# CVEs published 2019-09-11

137 CVEs were published on September 11, 2019: 0 critical, 8 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2019-16250](https://cve.now/CVE-2019-16250.md): includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a C (no CVSS)
- [CVE-2019-16248](https://cve.now/CVE-2019-16248.md): The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory. (no CVSS)
- [CVE-2019-16249](https://cve.now/CVE-2019-16249.md): OpenCV 4.1.1 has an out-of-bounds read in hal\_baseline::v\_load in core/hal/intrin\_sse.hpp when called from computeSSDMeanNorm in modules/vid (no CVSS, opencv-contrib-python · opencv-python +2)
- [CVE-2019-1287](https://cve.now/CVE-2019-1287.md): An elevation of privilege vulnerability exists in the way that the Windows Network Connectivity Assistant handles objects in memory, aka 'Wi (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-1289](https://cve.now/CVE-2019-1289.md): An elevation of privilege vulnerability exists when the Windows Update Delivery Optimization does not properly enforce file share permission (no CVSS, Microsoft Windows)
- [CVE-2019-1290](https://cve.now/CVE-2019-1290.md): A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote De (no CVSS, Microsoft Windows)
- [CVE-2019-1291](https://cve.now/CVE-2019-1291.md): A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote De (no CVSS, Microsoft Windows)
- [CVE-2019-1292](https://cve.now/CVE-2019-1292.md): A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. (no CVSS, Microsoft Windows)
- [CVE-2019-1293](https://cve.now/CVE-2019-1293.md): An information disclosure vulnerability exists in Windows when the Windows SMB Client kernel-mode driver fails to properly handle objects in (no CVSS, Microsoft Windows)
- [CVE-2019-1294](https://cve.now/CVE-2019-1294.md): A security feature bypass exists when Windows Secure Boot improperly restricts access to debugging functionality, aka 'Windows Secure Boot S (no CVSS, Microsoft Windows)
- [CVE-2019-1295](https://cve.now/CVE-2019-1295.md): A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input, aka 'Micro (no CVSS, Microsoft SharePoint Foundation · Microsoft SharePoint E… +1)
- [CVE-2019-1296](https://cve.now/CVE-2019-1296.md): A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input, aka 'Micro (no CVSS, Microsoft SharePoint Foundation · Microsoft SharePoint E… +1)
- [CVE-2019-1297](https://cve.now/CVE-2019-1297.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka ' (CVSS 8.8, KEV, Microsoft Excel · Microsoft Office)
- [CVE-2019-1298](https://cve.now/CVE-2019-1298.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge (EdgeHTML-based) on Windows Server · Micr… +2)
- [CVE-2019-1299](https://cve.now/CVE-2019-1299.md): An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory, aka 'Microsoft E (no CVSS, Microsoft Edge (EdgeHTML-based) on Windows)
- [CVE-2019-1300](https://cve.now/CVE-2019-1300.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit… +4)
- [CVE-2019-1301](https://cve.now/CVE-2019-1301.md): A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'. (no CVSS, Microsoft .NET Core · System.Management.Automation)
- [CVE-2019-1302](https://cve.now/CVE-2019-1302.md): An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to pro (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.SpaServices)
- [CVE-2019-1303](https://cve.now/CVE-2019-1303.md): An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerab (no CVSS, Microsoft Windows)
- [CVE-2019-1305](https://cve.now/CVE-2019-1305.md): A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foun (no CVSS, Microsoft Team Foundation Server · Microsoft Azure DevOps S…)
- [CVE-2019-1306](https://cve.now/CVE-2019-1306.md): A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properly (no CVSS, Microsoft Team Foundation Server · Microsoft Azure DevOps S…)
- [CVE-2019-1268](https://cve.now/CVE-2019-1268.md): An elevation of privilege exists when Winlogon does not properly handle file path information, aka 'Winlogon Elevation of Privilege Vulnerab (no CVSS, Microsoft Windows)
- [CVE-2019-1269](https://cve.now/CVE-2019-1269.md): An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).An attacker who (no CVSS, Microsoft Windows)
- [CVE-2019-1270](https://cve.now/CVE-2019-1270.md): An elevation of privilege vulnerability exists in Windows store installer where WindowsApps directory is vulnerable to symbolic link attack, (no CVSS, Microsoft Windows)
- [CVE-2019-1271](https://cve.now/CVE-2019-1271.md): An elevation of privilege exists in hdAudio.sys which may lead to an out of band write, aka 'Windows Media Elevation of Privilege Vulnerabil (no CVSS, Microsoft Windows)
- [CVE-2019-1272](https://cve.now/CVE-2019-1272.md): An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).An attacker who (no CVSS, Microsoft Windows)
- [CVE-2019-1273](https://cve.now/CVE-2019-1273.md): A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize certain error (no CVSS, Microsoft Windows)
- [CVE-2019-1274](https://cve.now/CVE-2019-1274.md): An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel In (no CVSS, Microsoft Windows)
- [CVE-2019-1277](https://cve.now/CVE-2019-1277.md): An elevation of privilege vulnerability exists in Windows Audio Service when a malformed parameter is processed, aka 'Windows Audio Service (no CVSS, Microsoft Windows)
- [CVE-2019-1278](https://cve.now/CVE-2019-1278.md): An elevation of privilege vulnerability exists in the way that the unistore.dll handles objects in memory, aka 'Windows Elevation of Privile (no CVSS, Microsoft Windows)
- [CVE-2019-1280](https://cve.now/CVE-2019-1280.md): A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An atta (no CVSS, Microsoft Windows)
- [CVE-2019-1282](https://cve.now/CVE-2019-1282.md): An information disclosure exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle sandbox checks, aka 'W (no CVSS, Microsoft Windows)
- [CVE-2019-1283](https://cve.now/CVE-2019-1283.md): An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphi (no CVSS, Microsoft Windows)
- [CVE-2019-1284](https://cve.now/CVE-2019-1284.md): An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulner (no CVSS, Microsoft Windows)
- [CVE-2019-1285](https://cve.now/CVE-2019-1285.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k (no CVSS, Microsoft Windows)
- [CVE-2019-1286](https://cve.now/CVE-2019-1286.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows (no CVSS, Microsoft Windows)
- [CVE-2019-1246](https://cve.now/CVE-2019-1246.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows · Microsoft Office)
- [CVE-2019-1247](https://cve.now/CVE-2019-1247.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-1248](https://cve.now/CVE-2019-1248.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-1249](https://cve.now/CVE-2019-1249.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-1250](https://cve.now/CVE-2019-1250.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-1251](https://cve.now/CVE-2019-1251.md): An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Informatio (no CVSS, Microsoft Windows)
- [CVE-2019-1252](https://cve.now/CVE-2019-1252.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows (no CVSS, Microsoft Windows)
- [CVE-2019-1253](https://cve.now/CVE-2019-1253.md): An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerab (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2019-1254](https://cve.now/CVE-2019-1254.md): An information disclosure vulnerability exists when Windows Hyper-V writes uninitialized memory to disk, aka 'Windows Hyper-V Information Di (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-1256](https://cve.now/CVE-2019-1256.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k (no CVSS, Microsoft Windows)
- [CVE-2019-1257](https://cve.now/CVE-2019-1257.md): A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa (no CVSS, Microsoft SharePoint Foundation · Microsoft SharePoint E… +1)
- [CVE-2019-1259](https://cve.now/CVE-2019-1259.md): A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-si (no CVSS, Microsoft SharePoint Foundation)
- [CVE-2019-1260](https://cve.now/CVE-2019-1260.md): An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'. (no CVSS, Microsoft SharePoint Foundation · Microsoft SharePoint E… +1)
- [CVE-2019-1261](https://cve.now/CVE-2019-1261.md): A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-si (no CVSS, Microsoft SharePoint Foundation · Microsoft SharePoint E… +1)
- [CVE-2019-1262](https://cve.now/CVE-2019-1262.md): A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques (no CVSS, Microsoft SharePoint Foundation)
- [CVE-2019-1263](https://cve.now/CVE-2019-1263.md): An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel In (no CVSS, Microsoft Excel · Microsoft Office)
- [CVE-2019-1264](https://cve.now/CVE-2019-1264.md): A security feature bypass vulnerability exists when Microsoft Office improperly handles input, aka 'Microsoft Office Security Feature Bypass (no CVSS, Microsoft Project · Microsoft Office)
- [CVE-2019-1265](https://cve.now/CVE-2019-1265.md): A security feature bypass vulnerability exists when Microsoft Yammer App for Android fails to apply the correct Intune MAM Policy.This could (no CVSS, Microsoft Yammer for Android)
- [CVE-2019-1266](https://cve.now/CVE-2019-1266.md): A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App (OWA) fails to properly handle web requests, aka 'Microsof (no CVSS, Microsoft Exchange Server)
- [CVE-2019-1267](https://cve.now/CVE-2019-1267.md): An elevation of privilege vulnerability exists in Microsoft Compatibility Appraiser where a configuration file, with local privileges, is vu (no CVSS, Microsoft Windows)
- [CVE-2019-1214](https://cve.now/CVE-2019-1214.md): An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, a (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2019-1215](https://cve.now/CVE-2019-1215.md): An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Pr (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2019-1216](https://cve.now/CVE-2019-1216.md): An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure Vulner (no CVSS, Microsoft Windows)
- [CVE-2019-1217](https://cve.now/CVE-2019-1217.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge (EdgeHTML-based) on Windows · Microsoft C… +1)
- [CVE-2019-1219](https://cve.now/CVE-2019-1219.md): An information disclosure vulnerability exists when the Windows Transaction Manager improperly handles objects in memory, aka 'Windows Trans (no CVSS, Microsoft Windows)
- [CVE-2019-1220](https://cve.now/CVE-2019-1220.md): A security feature bypass vulnerability exists when Microsoft Browsers fail to validate the correct Security Zone of requests for specific U (no CVSS, Microsoft Internet Explorer · Microsoft Edge (EdgeHTML-b… +3)
- [CVE-2019-1221](https://cve.now/CVE-2019-1221.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-1231](https://cve.now/CVE-2019-1231.md): An information disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS certificate validation, aka 'Rome SDK Information (no CVSS, Microsoft Rome SDK)
- [CVE-2019-1232](https://cve.now/CVE-2019-1232.md): An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file oper (no CVSS, Microsoft Visual Studio · Microsoft Windows)
- [CVE-2019-1233](https://cve.now/CVE-2019-1233.md): A denial of service vulnerability exists in Microsoft Exchange Server software when the software fails to properly handle objects in memory, (no CVSS, Microsoft Exchange Server)
- [CVE-2019-1235](https://cve.now/CVE-2019-1235.md): An elevation of privilege vulnerability exists in Windows Text Service Framework (TSF) when the TSF server process does not validate the sou (no CVSS, Microsoft Windows)
- [CVE-2019-1236](https://cve.now/CVE-2019-1236.md): A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-1237](https://cve.now/CVE-2019-1237.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge (EdgeHTML-based) on Windows Server · Micr… +2)
- [CVE-2019-1240](https://cve.now/CVE-2019-1240.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-1241](https://cve.now/CVE-2019-1241.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-1242](https://cve.now/CVE-2019-1242.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-1243](https://cve.now/CVE-2019-1243.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-1244](https://cve.now/CVE-2019-1244.md): An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Informatio (no CVSS, Microsoft Windows)
- [CVE-2019-1245](https://cve.now/CVE-2019-1245.md): An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Informatio (no CVSS, Microsoft Windows)
- [CVE-2019-0787](https://cve.now/CVE-2019-0787.md): A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote De (no CVSS, Microsoft Windows)
- [CVE-2019-0788](https://cve.now/CVE-2019-0788.md): A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote De (no CVSS, Microsoft Windows)
- [CVE-2019-0928](https://cve.now/CVE-2019-0928.md): A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on (no CVSS, Microsoft Windows)
- [CVE-2019-1138](https://cve.now/CVE-2019-1138.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge (EdgeHTML-based) on Windows Server · Micr… +2)
- [CVE-2019-1142](https://cve.now/CVE-2019-1142.md): An elevation of privilege vulnerability exists when the .NET Framework common language runtime (CLR) allows file creation in arbitrary locat (no CVSS, Microsoft .NET Framework)
- [CVE-2019-1208](https://cve.now/CVE-2019-1208.md): A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-1209](https://cve.now/CVE-2019-1209.md): An information disclosure vulnerability exists in Lync 2013, aka 'Lync 2013 Information Disclosure Vulnerability'. (no CVSS, Microsoft Lync Server)
- [CVE-2019-16247](https://cve.now/CVE-2019-16247.md): Delta DCISoft 1.21 has a User Mode Write AV starting at CommLib!CCommLib::SetSerializeData+0x000000000000001b. (no CVSS)
- [CVE-2019-5055](https://cve.now/CVE-2019-5055.md): An exploitable denial-of-service vulnerability exists in the Host Access Point Daemon (hostapd) on the NETGEAR N300 (WNR2000v5 with Firmware (CVSS 7.5, Netgear N300 WNR2000v5)
- [CVE-2019-5054](https://cve.now/CVE-2019-5054.md): An exploitable denial-of-service vulnerability exists in the session handling functionality of the NETGEAR N300 (WNR2000v5 with Firmware Ver (CVSS 7.5, Netgear N300 WNR2000v5)
- [CVE-2019-13540](https://cve.now/CVE-2019-13540.md): Delta Electronics TPEditor, Versions 1.94 and prior. (no CVSS, Delta Electronics TPEditor)
- [CVE-2019-13536](https://cve.now/CVE-2019-13536.md): Delta Electronics TPEditor, Versions 1.94 and prior. (no CVSS, Delta Electronics TPEditor)
- [CVE-2019-13544](https://cve.now/CVE-2019-13544.md): Delta Electronics TPEditor, Versions 1.94 and prior. (no CVSS, Delta Electronics TPEditor)
- [CVE-2019-10074](https://cve.now/CVE-2019-10074.md): An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a fie (no CVSS, Apache OFBiz)
- [CVE-2019-15302](https://cve.now/CVE-2019-15302.md): The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text pad with editing rights (no CVSS)
- [CVE-2019-10073](https://cve.now/CVE-2019-10073.md): The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. (no CVSS, Apache OFBiz)
- [CVE-2019-0189](https://cve.now/CVE-2019-0189.md): The java.io.ObjectInputStream is known to cause Java serialisation issues. (no CVSS, Apache OFBiz)
- [CVE-2018-17200](https://cve.now/CVE-2018-17200.md): The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/ (no CVSS, Apache OFBiz)
- [CVE-2019-11769](https://cve.now/CVE-2019-11769.md): An issue was discovered in TeamViewer 14.2.2558. (no CVSS)
- [CVE-2019-3763](https://cve.now/CVE-2019-3763.md): The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain an information e (CVSS 8.8, Dell RSA Identity Governance and Lifecycle · Dell RSA Via L…)
- [CVE-2019-3761](https://cve.now/CVE-2019-3761.md): The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a stored cross-s (CVSS 5.4, Dell RSA Identity Governance and Lifecycle · Dell RSA Via L…)
- [CVE-2019-3760](https://cve.now/CVE-2019-3760.md): The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a SQL Injection (CVSS 6.4, Dell RSA Identity Governance and Lifecycle · Dell RSA Via L…)
- [CVE-2019-3759](https://cve.now/CVE-2019-3759.md): The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injection (CVSS 6.4, Dell RSA Identity Governance and Lifecycle · Dell RSA Via L…)
- [CVE-2019-16235](https://cve.now/CVE-2019-16235.md): Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280\_message\_carbons.vala. (no CVSS)
- [CVE-2019-16236](https://cve.now/CVE-2019-16236.md): Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala. (no CVSS)
- [CVE-2019-16237](https://cve.now/CVE-2019-16237.md): Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313\_message\_archive\_management.vala. (no CVSS)
- [CVE-2019-14936](https://cve.now/CVE-2019-14936.md): Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash). (no CVSS)
- [CVE-2019-9488](https://cve.now/CVE-2019-9488.md): Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. (no CVSS, Trend Micro Deep Security · Trend Micro Vulnerability Prote…)
- [CVE-2019-11777](https://cve.now/CVE-2019-11777.md): In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the res (no CVSS, The Eclipse Foundation Eclipse Paho · org.eclipse.paho:org.…)
- [CVE-2019-16098](https://cve.now/CVE-2019-16098.md): The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to (no CVSS)
- [CVE-2019-16229](https://cve.now/CVE-2019-16229.md): drivers/gpu/drm/amd/amdkfd/kfd\_interrupt.c in the Linux kernel 5.2.14 does not check the alloc\_workqueue return value, leading to a NULL poi (no CVSS)
- [CVE-2019-16230](https://cve.now/CVE-2019-16230.md): drivers/gpu/drm/radeon/radeon\_display.c in the Linux kernel 5.2.14 does not check the alloc\_workqueue return value, leading to a NULL pointe (CVSS 4.7)
- [CVE-2019-16231](https://cve.now/CVE-2019-16231.md): drivers/net/fjes/fjes\_main.c in the Linux kernel 5.2.14 does not check the alloc\_workqueue return value, leading to a NULL pointer dereferen (no CVSS)
- [CVE-2019-16232](https://cve.now/CVE-2019-16232.md): drivers/net/wireless/marvell/libertas/if\_sdio.c in the Linux kernel 5.2.14 does not check the alloc\_workqueue return value, leading to a NUL (no CVSS)
- [CVE-2019-16233](https://cve.now/CVE-2019-16233.md): drivers/scsi/qla2xxx/qla\_os.c in the Linux kernel 5.2.14 does not check the alloc\_workqueue return value, leading to a NULL pointer derefere (no CVSS)
- [CVE-2019-16234](https://cve.now/CVE-2019-16234.md): drivers/net/wireless/intel/iwlwifi/pcie/trans.c in the Linux kernel 5.2.14 does not check the alloc\_workqueue return value, leading to a NUL (no CVSS)
- [CVE-2019-16224](https://cve.now/CVE-2019-16224.md): An issue was discovered in py-lmdb 0.97. (no CVSS, lmdb)
- [CVE-2019-16225](https://cve.now/CVE-2019-16225.md): An issue was discovered in py-lmdb 0.97. (no CVSS, lmdb)
- [CVE-2019-16226](https://cve.now/CVE-2019-16226.md): An issue was discovered in py-lmdb 0.97. (no CVSS, lmdb)
- [CVE-2019-16227](https://cve.now/CVE-2019-16227.md): An issue was discovered in py-lmdb 0.97. (no CVSS, lmdb)
- [CVE-2019-16228](https://cve.now/CVE-2019-16228.md): An issue was discovered in py-lmdb 0.97. (no CVSS, lmdb)
- [CVE-2019-3644](https://cve.now/CVE-2019-3644.md): MWG scanners updated to address CVE-2019-9517 (CVSS 7.5, McAfee Web Gateway)
- [CVE-2019-3643](https://cve.now/CVE-2019-3643.md): MWG scanners updated to address CVE-2019-9511 (CVSS 5.3, McAfee Web Gateway)
- [CVE-2019-8451](https://cve.now/CVE-2019-8451.md): The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal net (no CVSS, Atlassian Jira)
- [CVE-2019-8450](https://cve.now/CVE-2019-8450.md): Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attacke (no CVSS, Atlassian Jira)
- [CVE-2019-8449](https://cve.now/CVE-2019-8449.md): The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information (no CVSS, Atlassian Jira)
- [CVE-2019-14998](https://cve.now/CVE-2019-14998.md): The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remote attackers to bypas (no CVSS, Atlassian Jira)
- [CVE-2019-14997](https://cve.now/CVE-2019-14997.md): The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other users, including their (no CVSS, Atlassian Jira)
- [CVE-2019-14996](https://cve.now/CVE-2019-14996.md): The FilterPickerPopup.jspa resource in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.3 allows remote attackers to in (no CVSS, Atlassian Jira)
- [CVE-2019-14995](https://cve.now/CVE-2019-14995.md): The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specif (no CVSS, Atlassian Jira)
- [CVE-2019-16217](https://cve.now/CVE-2019-16217.md): WordPress before 5.2.3 allows XSS in media uploads because wp\_ajax\_upload\_attachment is mishandled. (no CVSS)
- [CVE-2019-16219](https://cve.now/CVE-2019-16219.md): WordPress before 5.2.3 allows XSS in shortcode previews. (no CVSS)
- [CVE-2019-16221](https://cve.now/CVE-2019-16221.md): WordPress before 5.2.3 allows reflected XSS in the dashboard. (no CVSS)
- [CVE-2019-16222](https://cve.now/CVE-2019-16222.md): WordPress before 5.2.3 has an issue with URL sanitization in wp\_kses\_bad\_protocol\_once in wp-includes/kses.php that can lead to cross-site s (no CVSS)
- [CVE-2019-16223](https://cve.now/CVE-2019-16223.md): WordPress before 5.2.3 allows XSS in post previews by authenticated users. (no CVSS)
- [CVE-2019-16220](https://cve.now/CVE-2019-16220.md): In WordPress before 5.2.3, validation and sanitization of a URL in wp\_validate\_redirect in wp-includes/pluggable.php could lead to an open r (no CVSS)
- [CVE-2019-16218](https://cve.now/CVE-2019-16218.md): WordPress before 5.2.3 allows XSS in stored comments. (no CVSS)
- [CVE-2019-16193](https://cve.now/CVE-2019-16193.md): In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting (XFS) attack through the EDIT MY PROFIL (no CVSS)
- [CVE-2019-14724](https://cve.now/CVE-2019-14724.md): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an e-mail forwarding de (no CVSS)
- [CVE-2019-14725](https://cve.now/CVE-2019-14725.md): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail usage valu (no CVSS)
- [CVE-2019-16214](https://cve.now/CVE-2019-16214.md): Libra Core before 2019-09-03 has an erroneous regular expression for inline comments, which makes it easier for attackers to interfere with (no CVSS)
- [CVE-2019-13473](https://cve.now/CVE-2019-13473.md): TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd, Imperial i400, Imper (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-09-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.