# CVEs published 2019-09-09

97 CVEs were published on September 9, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-10253](https://cve.now/CVE-2019-10253.md): A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (upl (no CVSS)
- [CVE-2019-15297](https://cve.now/CVE-2019-15297.md): res\_pjsip\_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stre (no CVSS)
- [CVE-2019-16145](https://cve.now/CVE-2019-16145.md): The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption. (no CVSS, padrino-contrib)
- [CVE-2019-16147](https://cve.now/CVE-2019-16147.md): Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal\_article/page.jsp in journal/journal-taglib. (no CVSS, com.liferay:com.liferay.journal.taglib)
- [CVE-2019-16174](https://cve.now/CVE-2019-16174.md): An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and (no CVSS)
- [CVE-2019-16175](https://cve.now/CVE-2019-16175.md): A clickjacking vulnerability was found in Limesurvey before 3.17.14. (no CVSS)
- [CVE-2019-16176](https://cve.now/CVE-2019-16176.md): A path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote attacker to discover the path to the application (no CVSS)
- [CVE-2019-16177](https://cve.now/CVE-2019-16177.md): In Limesurvey before 3.17.14, the entire database is exposed through browser caching. (no CVSS)
- [CVE-2019-16192](https://cve.now/CVE-2019-16192.md): upload\_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code throug (no CVSS)
- [CVE-2019-16178](https://cve.now/CVE-2019-16178.md): A stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permis (no CVSS)
- [CVE-2019-16179](https://cve.now/CVE-2019-16179.md): Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration. (no CVSS)
- [CVE-2019-16180](https://cve.now/CVE-2019-16180.md): Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method i (no CVSS)
- [CVE-2019-16181](https://cve.now/CVE-2019-16181.md): In Limesurvey before 3.17.14, admin users can mark other users' notifications as read. (no CVSS)
- [CVE-2019-16182](https://cve.now/CVE-2019-16182.md): A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2019-16183](https://cve.now/CVE-2019-16183.md): In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions. (no CVSS)
- [CVE-2019-16184](https://cve.now/CVE-2019-16184.md): A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey res (no CVSS)
- [CVE-2019-16185](https://cve.now/CVE-2019-16185.md): In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions. (no CVSS)
- [CVE-2019-6791](https://cve.now/CVE-2019-6791.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. (no CVSS)
- [CVE-2019-16186](https://cve.now/CVE-2019-16186.md): In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions. (no CVSS)
- [CVE-2019-16187](https://cve.now/CVE-2019-16187.md): Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-s (no CVSS)
- [CVE-2019-7176](https://cve.now/CVE-2019-7176.md): An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 1 (no CVSS)
- [CVE-2019-6997](https://cve.now/CVE-2019-6997.md): An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting in 10.7) and 11.x before 11.5.8, 11.6.x before 11.6.6, and (no CVSS)
- [CVE-2019-6996](https://cve.now/CVE-2019-6996.md): An issue was discovered in GitLab Enterprise Edition 10.x (starting in 10.6) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before (no CVSS)
- [CVE-2019-16190](https://cve.now/CVE-2019-16190.md): SharePort Web Access on D-Link DIR-868L REVB through 2.03, DIR-885L REVA through 1.20, and DIR-895L REVA through 1.21 devices allows Authent (no CVSS)
- [CVE-2019-6995](https://cve.now/CVE-2019-6995.md): An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x (no CVSS)
- [CVE-2019-6960](https://cve.now/CVE-2019-6960.md): An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x befor (no CVSS)
- [CVE-2019-6795](https://cve.now/CVE-2019-6795.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. (no CVSS)
- [CVE-2019-6794](https://cve.now/CVE-2019-6794.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. (no CVSS)
- [CVE-2019-6793](https://cve.now/CVE-2019-6793.md): An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. (no CVSS)
- [CVE-2019-6792](https://cve.now/CVE-2019-6792.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. (no CVSS)
- [CVE-2019-6789](https://cve.now/CVE-2019-6789.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. (no CVSS)
- [CVE-2019-6788](https://cve.now/CVE-2019-6788.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. (no CVSS)
- [CVE-2019-6786](https://cve.now/CVE-2019-6786.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. (no CVSS)
- [CVE-2019-6785](https://cve.now/CVE-2019-6785.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. (no CVSS)
- [CVE-2019-6784](https://cve.now/CVE-2019-6784.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. (no CVSS)
- [CVE-2019-6783](https://cve.now/CVE-2019-6783.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. (no CVSS)
- [CVE-2019-6782](https://cve.now/CVE-2019-6782.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. (no CVSS)
- [CVE-2019-11549](https://cve.now/CVE-2019-11549.md): An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x bef (no CVSS)
- [CVE-2019-11548](https://cve.now/CVE-2019-11548.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. (no CVSS)
- [CVE-2019-11547](https://cve.now/CVE-2019-11547.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. (no CVSS)
- [CVE-2019-11546](https://cve.now/CVE-2019-11546.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. (no CVSS)
- [CVE-2019-11545](https://cve.now/CVE-2019-11545.md): An issue was discovered in GitLab Community Edition 11.9.x before 11.9.10 and 11.10.x before 11.10.2. (no CVSS)
- [CVE-2019-11544](https://cve.now/CVE-2019-11544.md): An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10. (no CVSS)
- [CVE-2019-16172](https://cve.now/CVE-2019-16172.md): LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. (no CVSS, limesurvey/limesurvey)
- [CVE-2019-16173](https://cve.now/CVE-2019-16173.md): LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. (no CVSS, limesurvey/limesurvey)
- [CVE-2019-11605](https://cve.now/CVE-2019-11605.md): An issue was discovered in GitLab Community and Enterprise Edition 11.8.x before 11.8.10, 11.9.x before 11.9.11, and 11.10.x before 11.10.3. (no CVSS)
- [CVE-2019-5473](https://cve.now/CVE-2019-5473.md): An authentication issue was discovered in GitLab that allowed a bypass of email verification. (no CVSS, gitlab.com)
- [CVE-2019-5471](https://cve.now/CVE-2019-5471.md): An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSS (no CVSS, GitLab)
- [CVE-2019-5467](https://cve.now/CVE-2019-5467.md): An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. (no CVSS, GitLab CE/EE)
- [CVE-2019-5463](https://cve.now/CVE-2019-5463.md): An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. (no CVSS, GitLab CE/EE)
- [CVE-2019-5461](https://cve.now/CVE-2019-5461.md): An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary (no CVSS, GitLab Community Edition)
- [CVE-2019-5483](https://cve.now/CVE-2019-5483.md): Seneca \< 3.9.0 contains a vulnerability that could lead to exposing environment variables to unauthorized users. (no CVSS, seneca)
- [CVE-2019-12405](https://cve.now/CVE-2019-12405.md): Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API c (no CVSS, Apache Traffic Control · github.com/apache/trafficcontrol)
- [CVE-2019-16168](https://cve.now/CVE-2019-16168.md): In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sq (CVSS 6.5)
- [CVE-2019-16161](https://cve.now/CVE-2019-16161.md): Onigmo through 6.2.0 has a NULL pointer dereference in onig\_error\_code\_to\_str because of fetch\_token in regparse.c. (no CVSS)
- [CVE-2019-16162](https://cve.now/CVE-2019-16162.md): Onigmo through 6.2.0 has an out-of-bounds read in parse\_char\_class because of missing codepoint validation in regenc.c. (no CVSS)
- [CVE-2019-16163](https://cve.now/CVE-2019-16163.md): Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. (no CVSS)
- [CVE-2019-16164](https://cve.now/CVE-2019-16164.md): MyHTML through 4.0.5 has a NULL pointer dereference in myhtml\_tree\_node\_remove in tree.c. (no CVSS)
- [CVE-2019-16165](https://cve.now/CVE-2019-16165.md): GNU cflow through 1.6 has a use-after-free in the reference function in parser.c. (no CVSS)
- [CVE-2019-16166](https://cve.now/CVE-2019-16166.md): GNU cflow through 1.6 has a heap-based buffer over-read in the nexttoken function in parser.c. (no CVSS)
- [CVE-2019-16159](https://cve.now/CVE-2019-16159.md): BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. (no CVSS)
- [CVE-2019-10670](https://cve.now/CVE-2019-10670.md): An issue was discovered in LibreNMS through 1.47. (no CVSS)
- [CVE-2019-12465](https://cve.now/CVE-2019-12465.md): An issue was discovered in LibreNMS 1.50.1. (no CVSS, librenms/librenms)
- [CVE-2019-12464](https://cve.now/CVE-2019-12464.md): An issue was discovered in LibreNMS 1.50.1. (no CVSS, librenms/librenms)
- [CVE-2019-12463](https://cve.now/CVE-2019-12463.md): An issue was discovered in LibreNMS 1.50.1. (no CVSS, librenms/librenms)
- [CVE-2019-10671](https://cve.now/CVE-2019-10671.md): An issue was discovered in LibreNMS through 1.47. (no CVSS, librenms/librenms)
- [CVE-2019-10668](https://cve.now/CVE-2019-10668.md): An issue was discovered in LibreNMS through 1.47. (no CVSS, librenms/librenms)
- [CVE-2019-10667](https://cve.now/CVE-2019-10667.md): An issue was discovered in LibreNMS through 1.47. (no CVSS, librenms/librenms)
- [CVE-2019-10666](https://cve.now/CVE-2019-10666.md): An issue was discovered in LibreNMS through 1.47. (no CVSS)
- [CVE-2019-10665](https://cve.now/CVE-2019-10665.md): An issue was discovered in LibreNMS through 1.47. (no CVSS, librenms/librenms)
- [CVE-2019-15895](https://cve.now/CVE-2019-15895.md): search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes. (no CVSS)
- [CVE-2019-15639](https://cve.now/CVE-2019-15639.md): main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a cra (no CVSS)
- [CVE-2019-10669](https://cve.now/CVE-2019-10669.md): An issue was discovered in LibreNMS through 1.47. (no CVSS)
- [CVE-2019-16148](https://cve.now/CVE-2019-16148.md): Sakai through 12.6 allows XSS via a chat user name. (no CVSS, org.sakaiproject:chat-base)
- [CVE-2019-16114](https://cve.now/CVE-2019-16114.md): In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him (no CVSS)
- [CVE-2019-16146](https://cve.now/CVE-2019-16146.md): Gophish through 0.8.0 allows XSS via a username. (no CVSS, github.com/gophish/gophish)
- [CVE-2018-21014](https://cve.now/CVE-2018-21014.md): The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS. (no CVSS)
- [CVE-2018-21013](https://cve.now/CVE-2018-21013.md): The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors (no CVSS)
- [CVE-2018-21012](https://cve.now/CVE-2018-21012.md): The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS. (no CVSS)
- [CVE-2018-21011](https://cve.now/CVE-2018-21011.md): The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details. (no CVSS)
- [CVE-2019-16144](https://cve.now/CVE-2019-16144.md): An issue was discovered in the generator crate before 0.6.18 for Rust. (no CVSS, generator)
- [CVE-2019-16143](https://cve.now/CVE-2019-16143.md): An issue was discovered in the blake2 crate before 0.8.1 for Rust. (no CVSS, blake2)
- [CVE-2019-16142](https://cve.now/CVE-2019-16142.md): An issue was discovered in the renderdoc crate before 0.5.0 for Rust. (no CVSS, renderdoc)
- [CVE-2019-16141](https://cve.now/CVE-2019-16141.md): An issue was discovered in the once\_cell crate before 1.0.1 for Rust. (no CVSS, once\_cell)
- [CVE-2019-16139](https://cve.now/CVE-2019-16139.md): An issue was discovered in the compact\_arena crate before 0.4.0 for Rust. (no CVSS, compact\_arena)
- [CVE-2019-16138](https://cve.now/CVE-2019-16138.md): An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. (no CVSS, image)
- [CVE-2019-16137](https://cve.now/CVE-2019-16137.md): An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used. (no CVSS, spin)
- [CVE-2019-16130](https://cve.now/CVE-2019-16130.md): YII2-CMS v1.0 has XSS in protected\\core\\modules\\home\\models\\Contact.php via a name field to /contact.html. (no CVSS, yii2mod/yii2-cms)
- [CVE-2019-16131](https://cve.now/CVE-2019-16131.md): framework/admin/modulec\_control.php in OKLite v1.2.25 has an Arbitrary File Upload Vulnerability because a .php file from a ZIP archive can (no CVSS)
- [CVE-2019-16132](https://cve.now/CVE-2019-16132.md): An issue was discovered in OKLite v1.2.25. (no CVSS)
- [CVE-2019-16133](https://cve.now/CVE-2019-16133.md): An issue was discovered in eteams OA v4.0.34. (no CVSS)
- [CVE-2019-16124](https://cve.now/CVE-2019-16124.md): In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configurati (no CVSS)
- [CVE-2019-16125](https://cve.now/CVE-2019-16125.md): In Jobberbase 2.0, the parameter category is not sanitized in public/page\_subscribe.php, leading to /subscribe SQL injection. (no CVSS)
- [CVE-2019-16126](https://cve.now/CVE-2019-16126.md): Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images. (no CVSS, getgrav/grav)
- [CVE-2019-16123](https://cve.now/CVE-2019-16123.md): In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File Disclosure. (no CVSS)
- [CVE-2019-16140](https://cve.now/CVE-2019-16140.md): An issue was discovered in the chttp crate before 0.1.3 for Rust. (no CVSS, chttp)
- [CVE-2019-16167](https://cve.now/CVE-2019-16167.md): sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap\_struct() in sa\_common.c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-09-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.