CVEs published September 10, 2019
57 CVEs were published on September 10, 2019: 0 critical, 0 high.
- Published
- 57
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 57
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- OpenSSL
- 3
- SAP SE SAP HANA Extended Application Services
- 2
- Advantech WebAccess/SCADA
- 1
- Apache Solr · org.apache.solr:solr-core
- 1
- Micro Focus Service Manager
- 1
- NetApp OnCommand Workflow Automation
- 1
- SAP SE SAP Business One Client
- 1
- SAP SE SAP BusinessObjects Business Intelligence Platform
- 1
- SAP SE SAP HANA
- 1
- SAP SE SAP Kernel · SAP SE SAP GUI for Windows +1
- 1
Medium, low and unrated 57
- CVE-2019-12943TTLock devices do not properly restrict password-reset attempts, leading to incorrect access control and disclosure of sensitive information
- CVE-2019-12942TTLock devices do not properly block guest access in certain situations where the network connection to the cloud is unavailable.
- CVE-2019-11669Modifiable read only check box In Micro Focus Service Manager, versions 9.60p1, 9.61, 9.62.Micro Focus Service Manager
- CVE-2019-11668HTTP cookie in Micro Focus Service manager, Versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62.Service Manager, Service Manager – Chat Service. Server M…
- CVE-2019-12996In Mendix 7.23.5 and earlier, issue in XML import mappings allow DOCTYPE declarations in the XML input that is potentially unsafe.
- CVE-2019-10256An authentication bypass vulnerability in VIVOTEK IPCam versions prior to 0x13a was found.
- CVE-2019-14457VIVOTEK IP Camera devices with firmware before 0x20x have a stack-based buffer overflow via a crafted HTTP header.
- CVE-2019-11496In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and write access without aut
- CVE-2019-11497In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and
- CVE-2019-11467In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson.
- CVE-2019-11495In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely.
- CVE-2019-11466In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that does not require crede
- CVE-2019-1563Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkeyOpenSSL
- CVE-2019-1549Fork ProtectionOpenSSL
- CVE-2019-1547ECDSA remote timing attackOpenSSL
- CVE-2019-11465An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0.
- CVE-2019-0357The administrator of SAP HANA database, before versions 1.0 and 2.0, can misuse HANA to execute commands with operating system "root" privilSAP SE SAP HANA
- CVE-2019-11464Some enterprises require that REST API endpoints include security-related headers in REST responses.
- CVE-2019-0356Under certain conditions SAP NetWeaver Process Integration Runtime Workbench – MESSAGING and SAP_XIAF (before versions 7.31, 7.40, 7.50) allSAP SE SAP NetWeaver Process Integration Runtime Workbench…
- CVE-2019-12105In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service.supervisor
- CVE-2019-0365SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versions 7.21, 7.21EXT, 7SAP SE SAP Kernel · SAP SE SAP GUI for Windows +1
- CVE-2019-0364Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to enumerate SAP SE SAP HANA Extended Application Services
- CVE-2019-0363Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.0.118, to overload tSAP SE SAP HANA Extended Application Services
- CVE-2019-0361SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently SAP SE SAP Supplier Relationship Management (Master Data Ma…
- CVE-2019-0355SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before vSAP SE SAP NetWeaver AS for Java (Web Container)-ENGINEAPI…
- CVE-2019-0353Under certain conditions SAP Business One client (B1_ON_HANA, SAP-M-BO), before versions 9.2 and 9.3, allows an attacker to access informatiSAP SE SAP Business One Client
- CVE-2019-0352In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp) are cached, which leSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2019-3975Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a craAdvantech WebAccess/SCADA
- CVE-2019-5503OnCommand Workflow Automation versions prior to 5.0 shipped without certain HTTP Security headers configured which could allow an attacker tNetApp OnCommand Workflow Automation
- CVE-2019-16106The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to change the password of any user
- CVE-2019-15896An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress.
- CVE-2019-14730In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a domain from a victi
- CVE-2019-14728In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to add an e-mail forwarding des
- CVE-2019-14729In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a sub-domain from a v
- CVE-2019-14727In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail password o
- CVE-2019-14726In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to access and delete DNS record
- CVE-2019-14723In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a victim's e-mail acc
- CVE-2019-14722In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete an e-mail forwarding
- CVE-2019-14721In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to remove a target user from ph
- CVE-2019-12401Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a.Apache Solr · org.apache.solr:solr-core
- CVE-2019-16202MISP before 2.4.115 allows privilege escalation in certain situations.
- CVE-2017-18611The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter.
- CVE-2017-18610The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter.
- CVE-2017-18609The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.
- CVE-2017-18608The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.
- CVE-2017-18607The avada theme before 5.1.5 for WordPress has CSRF.
- CVE-2017-18606The avada theme before 5.1.5 for WordPress has stored XSS.
- CVE-2017-18605The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.
- CVE-2017-18604The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.
- CVE-2017-18603The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter.
- CVE-2017-18602The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter.
- CVE-2017-18601The examapp plugin 1.0 for WordPress has XSS via exam input text fields.
- CVE-2017-18600The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.
- CVE-2017-18599The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter.
- CVE-2017-18598The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php.
- CVE-2017-18597The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-tables-admin.php tableId
- CVE-2017-18596The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.