.4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account… (CVSS 7.5, IBM Security Directory Server)
- [CVE-2019-17091](https://cve.now/CVE-2019-17091.md): faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer… (no CVSS, org.glassfish:javax.faces · org.glassfish:jakarta.faces)
- [CVE-2019-17080](https://cve.now/CVE-2019-17080.md): mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a REVIEWS\_CACHE file is controlled by an attacker… (no CVSS)
- [CVE-2019-14454](https://cve.now/CVE-2019-14454.md): SuiteCRM 7.11.x and 7.10.x before 7.11.8 and 7.10.20 is vulnerable to vertical privilege escalation. (no CVSS)
- [CVE-2019-13335](https://cve.now/CVE-2019-13335.md): SalesAgility SuiteCRM 7.10.x 7.10.19 and 7.11.x before and 7.11.7 has SSRF. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2019-10-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.