CVEs published September 3, 2019
36 CVEs were published on September 3, 2019: 0 critical, 2 high.
- Published
- 36
- Critical
- 0
- High
- 2
- Medium
- 9
- Low
- 0
- Unrated
- 25
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Lenovo XClarity Administrator
- 3
- Artifex Software ghostscript
- 2
- Dell EMC Enterprise Copy Data Management
- 1
- DELL EMC Unity Operating Environment · DELL EMC UnityVSA… +1
- 1
- larvitbase-api
- 1
- Lenovo XClarity Administrator · Lenovo XClarity Integrat… +1
- 1
- Microsoft Windows
- 1
- NAVER NDrive
- 1
- Nexus Repository Manager · org.sonatype.nexus.plugins:nexus…
- 1
- samba
- 1
High 2
- CVE-2019-14817A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privArtifex Software ghostscript
- CVE-2019-14811A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileArtifex Software ghostscript
Medium, low and unrated 34
- CVE-2019-15898Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page.
- CVE-2019-15892An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1.
- CVE-2019-5480A path traversal vulnerability in <= v0.9.7 of statichttpserver npm module allows attackers to list files in arbitrary folders.statichttpserver
- CVE-2019-5478A weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices.Zynq UltraScale+ SoC
- CVE-2019-5479An unintended require vulnerability in <v0.5.5 larvitbase-api may allow an attacker to load arbitrary non-production code (JavaScript file).larvitbase-api
- CVE-2019-5475The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnNexus Repository Manager · org.sonatype.nexus.plugins:nexus…
- CVE-2019-6182A stored CSV Injection vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an adminiLenovo XClarity Administrator
- CVE-2019-6181A reflected cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that couldLenovo XClarity Administrator
- CVE-2019-6180A stored cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could alLenovo XClarity Administrator
- CVE-2019-6179An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo XLenovo XClarity Administrator · Lenovo XClarity Integrat… +1
- CVE-2019-14261An issue was discovered on ABUS Secvest FUAA50000 3.01.01 devices.
- CVE-2019-1125Windows Kernel Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2019-15889The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search
- CVE-2019-3754Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe320DELL EMC Unity Operating Environment · DELL EMC UnityVSA… +1
- CVE-2019-3751Dell EMC Enterprise Copy Data Management (eCDM) versions 1.0, 1.1, 2.0, 2.1, and 3.0 contain a certificate validation vulnerability.Dell EMC Enterprise Copy Data Management
- CVE-2019-10197A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters wsamba
- CVE-2019-13156NDrive(1.2.2).sys in Naver Cloud Explorer has a stack-based buffer overflow, which allows attackers to cause a denial of service when readinNAVER NDrive
- CVE-2019-15873The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.
- CVE-2019-15871The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.
- CVE-2019-15872The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.
- CVE-2019-15870The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.
- CVE-2019-15869The JobCareer theme before 2.5.1 for WordPress has stored XSS.
- CVE-2019-15868The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.
- CVE-2019-15867The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber ca
- CVE-2019-15866The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_im
- CVE-2019-15865The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.
- CVE-2019-15864The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS.
- CVE-2019-15043In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use.
- CVE-2019-15863The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.
- CVE-2019-15860Xpdf 2.00 allows a SIGSEGV in XRef::constructXRef in XRef.cc.
- CVE-2019-15858admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import,
- CVE-2015-9383FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.
- CVE-2015-9382FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Me
- CVE-2015-9381FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c.