# CVEs published 2019-09-04 37 CVEs were published on September 4, 2019: 0 critical, 0 high. Days are UTC. - [CVE-2017-18595](https://cve.now/CVE-2017-18595.md): An issue was discovered in the Linux kernel before 4.14.11. (no CVSS) - [CVE-2019-15925](https://cve.now/CVE-2019-15925.md): An issue was discovered in the Linux kernel before 5.2.3. (no CVSS) - [CVE-2019-15926](https://cve.now/CVE-2019-15926.md): An issue was discovered in the Linux kernel before 5.2.3. (no CVSS) - [CVE-2018-21008](https://cve.now/CVE-2018-21008.md): An issue was discovered in the Linux kernel before 4.16.7. (no CVSS) - [CVE-2019-15927](https://cve.now/CVE-2019-15927.md): An issue was discovered in the Linux kernel before 4.20.2. (no CVSS) - [CVE-2019-12586](https://cve.now/CVE-2019-12586.md): The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266\_NONOS\_SDK 2.2.0 through 3.1.0 processes EAP Success message (no CVSS) - [CVE-2019-14319](https://cve.now/CVE-2019-14319.md): The TikTok (formerly Musical.ly) application 12.2.0 for Android and iOS performs unencrypted transmission of images, videos, and likes. (no CVSS) - [CVE-2019-14470](https://cve.now/CVE-2019-14470.md): cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/s (no CVSS, cosenary/instagram) - [CVE-2019-15917](https://cve.now/CVE-2019-15917.md): An issue was discovered in the Linux kernel before 5.0.5. (no CVSS) - [CVE-2019-15918](https://cve.now/CVE-2019-15918.md): An issue was discovered in the Linux kernel before 5.0.10. (no CVSS) - [CVE-2019-15919](https://cve.now/CVE-2019-15919.md): An issue was discovered in the Linux kernel before 5.0.10. (no CVSS) - [CVE-2019-15920](https://cve.now/CVE-2019-15920.md): An issue was discovered in the Linux kernel before 5.0.10. (no CVSS) - [CVE-2019-15921](https://cve.now/CVE-2019-15921.md): An issue was discovered in the Linux kernel before 5.0.6. (no CVSS) - [CVE-2019-15922](https://cve.now/CVE-2019-15922.md): An issue was discovered in the Linux kernel before 5.0.9. (no CVSS) - [CVE-2019-15923](https://cve.now/CVE-2019-15923.md): An issue was discovered in the Linux kernel before 5.0.9. (no CVSS) - [CVE-2019-15924](https://cve.now/CVE-2019-15924.md): An issue was discovered in the Linux kernel before 5.0.11. (no CVSS) - [CVE-2019-6643](https://cve.now/CVE-2019-6643.md): On versions 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, 12.1.0-12.1.4.1, and 11.5.2-11.6.4, an attacker sending specifically crafted DH (no CVSS, BIG-IP) - [CVE-2019-6646](https://cve.now/CVE-2019-6646.md): On BIG-IP 11.5.2-11.6.4 and Enterprise Manager 3.1.1, REST users with guest privileges may be able to escalate their privileges and run comm (no CVSS, BIG-IP, Enterprise Manager) - [CVE-2019-6644](https://cve.now/CVE-2019-6644.md): Similar to the issue identified in CVE-2018-12120, on versions 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, and 12.1.0-12.1.4 BIG-IP wil (no CVSS, BIG-IP) - [CVE-2019-6647](https://cve.now/CVE-2019-6647.md): On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, 12.1.0-12.1.4.1, 11.5.2-11.6.4, when processing authentication attempts for contr (no CVSS, BIG-IP) - [CVE-2019-6648](https://cve.now/CVE-2019-6648.md): On version 1.9.0, If DEBUG logging is enable, F5 Container Ingress Service (CIS) for Kubernetes and Red Hat OpenShift (k8s-bigip-ctlr) log f (no CVSS, F5 Container Ingress Service) - [CVE-2019-6645](https://cve.now/CVE-2019-6645.md): On BIG-IP 14.0.0-14.1.0.5, 13.0.0-13.1.2, 12.1.0-12.1.4.1, 11.5.2-11.6.4, FTP traffic passing through a Virtual Server with both an active F (no CVSS, BIG-IP) - [CVE-2019-13976](https://cve.now/CVE-2019-13976.md): eGain Chat 15.0.3 allows unrestricted file upload. (no CVSS) - [CVE-2019-13975](https://cve.now/CVE-2019-13975.md): eGain Chat 15.0.3 allows HTML Injection. (no CVSS) - [CVE-2019-15916](https://cve.now/CVE-2019-15916.md): An issue was discovered in the Linux kernel before 5.0.1. (no CVSS) - [CVE-2019-13518](https://cve.now/CVE-2019-13518.md): An attacker could use a specially crafted project file to overflow the buffer and execute code under the privileges of the EZ Touch Editor V (no CVSS, EZ Touch Editor) - [CVE-2019-13522](https://cve.now/CVE-2019-13522.md): An attacker could use a specially crafted project file to corrupt the memory and execute code under the privileges of the EZ PLC Editor Vers (no CVSS, EZ PLC Editor) - [CVE-2019-15814](https://cve.now/CVE-2019-15814.md): Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML. (no CVSS) - [CVE-2019-15813](https://cve.now/CVE-2019-15813.md): Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arbitrary code via a we (no CVSS) - [CVE-2019-13209](https://cve.now/CVE-2019-13209.md): Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed (no CVSS, github.com/rancher/rancher) - [CVE-2019-10988](https://cve.now/CVE-2019-10988.md): In Philips HDI 4000 Ultrasound Systems, all versions running on old, unsupported operating systems such as Windows 2000, the HDI 4000 Ultras (no CVSS, Philips HDI 4000 Ultrasound Systems) - [CVE-2019-12587](https://cve.now/CVE-2019-12587.md): The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266\_NONOS\_SDK 2.2.0 through 3.1.0 allows the installation of a (no CVSS) - [CVE-2019-12588](https://cve.now/CVE-2019-12588.md): The client 802.11 mac implementation in Espressif ESP8266\_NONOS\_SDK 2.2.0 through 3.1.0 does not validate correctly the RSN AuthKey suite li (no CVSS) - [CVE-2019-10709](https://cve.now/CVE-2019-10709.md): AsusPTPFilter.sys on Asus Precision TouchPad 11.0.0.25 hardware has a Pool Overflow associated with the \\\\.\\AsusTP device, leading to a DoS (no CVSS) - [CVE-2019-15718](https://cve.now/CVE-2019-15718.md): In systemd 240, bus\_open\_system\_watch\_bind\_with\_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus (no CVSS) - [CVE-2019-15903](https://cve.now/CVE-2019-15903.md): In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutiv (CVSS 6.5) - [CVE-2019-15902](https://cve.now/CVE-2019-15902.md): A backporting error was discovered in the Linux stable/longterm kernel 4.4.x through 4.4.190, 4.9.x through 4.9.190, 4.14.x through 4.14.141 (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-09-04 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.