CVEs published September 9, 2019
97 CVEs were published on September 9, 2019: 0 critical, 0 high.
- Published
- 97
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 96
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- librenms/librenms
- 7
- GitLab CE/EE
- 2
- limesurvey/limesurvey
- 2
- Apache Traffic Control · github.com/apache/trafficcontrol
- 1
- blake2
- 1
- chttp
- 1
- com.liferay:com.liferay.journal.taglib
- 1
- compact_arena
- 1
- generator
- 1
- getgrav/grav
- 1
Medium, low and unrated 97
- CVE-2019-10253A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (upl
- CVE-2019-15297res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stre
- CVE-2019-16145The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.padrino-contrib
- CVE-2019-16147Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib.com.liferay:com.liferay.journal.taglib
- CVE-2019-16174An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and
- CVE-2019-16175A clickjacking vulnerability was found in Limesurvey before 3.17.14.
- CVE-2019-16176A path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote attacker to discover the path to the application
- CVE-2019-16177In Limesurvey before 3.17.14, the entire database is exposed through browser caching.
- CVE-2019-16192upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code throug
- CVE-2019-16178A stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permis
- CVE-2019-16179Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration.
- CVE-2019-16180Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method i
- CVE-2019-16181In Limesurvey before 3.17.14, admin users can mark other users' notifications as read.
- CVE-2019-16182A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary
- CVE-2019-16183In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions.
- CVE-2019-16184A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey res
- CVE-2019-16185In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions.
- CVE-2019-6791An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1.
- CVE-2019-16186In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions.
- CVE-2019-16187Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-s
- CVE-2019-7176An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 1
- CVE-2019-6997An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting in 10.7) and 11.x before 11.5.8, 11.6.x before 11.6.6, and
- CVE-2019-6996An issue was discovered in GitLab Enterprise Edition 10.x (starting in 10.6) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before
- CVE-2019-16190SharePort Web Access on D-Link DIR-868L REVB through 2.03, DIR-885L REVA through 1.20, and DIR-895L REVA through 1.21 devices allows Authent
- CVE-2019-6995An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x
- CVE-2019-6960An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x befor
- CVE-2019-6795An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1.
- CVE-2019-6794An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1.
- CVE-2019-6793An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1.
- CVE-2019-6792An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1.
- CVE-2019-6789An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1.
- CVE-2019-6788An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1.
- CVE-2019-6786An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1.
- CVE-2019-6785An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1.
- CVE-2019-6784An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1.
- CVE-2019-6783An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1.
- CVE-2019-6782An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1.
- CVE-2019-11549An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x bef
- CVE-2019-11548An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9.
- CVE-2019-11547An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2.
- CVE-2019-11546An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2.
- CVE-2019-11545An issue was discovered in GitLab Community Edition 11.9.x before 11.9.10 and 11.10.x before 11.10.2.
- CVE-2019-11544An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.
- CVE-2019-16172LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin.limesurvey/limesurvey
- CVE-2019-16173LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin.limesurvey/limesurvey
- CVE-2019-11605An issue was discovered in GitLab Community and Enterprise Edition 11.8.x before 11.8.10, 11.9.x before 11.9.11, and 11.10.x before 11.10.3.
- CVE-2019-5473An authentication issue was discovered in GitLab that allowed a bypass of email verification.gitlab.com
- CVE-2019-5471An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSSGitLab
- CVE-2019-5467An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS.GitLab CE/EE
- CVE-2019-5463An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status.GitLab CE/EE
- CVE-2019-5461An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary GitLab Community Edition
- CVE-2019-5483Seneca < 3.9.0 contains a vulnerability that could lead to exposing environment variables to unauthorized users.seneca
- CVE-2019-12405Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API cApache Traffic Control · github.com/apache/trafficcontrol
- CVE-2019-16168In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sq
- CVE-2019-16161Onigmo through 6.2.0 has a NULL pointer dereference in onig_error_code_to_str because of fetch_token in regparse.c.
- CVE-2019-16162Onigmo through 6.2.0 has an out-of-bounds read in parse_char_class because of missing codepoint validation in regenc.c.
- CVE-2019-16163Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.
- CVE-2019-16164MyHTML through 4.0.5 has a NULL pointer dereference in myhtml_tree_node_remove in tree.c.
- CVE-2019-16165GNU cflow through 1.6 has a use-after-free in the reference function in parser.c.
- CVE-2019-16166GNU cflow through 1.6 has a heap-based buffer over-read in the nexttoken function in parser.c.
- CVE-2019-16159BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow.
- CVE-2019-10670An issue was discovered in LibreNMS through 1.47.
- CVE-2019-12465An issue was discovered in LibreNMS 1.50.1.librenms/librenms
- CVE-2019-12464An issue was discovered in LibreNMS 1.50.1.librenms/librenms
- CVE-2019-12463An issue was discovered in LibreNMS 1.50.1.librenms/librenms
- CVE-2019-10671An issue was discovered in LibreNMS through 1.47.librenms/librenms
- CVE-2019-10668An issue was discovered in LibreNMS through 1.47.librenms/librenms
- CVE-2019-10667An issue was discovered in LibreNMS through 1.47.librenms/librenms
- CVE-2019-10666An issue was discovered in LibreNMS through 1.47.
- CVE-2019-10665An issue was discovered in LibreNMS through 1.47.librenms/librenms
- CVE-2019-15895search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes.
- CVE-2019-15639main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a cra
- CVE-2019-10669An issue was discovered in LibreNMS through 1.47.
- CVE-2019-16148Sakai through 12.6 allows XSS via a chat user name.org.sakaiproject:chat-base
- CVE-2019-16114In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him
- CVE-2019-16146Gophish through 0.8.0 allows XSS via a username.github.com/gophish/gophish
- CVE-2018-21014The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS.
- CVE-2018-21013The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors
- CVE-2018-21012The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS.
- CVE-2018-21011The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details.
- CVE-2019-16144An issue was discovered in the generator crate before 0.6.18 for Rust.generator
- CVE-2019-16143An issue was discovered in the blake2 crate before 0.8.1 for Rust.blake2
- CVE-2019-16142An issue was discovered in the renderdoc crate before 0.5.0 for Rust.renderdoc
- CVE-2019-16141An issue was discovered in the once_cell crate before 1.0.1 for Rust.once_cell
- CVE-2019-16139An issue was discovered in the compact_arena crate before 0.4.0 for Rust.compact_arena
- CVE-2019-16138An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder.image
- CVE-2019-16137An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used.spin
- CVE-2019-16130YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html.yii2mod/yii2-cms
- CVE-2019-16131framework/admin/modulec_control.php in OKLite v1.2.25 has an Arbitrary File Upload Vulnerability because a .php file from a ZIP archive can
- CVE-2019-16132An issue was discovered in OKLite v1.2.25.
- CVE-2019-16133An issue was discovered in eteams OA v4.0.34.
- CVE-2019-16124In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configurati
- CVE-2019-16125In Jobberbase 2.0, the parameter category is not sanitized in public/page_subscribe.php, leading to /subscribe SQL injection.
- CVE-2019-16126Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images.getgrav/grav
- CVE-2019-16123In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File Disclosure.
- CVE-2019-16140An issue was discovered in the chttp crate before 0.1.3 for Rust.chttp
- CVE-2019-16167sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c.