# CVEs published 2019-09-03

36 CVEs were published on September 3, 2019: 0 critical, 2 high. Days are UTC.

- [CVE-2019-15898](https://cve.now/CVE-2019-15898.md): Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page. (no CVSS)
- [CVE-2019-15892](https://cve.now/CVE-2019-15892.md): An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. (no CVSS)
- [CVE-2019-5480](https://cve.now/CVE-2019-5480.md): A path traversal vulnerability in \<= v0.9.7 of statichttpserver npm module allows attackers to list files in arbitrary folders. (no CVSS, statichttpserver)
- [CVE-2019-5478](https://cve.now/CVE-2019-5478.md): A weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices. (no CVSS, Zynq UltraScale+ SoC)
- [CVE-2019-5479](https://cve.now/CVE-2019-5479.md): An unintended require vulnerability in \<v0.5.5 larvitbase-api may allow an attacker to load arbitrary non-production code (JavaScript file). (no CVSS, larvitbase-api)
- [CVE-2019-5475](https://cve.now/CVE-2019-5475.md): The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vuln (no CVSS, Nexus Repository Manager · org.sonatype.nexus.plugins:nexus…)
- [CVE-2019-6182](https://cve.now/CVE-2019-6182.md): A stored CSV Injection vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an admini (CVSS 4.8, Lenovo XClarity Administrator)
- [CVE-2019-6181](https://cve.now/CVE-2019-6181.md): A reflected cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could (CVSS 6.1, Lenovo XClarity Administrator)
- [CVE-2019-6180](https://cve.now/CVE-2019-6180.md): A stored cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could al (CVSS 4.8, Lenovo XClarity Administrator)
- [CVE-2019-6179](https://cve.now/CVE-2019-6179.md): An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo X (CVSS 5.3, Lenovo XClarity Administrator · Lenovo XClarity Integrat… +1)
- [CVE-2019-14261](https://cve.now/CVE-2019-14261.md): An issue was discovered on ABUS Secvest FUAA50000 3.01.01 devices. (no CVSS)
- [CVE-2019-1125](https://cve.now/CVE-2019-1125.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.6, Microsoft Windows)
- [CVE-2019-15889](https://cve.now/CVE-2019-15889.md): The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search (CVSS 6.1)
- [CVE-2019-3754](https://cve.now/CVE-2019-3754.md): Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe320 (CVSS 4.7, DELL EMC Unity Operating Environment · DELL EMC UnityVSA… +1)
- [CVE-2019-3751](https://cve.now/CVE-2019-3751.md): Dell EMC Enterprise Copy Data Management (eCDM) versions 1.0, 1.1, 2.0, 2.1, and 3.0 contain a certificate validation vulnerability. (CVSS 6.4, Dell EMC Enterprise Copy Data Management)
- [CVE-2019-14817](https://cve.now/CVE-2019-14817.md): A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its priv (CVSS 7.3, Artifex Software ghostscript)
- [CVE-2019-14811](https://cve.now/CVE-2019-14811.md): A flaw was found in, ghostscript versions prior to 9.50, in the .pdf\_hook\_DSC\_Creator procedure where it did not properly secure its privile (CVSS 7.3, Artifex Software ghostscript)
- [CVE-2019-10197](https://cve.now/CVE-2019-10197.md): A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters w (CVSS 6.5, samba)
- [CVE-2019-13156](https://cve.now/CVE-2019-13156.md): NDrive(1.2.2).sys in Naver Cloud Explorer has a stack-based buffer overflow, which allows attackers to cause a denial of service when readin (no CVSS, NAVER NDrive)
- [CVE-2019-15873](https://cve.now/CVE-2019-15873.md): The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax. (no CVSS)
- [CVE-2019-15871](https://cve.now/CVE-2019-15871.md): The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings. (no CVSS)
- [CVE-2019-15872](https://cve.now/CVE-2019-15872.md): The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings. (no CVSS)
- [CVE-2019-15870](https://cve.now/CVE-2019-15870.md): The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field. (no CVSS)
- [CVE-2019-15869](https://cve.now/CVE-2019-15869.md): The JobCareer theme before 2.5.1 for WordPress has stored XSS. (no CVSS)
- [CVE-2019-15868](https://cve.now/CVE-2019-15868.md): The affiliates-manager plugin before 2.6.6 for WordPress has CSRF. (no CVSS)
- [CVE-2019-15867](https://cve.now/CVE-2019-15867.md): The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber ca (no CVSS)
- [CVE-2019-15866](https://cve.now/CVE-2019-15866.md): The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp\_ajax\_crellyslider\_im (no CVSS)
- [CVE-2019-15865](https://cve.now/CVE-2019-15865.md): The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF. (no CVSS)
- [CVE-2019-15864](https://cve.now/CVE-2019-15864.md): The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS. (no CVSS)
- [CVE-2019-15043](https://cve.now/CVE-2019-15043.md): In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. (no CVSS)
- [CVE-2019-15863](https://cve.now/CVE-2019-15863.md): The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants. (no CVSS)
- [CVE-2019-15860](https://cve.now/CVE-2019-15860.md): Xpdf 2.00 allows a SIGSEGV in XRef::constructXRef in XRef.cc. (no CVSS)
- [CVE-2019-15858](https://cve.now/CVE-2019-15858.md): admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, (no CVSS)
- [CVE-2015-9383](https://cve.now/CVE-2015-9383.md): FreeType before 2.6.2 has a heap-based buffer over-read in tt\_cmap14\_validate in sfnt/ttcmap.c. (no CVSS)
- [CVE-2015-9382](https://cve.now/CVE-2015-9382.md): FreeType before 2.6.1 has a buffer over-read in skip\_comment in psaux/psobjs.c because ps\_parser\_skip\_PS\_token is mishandled in an FT\_New\_Me (no CVSS)
- [CVE-2015-9381](https://cve.now/CVE-2015-9381.md): FreeType before 2.6.1 has a heap-based buffer over-read in T1\_Get\_Private\_Dict in type1/t1parse.c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-09-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.