CVEs published September 11, 2019
137 CVEs were published on September 11, 2019: 0 critical, 8 high. 4 are now in CISA KEV.
- Published
- 137
- Critical
- 0
- High
- 8
- Medium
- 5
- Low
- 0
- Unrated
- 124
- Now in CISA KEV
- 4
- Fix available
- 27
Most affected products
- Microsoft Windows
- 45
- Atlassian Jira
- 7
- lmdb
- 5
- Microsoft SharePoint Foundation · Microsoft SharePoint E… +1
- 5
- Apache OFBiz
- 4
- Dell RSA Identity Governance and Lifecycle · Dell RSA Via L…
- 4
- Delta Electronics TPEditor
- 3
- Microsoft Edge (EdgeHTML-based) on Windows Server · Micr… +2
- 3
- Microsoft Internet Explorer
- 3
- McAfee Web Gateway
- 2
High 8
- CVE-2019-1297A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel · Microsoft Office
- CVE-2019-1253An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerabMicrosoft Windows
- CVE-2019-1214An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aMicrosoft Windows
- CVE-2019-1215An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of PrMicrosoft Windows
- CVE-2019-5055An exploitable denial-of-service vulnerability exists in the Host Access Point Daemon (hostapd) on the NETGEAR N300 (WNR2000v5 with FirmwareNetgear N300 WNR2000v5
- CVE-2019-5054An exploitable denial-of-service vulnerability exists in the session handling functionality of the NETGEAR N300 (WNR2000v5 with Firmware VerNetgear N300 WNR2000v5
- CVE-2019-3763The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain an information eDell RSA Identity Governance and Lifecycle · Dell RSA Via L…
- CVE-2019-3644MWG scanners updated to address CVE-2019-9517McAfee Web Gateway
Medium, low and unrated 129
- CVE-2019-16250includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a C
- CVE-2019-16248The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory.
- CVE-2019-16249OpenCV 4.1.1 has an out-of-bounds read in hal_baseline::v_load in core/hal/intrin_sse.hpp when called from computeSSDMeanNorm in modules/vidopencv-contrib-python · opencv-python +2
- CVE-2019-1287An elevation of privilege vulnerability exists in the way that the Windows Network Connectivity Assistant handles objects in memory, aka 'WiMicrosoft Windows Server · Microsoft Windows
- CVE-2019-1289An elevation of privilege vulnerability exists when the Windows Update Delivery Optimization does not properly enforce file share permissionMicrosoft Windows
- CVE-2019-1290A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote DeMicrosoft Windows
- CVE-2019-1291A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote DeMicrosoft Windows
- CVE-2019-1292A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.Microsoft Windows
- CVE-2019-1293An information disclosure vulnerability exists in Windows when the Windows SMB Client kernel-mode driver fails to properly handle objects inMicrosoft Windows
- CVE-2019-1294A security feature bypass exists when Windows Secure Boot improperly restricts access to debugging functionality, aka 'Windows Secure Boot SMicrosoft Windows
- CVE-2019-1295A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input, aka 'MicroMicrosoft SharePoint Foundation · Microsoft SharePoint E… +1
- CVE-2019-1296A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input, aka 'MicroMicrosoft SharePoint Foundation · Microsoft SharePoint E… +1
- CVE-2019-1298A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge (EdgeHTML-based) on Windows Server · Micr… +2
- CVE-2019-1299An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory, aka 'Microsoft EMicrosoft Edge (EdgeHTML-based) on Windows
- CVE-2019-1300A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge (EdgeHTML-based) on Windows 10 for 32-bit… +4
- CVE-2019-1301A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'.Microsoft .NET Core · System.Management.Automation
- CVE-2019-1302An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to proMicrosoft ASP.NET Core · Microsoft.AspNetCore.SpaServices
- CVE-2019-1303An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerabMicrosoft Windows
- CVE-2019-1305A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team FounMicrosoft Team Foundation Server · Microsoft Azure DevOps S…
- CVE-2019-1306A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properlyMicrosoft Team Foundation Server · Microsoft Azure DevOps S…
- CVE-2019-1268An elevation of privilege exists when Winlogon does not properly handle file path information, aka 'Winlogon Elevation of Privilege VulnerabMicrosoft Windows
- CVE-2019-1269An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).An attacker whoMicrosoft Windows
- CVE-2019-1270An elevation of privilege vulnerability exists in Windows store installer where WindowsApps directory is vulnerable to symbolic link attack,Microsoft Windows
- CVE-2019-1271An elevation of privilege exists in hdAudio.sys which may lead to an out of band write, aka 'Windows Media Elevation of Privilege VulnerabilMicrosoft Windows
- CVE-2019-1272An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).An attacker whoMicrosoft Windows
- CVE-2019-1273A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize certain error Microsoft Windows
- CVE-2019-1274An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel InMicrosoft Windows
- CVE-2019-1277An elevation of privilege vulnerability exists in Windows Audio Service when a malformed parameter is processed, aka 'Windows Audio Service Microsoft Windows
- CVE-2019-1278An elevation of privilege vulnerability exists in the way that the unistore.dll handles objects in memory, aka 'Windows Elevation of PrivileMicrosoft Windows
- CVE-2019-1280A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attaMicrosoft Windows
- CVE-2019-1282An information disclosure exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle sandbox checks, aka 'WMicrosoft Windows
- CVE-2019-1283An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft GraphiMicrosoft Windows
- CVE-2019-1284An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege VulnerMicrosoft Windows
- CVE-2019-1285An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-1286An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-1246A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows · Microsoft Office
- CVE-2019-1247A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-1248A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-1249A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-1250A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-1251An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite InformatioMicrosoft Windows
- CVE-2019-1252An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-1254An information disclosure vulnerability exists when Windows Hyper-V writes uninitialized memory to disk, aka 'Windows Hyper-V Information DiMicrosoft Windows Server · Microsoft Windows
- CVE-2019-1256An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-1257A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application paMicrosoft SharePoint Foundation · Microsoft SharePoint E… +1
- CVE-2019-1259A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-siMicrosoft SharePoint Foundation
- CVE-2019-1260An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'.Microsoft SharePoint Foundation · Microsoft SharePoint E… +1
- CVE-2019-1261A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-siMicrosoft SharePoint Foundation · Microsoft SharePoint E… +1
- CVE-2019-1262A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesMicrosoft SharePoint Foundation
- CVE-2019-1263An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel InMicrosoft Excel · Microsoft Office
- CVE-2019-1264A security feature bypass vulnerability exists when Microsoft Office improperly handles input, aka 'Microsoft Office Security Feature BypassMicrosoft Project · Microsoft Office
- CVE-2019-1265A security feature bypass vulnerability exists when Microsoft Yammer App for Android fails to apply the correct Intune MAM Policy.This couldMicrosoft Yammer for Android
- CVE-2019-1266A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App (OWA) fails to properly handle web requests, aka 'MicrosofMicrosoft Exchange Server
- CVE-2019-1267An elevation of privilege vulnerability exists in Microsoft Compatibility Appraiser where a configuration file, with local privileges, is vuMicrosoft Windows
- CVE-2019-1216An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure VulnerMicrosoft Windows
- CVE-2019-1217A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge (EdgeHTML-based) on Windows · Microsoft C… +1
- CVE-2019-1219An information disclosure vulnerability exists when the Windows Transaction Manager improperly handles objects in memory, aka 'Windows TransMicrosoft Windows
- CVE-2019-1220A security feature bypass vulnerability exists when Microsoft Browsers fail to validate the correct Security Zone of requests for specific UMicrosoft Internet Explorer · Microsoft Edge (EdgeHTML-b… +3
- CVE-2019-1221A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2019-1231An information disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS certificate validation, aka 'Rome SDK Information Microsoft Rome SDK
- CVE-2019-1232An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file operMicrosoft Visual Studio · Microsoft Windows
- CVE-2019-1233A denial of service vulnerability exists in Microsoft Exchange Server software when the software fails to properly handle objects in memory,Microsoft Exchange Server
- CVE-2019-1235An elevation of privilege vulnerability exists in Windows Text Service Framework (TSF) when the TSF server process does not validate the souMicrosoft Windows
- CVE-2019-1236A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code ExecutMicrosoft Internet Explorer
- CVE-2019-1237A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge (EdgeHTML-based) on Windows Server · Micr… +2
- CVE-2019-1240A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-1241A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-1242A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-1243A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-1244An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite InformatioMicrosoft Windows
- CVE-2019-1245An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite InformatioMicrosoft Windows
- CVE-2019-0787A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote DeMicrosoft Windows
- CVE-2019-0788A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote DeMicrosoft Windows
- CVE-2019-0928A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on Microsoft Windows
- CVE-2019-1138A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CMicrosoft Edge (EdgeHTML-based) on Windows Server · Micr… +2
- CVE-2019-1142An elevation of privilege vulnerability exists when the .NET Framework common language runtime (CLR) allows file creation in arbitrary locatMicrosoft .NET Framework
- CVE-2019-1208A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code ExecutMicrosoft Internet Explorer
- CVE-2019-1209An information disclosure vulnerability exists in Lync 2013, aka 'Lync 2013 Information Disclosure Vulnerability'.Microsoft Lync Server
- CVE-2019-16247Delta DCISoft 1.21 has a User Mode Write AV starting at CommLib!CCommLib::SetSerializeData+0x000000000000001b.
- CVE-2019-13540Delta Electronics TPEditor, Versions 1.94 and prior.Delta Electronics TPEditor
- CVE-2019-13536Delta Electronics TPEditor, Versions 1.94 and prior.Delta Electronics TPEditor
- CVE-2019-13544Delta Electronics TPEditor, Versions 1.94 and prior.Delta Electronics TPEditor
- CVE-2019-10074An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a fieApache OFBiz
- CVE-2019-15302The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text pad with editing rights
- CVE-2019-10073The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks.Apache OFBiz
- CVE-2019-0189The java.io.ObjectInputStream is known to cause Java serialisation issues.Apache OFBiz
- CVE-2018-17200The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/Apache OFBiz
- CVE-2019-11769An issue was discovered in TeamViewer 14.2.2558.
- CVE-2019-3761The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a stored cross-sDell RSA Identity Governance and Lifecycle · Dell RSA Via L…
- CVE-2019-3760The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a SQL Injection Dell RSA Identity Governance and Lifecycle · Dell RSA Via L…
- CVE-2019-3759The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injectionDell RSA Identity Governance and Lifecycle · Dell RSA Via L…
- CVE-2019-16235Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280_message_carbons.vala.
- CVE-2019-16236Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala.
- CVE-2019-16237Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313_message_archive_management.vala.
- CVE-2019-14936Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash).
- CVE-2019-9488Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack.Trend Micro Deep Security · Trend Micro Vulnerability Prote…
- CVE-2019-11777In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the resThe Eclipse Foundation Eclipse Paho · org.eclipse.paho:org.…
- CVE-2019-16098The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to
- CVE-2019-16229drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL poi
- CVE-2019-16230drivers/gpu/drm/radeon/radeon_display.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointe
- CVE-2019-16231drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereferen
- CVE-2019-16232drivers/net/wireless/marvell/libertas/if_sdio.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NUL
- CVE-2019-16233drivers/scsi/qla2xxx/qla_os.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer derefere
- CVE-2019-16234drivers/net/wireless/intel/iwlwifi/pcie/trans.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NUL
- CVE-2019-16224An issue was discovered in py-lmdb 0.97.lmdb
- CVE-2019-16225An issue was discovered in py-lmdb 0.97.lmdb
- CVE-2019-16226An issue was discovered in py-lmdb 0.97.lmdb
- CVE-2019-16227An issue was discovered in py-lmdb 0.97.lmdb
- CVE-2019-16228An issue was discovered in py-lmdb 0.97.lmdb
- CVE-2019-3643MWG scanners updated to address CVE-2019-9511McAfee Web Gateway
- CVE-2019-8451The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal netAtlassian Jira
- CVE-2019-8450Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackeAtlassian Jira
- CVE-2019-8449The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an informationAtlassian Jira
- CVE-2019-14998The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remote attackers to bypasAtlassian Jira
- CVE-2019-14997The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other users, including theirAtlassian Jira
- CVE-2019-14996The FilterPickerPopup.jspa resource in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.3 allows remote attackers to inAtlassian Jira
- CVE-2019-14995The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specifAtlassian Jira
- CVE-2019-16217WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.
- CVE-2019-16219WordPress before 5.2.3 allows XSS in shortcode previews.
- CVE-2019-16221WordPress before 5.2.3 allows reflected XSS in the dashboard.
- CVE-2019-16222WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site s
- CVE-2019-16223WordPress before 5.2.3 allows XSS in post previews by authenticated users.
- CVE-2019-16220In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open r
- CVE-2019-16218WordPress before 5.2.3 allows XSS in stored comments.
- CVE-2019-16193In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting (XFS) attack through the EDIT MY PROFIL
- CVE-2019-14724In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an e-mail forwarding de
- CVE-2019-14725In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail usage valu
- CVE-2019-16214Libra Core before 2019-09-03 has an erroneous regular expression for inline comments, which makes it easier for attackers to interfere with
- CVE-2019-13473TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd, Imperial i400, Imper