# CVEs published 2019-09-08

22 CVEs were published on September 8, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-16117](https://cve.now/CVE-2019-16117.md): Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.p (no CVSS)
- [CVE-2019-16118](https://cve.now/CVE-2019-16118.md): Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Option (no CVSS)
- [CVE-2019-16119](https://cve.now/CVE-2019-16119.md): SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries (no CVSS)
- [CVE-2019-16120](https://cve.now/CVE-2019-16120.md): CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post\> Ticketed \> Attendees" Expo (no CVSS)
- [CVE-2019-16115](https://cve.now/CVE-2019-16115.md): In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc, used by GfxAxialShading:: (no CVSS)
- [CVE-2019-16113](https://cve.now/CVE-2019-16113.md): Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and th (no CVSS)
- [CVE-2019-16109](https://cve.now/CVE-2019-16109.md): An issue was discovered in Plataformatec Devise before 4.7.1. (no CVSS, devise)
- [CVE-2019-16099](https://cve.now/CVE-2019-16099.md): Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows CSRF via JSON data to a .swf file. (no CVSS)
- [CVE-2019-16100](https://cve.now/CVE-2019-16100.md): Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to trigger a web-interface outage via slow client-side HTTP traffic fr (no CVSS)
- [CVE-2019-16101](https://cve.now/CVE-2019-16101.md): Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to obtain potentially sensitive stack traces by sending incorrect JSON (no CVSS)
- [CVE-2019-16102](https://cve.now/CVE-2019-16102.md): Silver Peak EdgeConnect SD-WAN before 8.1.7.x has an SNMP service with a public value for rocommunity and trapcommunity. (no CVSS)
- [CVE-2019-16103](https://cve.now/CVE-2019-16103.md): Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows privilege escalation (by administrators) from the menu to a root Bash OS shell via the (no CVSS)
- [CVE-2019-16104](https://cve.now/CVE-2019-16104.md): Silver Peak EdgeConnect SD-WAN before 8.1.7.x has reflected XSS via the rest/json/configdb/download/ PATH\_INFO. (no CVSS)
- [CVE-2019-16105](https://cve.now/CVE-2019-16105.md): Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows ..%2f directory traversal via a rest/json/configdb/download/ URI. (no CVSS)
- [CVE-2019-16097](https://cve.now/CVE-2019-16097.md): core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is s (no CVSS, github.com/goharbor/harbor)
- [CVE-2016-10937](https://cve.now/CVE-2016-10937.md): IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate. (no CVSS)
- [CVE-2019-16096](https://cve.now/CVE-2019-16096.md): Kilo 0.0.1 has a heap-based buffer overflow because there is an integer overflow in a calculation involving the number of tabs in one row. (no CVSS)
- [CVE-2019-16091](https://cve.now/CVE-2019-16091.md): Symonics libmysofa 0.7 has an out-of-bounds read in directblockRead in hdf/fractalhead.c. (no CVSS)
- [CVE-2019-16092](https://cve.now/CVE-2019-16092.md): Symonics libmysofa 0.7 has a NULL pointer dereference in getHrtf in hrtf/reader.c. (no CVSS)
- [CVE-2019-16093](https://cve.now/CVE-2019-16093.md): Symonics libmysofa 0.7 has an invalid write in readOHDRHeaderMessageDataLayout in hdf/dataobject.c. (no CVSS)
- [CVE-2019-16094](https://cve.now/CVE-2019-16094.md): Symonics libmysofa 0.7 has an invalid read in readOHDRHeaderMessageDataLayout in hdf/dataobject.c. (no CVSS)
- [CVE-2019-16095](https://cve.now/CVE-2019-16095.md): Symonics libmysofa 0.7 has an invalid read in getDimension in hrtf/reader.c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-09-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.