# CVEs published 2019-09-05

59 CVEs were published on September 5, 2019: 0 critical, 4 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-2181](https://cve.now/CVE-2019-2181.md): In binder\_transaction of binder.c in the Android kernel, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2019-2108](https://cve.now/CVE-2019-2108.md): In ihevcd\_ref\_list of ihevcd\_ref\_list.c in Android 10, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-9254](https://cve.now/CVE-2019-9254.md): In readArgumentList of zygote.java in Android 10, there is a possible command injection due to improper input validation. (no CVSS, Android)
- [CVE-2019-2124](https://cve.now/CVE-2019-2124.md): In ComposeActivityEmailExternal of ComposeActivityEmailExternal.java in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible way to sil (no CVSS, Android)
- [CVE-2019-2180](https://cve.now/CVE-2019-2180.md): In ippSetValueTag of ipp.c in Android 8.0, 8.1 and 9, there is a possible out of bounds read due to improper input validation. (no CVSS, Android)
- [CVE-2019-2179](https://cve.now/CVE-2019-2179.md): In NDEF\_MsgValidate of ndef\_utils in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible out of bounds read due to an integer overflow (no CVSS, Android)
- [CVE-2019-2178](https://cve.now/CVE-2019-2178.md): In rw\_t4t\_sm\_read\_ndef of rw\_t4t in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible out of bounds write due to a missing bounds ch (no CVSS, Android)
- [CVE-2019-2115](https://cve.now/CVE-2019-2115.md): In GateKeeper::MintAuthToken of gatekeeper.cpp in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is possible memory corruption due to a double (no CVSS, Android)
- [CVE-2019-2177](https://cve.now/CVE-2019-2177.md): In isPreferred of HidProfile.java in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible device type confusion due to a permissions by (no CVSS, Android)
- [CVE-2019-2176](https://cve.now/CVE-2019-2176.md): In ihevcd\_parse\_buffering\_period\_sei of ihevcd\_parse\_headers.c in Android 8.0, 8.1 and 9, there is a possible out of bounds write due to a m (no CVSS, Android)
- [CVE-2019-2103](https://cve.now/CVE-2019-2103.md): In Google Assistant in Android 9, there is a possible permissions bypass that allows the Assistant to take a screenshot of apps with FLAG\_SE (no CVSS, Android)
- [CVE-2019-2175](https://cve.now/CVE-2019-2175.md): In checkAccess of SliceManagerService.java in Android 9, there is a possible permissions check bypass due to incorrect order of arguments. (no CVSS, Android)
- [CVE-2019-2174](https://cve.now/CVE-2019-2174.md): In SensorManager::assertStateLocked of SensorManager.cpp in Android 7.1.1, 7.1.2, 8.0, 8.1, and 9, there is a possible use after free due to (no CVSS, Android)
- [CVE-2019-2123](https://cve.now/CVE-2019-2123.md): In execTransact of Binder.java in Android 7.1.1, 7.1.2, 8.0, 8.1, and 9, there is a possible local execution of arbitrary code in a privileg (no CVSS, Android)
- [CVE-2019-14222](https://cve.now/CVE-2019-14222.md): An issue was discovered in Alfresco Community Edition versions 6.0 and lower. (no CVSS)
- [CVE-2019-14224](https://cve.now/CVE-2019-14224.md): An issue was discovered in Alfresco Community Edition 5.2 201707. (no CVSS)
- [CVE-2019-15029](https://cve.now/CVE-2019-15029.md): FusionPBX 4.4.8 allows an attacker to execute arbitrary system commands by submitting a malicious command to the service\_edit.php file (whic (no CVSS)
- [CVE-2019-11380](https://cve.now/CVE-2019-11380.md): The master-password feature in the ES File Explorer File Manager application 4.2.0.1.3 for Android can be bypassed via a com.estrongs.androi (no CVSS)
- [CVE-2019-10753](https://cve.now/CVE-2019-10753.md): In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to versi (no CVSS, Spotless · com.diffplug.spotless:spotless-eclipse-wtp +2)
- [CVE-2019-14339](https://cve.now/CVE-2019-14339.md): The ContentProvider in the Canon PRINT jp.co.canon.bsd.ad.pixmaprint 2.5.5 application for Android does not properly restrict canon.ij.print (no CVSS)
- [CVE-2019-15848](https://cve.now/CVE-2019-15848.md): JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbitrary HTTP request t (no CVSS)
- [CVE-2019-15944](https://cve.now/CVE-2019-15944.md): In Counter-Strike: Global Offensive before 8/29/2019, community game servers can display unsafe HTML in a disconnection message. (no CVSS)
- [CVE-2019-15952](https://cve.now/CVE-2019-15952.md): An issue was discovered in Total.js CMS 12.0.0. (no CVSS, total4)
- [CVE-2019-15953](https://cve.now/CVE-2019-15953.md): An issue was discovered in Total.js CMS 12.0.0. (no CVSS, total4)
- [CVE-2019-15954](https://cve.now/CVE-2019-15954.md): An issue was discovered in Total.js CMS 12.0.0. (no CVSS, total4)
- [CVE-2019-15955](https://cve.now/CVE-2019-15955.md): An issue was discovered in Total.js CMS 12.0.0. (no CVSS)
- [CVE-2019-13188](https://cve.now/CVE-2019-13188.md): In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application. (no CVSS)
- [CVE-2019-14278](https://cve.now/CVE-2019-14278.md): In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page. (no CVSS)
- [CVE-2019-13191](https://cve.now/CVE-2019-13191.md): A SQL injection vulnerability in IntraMaps MapControl 8 allows attackers to execute arbitrary SQL commands via the /ApplicationEngine/Search (no CVSS)
- [CVE-2019-13187](https://cve.now/CVE-2019-13187.md): The Rich Text Formatter (Redactor) extension through v1.1.1 for Symphony CMS has an Unauthenticated arbitrary file upload vulnerability in c (no CVSS)
- [CVE-2019-13349](https://cve.now/CVE-2019-13349.md): In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes. (no CVSS)
- [CVE-2019-5070](https://cve.now/CVE-2019-5070.md): An exploitable SQL injection vulnerability exists in the unauthenticated portion of eFront LMS, versions v5.2.12 and earlier. (CVSS 6.5, Epignosis)
- [CVE-2019-5069](https://cve.now/CVE-2019-5069.md): A code execution vulnerability exists in Epignosis eFront LMS v5.2.12. (CVSS 8.8, Epignosis)
- [CVE-2019-15949](https://cve.now/CVE-2019-15949.md): Nagios XI before 5.6.6 allows remote command execution as root. (CVSS 8.8, KEV)
- [CVE-2019-13190](https://cve.now/CVE-2019-13190.md): In Knowage through 6.1.1, the sign up page does not invalidate a valid CAPTCHA token. (no CVSS)
- [CVE-2019-13361](https://cve.now/CVE-2019-13361.md): Smanos W100 1.0.0 devices have Insecure Permissions, exploitable by an attacker on the same Wi-Fi network. (no CVSS)
- [CVE-2019-15947](https://cve.now/CVE-2019-15947.md): In Bitcoin Core 0.18.0, bitcoin-qt stores wallet.dat data unencrypted in memory. (no CVSS)
- [CVE-2019-5065](https://cve.now/CVE-2019-5065.md): An exploitable information disclosure vulnerability exists in the packet-parsing functionality of Blynk-Library v0.6.1. (CVSS 5.3, Blynck Inc)
- [CVE-2019-15946](https://cve.now/CVE-2019-15946.md): OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1\_decode\_entry in libopensc/asn1.c. (no CVSS)
- [CVE-2019-15945](https://cve.now/CVE-2019-15945.md): OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode\_bit\_string in libopensc/asn1.c. (no CVSS)
- [CVE-2019-15942](https://cve.now/CVE-2019-15942.md): FFmpeg through 4.2 has a "Conditional jump or move depends on uninitialised value" issue in h2645\_parse because alloc\_rbsp\_buffer in libavco (no CVSS)
- [CVE-2018-11569](https://cve.now/CVE-2018-11569.md): Controller/ListController.php in Eventum 3.5.0 is vulnerable to Deserialization of Untrusted Data. (no CVSS)
- [CVE-2019-15939](https://cve.now/CVE-2019-15939.md): An issue was discovered in OpenCV 4.1.0. (no CVSS, opencv-python · opencv-python-headless +2)
- [CVE-2019-12223](https://cve.now/CVE-2019-12223.md): An issue was discovered in NVR WebViewer on Hanwah Techwin SRN-472s 1.07\_190502 devices, and other SRN-x devices before 2019-05-03. (no CVSS)
- [CVE-2019-4321](https://cve.now/CVE-2019-4321.md): IBM Intelligent Operations Center V5.1.0 - V5.2.0, IBM Intelligent Operations Center for Emergency Management V5.1.0 - V5.1.0.6, and IBM Wat (CVSS 5.9, IBM Intelligent Operations Center)
- [CVE-2019-4186](https://cve.now/CVE-2019-4186.md): IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header during cachi (CVSS 5.3, IBM Jazz for Service Management)
- [CVE-2019-4149](https://cve.now/CVE-2019-4149.md): IBM Business Automation Workflow V18.0.0.0 through V18.0.0.2 and IBM Business Process Manager V8.6.0.0 through V8.6.0.0 Cumulative Fix 2018. (CVSS 5.4, IBM Business Automation Workflow · IBM Business Process Man…)
- [CVE-2019-15937](https://cve.now/CVE-2019-15937.md): Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs\_readlink\_reply in net/nfs.c because a length field is directly use (no CVSS)
- [CVE-2019-15938](https://cve.now/CVE-2019-15938.md): Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs\_readlink\_req in fs/nfs.c because a length field is directly used f (no CVSS)
- [CVE-2019-10677](https://cve.now/CVE-2019-10677.md): Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devices allow a remote at (no CVSS)
- [CVE-2018-21010](https://cve.now/CVE-2018-21010.md): OpenJPEG before 2.3.1 has a heap buffer overflow in color\_apply\_icc\_profile in bin/common/color.c. (no CVSS)
- [CVE-2018-21009](https://cve.now/CVE-2018-21009.md): Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc. (no CVSS)
- [CVE-2019-1939](https://cve.now/CVE-2019-1939.md): Cisco Webex Teams Logging Feature Command Execution Vulnerability (CVSS 7.5, Cisco Webex Teams)
- [CVE-2019-1976](https://cve.now/CVE-2019-1976.md): Cisco Industrial Network Director Configuration Data Information Disclosure Vulnerability (CVSS 7.5, Cisco Industrial Network Director)
- [CVE-2019-12635](https://cve.now/CVE-2019-12635.md): Cisco Content Security Management Appliance Information Disclosure Vulnerability (CVSS 4.3, Cisco Content Security Management Appliance)
- [CVE-2019-12644](https://cve.now/CVE-2019-12644.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2019-12645](https://cve.now/CVE-2019-12645.md): Cisco Jabber Client Framework for Mac Code Execution Vulnerability (CVSS 6.7, Cisco Jabber for Mac)
- [CVE-2019-12632](https://cve.now/CVE-2019-12632.md): Cisco Finesse Request Processing Server-Side Request Forgery Vulnerability (CVSS 5.3, Cisco Finesse)
- [CVE-2019-12633](https://cve.now/CVE-2019-12633.md): Cisco Unified Contact Center Express Request Processing Server-Side Request Forgery Vulnerability (CVSS 5.3, Cisco Unified Contact Center Express)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-09-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.