CVEs published September 12, 2019
42 CVEs were published on September 12, 2019: 2 critical, 2 high. 1 is now in CISA KEV.
- Published
- 42
- Critical
- 2
- High
- 2
- Medium
- 0
- Low
- 0
- Unrated
- 38
- Now in CISA KEV
- 1
- Fix available
- 12
Most affected products
- Inc." Cybozu Garoon
- 4
- Jenkins project Jenkins Script Security Plugin · org.jenkin…
- 4
- Adobe Flash Player
- 2
- Bosch Access Professional Edition
- 2
- Hikari Denwa router/Home GateWay provided by NIPPON TELEGRA…
- 2
- Philips IntelliVue WLAN, portable patient monitors
- 2
- The Eclipse Foundation Eclipse OMR
- 2
- Adobe Application Manager
- 1
- apng-drawable 1.0.0 to
- 1
- Category Specific RSS feed Subscription
- 1
Critical 2
- CVE-2019-11898Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools.Bosch Access Professional Edition
- CVE-2019-16256Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve l
High 2
Medium, low and unrated 38
- CVE-2019-16275hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source addre
- CVE-2019-13530Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501,Philips IntelliVue WLAN, portable patient monitors
- CVE-2019-13534Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501,Philips IntelliVue WLAN, portable patient monitors
- CVE-2019-8070Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use after free vulnerability.Adobe Flash Player
- CVE-2019-8076Adobe application manager installer version 10.0 have an Insecure Library Loading (DLL hijacking) vulnerability.Adobe Application Manager
- CVE-2019-8069Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Same Origin Method Execution vulnerability.Adobe Flash Player
- CVE-2019-14237On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only ac
- CVE-2019-14236On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a soft
- CVE-2019-11773Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users.The Eclipse Foundation Eclipse OMR
- CVE-2019-11774Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop The Eclipse Foundation Eclipse OMR
- CVE-2019-5956Directory traversal vulnerability in WonderCMS 2.6.0 and earlier allows remote attackers to delete arbitrary files via unspecified vectors.WonderCMS 2.6.0 and earlier
- CVE-2019-5975DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary web Inc." Cybozu Garoon
- CVE-2019-5976Cybozu Garoon 4.0.0 to 4.10.2 allows an attacker with administrative rights to cause a denial of service condition via unspecified vectors.Inc." Cybozu Garoon
- CVE-2019-5977Mail header injection vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 may allow a remote authenticated attackers to alter mail header via theInc." Cybozu Garoon
- CVE-2019-5978Open redirect vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 allows remote attackers to redirect users to arbitrary web sites and conduct phCybozu Garoon
- CVE-2019-5985Cross-site scripting vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TEHikari Denwa router/Home GateWay provided by NIPPON TELEGRA…
- CVE-2019-5986Cross-site request forgery (CSRF) vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELHikari Denwa router/Home GateWay provided by NIPPON TELEGRA…
- CVE-2019-5991SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.3 allows remote authenticated attackers to execute arbitrary SQL commands viaInc." Cybozu Garoon
- CVE-2019-5992Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hWordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier
- CVE-2019-5993Cross-site request forgery (CSRF) vulnerability in Category Specific RSS feed Subscription version v2.0 and earlier allows remote attackers Category Specific RSS feed Subscription
- CVE-2019-5996SQL injection vulnerability in the Video Insight VMS 7.3.2.5 and earlier allows remote authenticated attackers to execute arbitrary SQL commVideo Insight VMS 7.3.2.5 and earlier
- CVE-2019-6003Cross-site scripting vulnerability in EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13' version 2.4.2 and earlier allows remote attackers to injeLTD." EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13'
- CVE-2019-6004Open redirect vulnerability in ApeosWare Management Suite Ver.1.4.0.18 and earlier, and ApeosWare Management Suite 2 Ver.2.1.2.4 and earlierFuji Xerox Co. ApeosWare Management Suite and ApeosWare Man…
- CVE-2019-6005Smart TV Box firmware version prior to 1300 allows remote attackers to bypass access restriction to conduct arbitrary operations on the deviSmart TV Box firmware
- CVE-2019-6007Integer overflow vulnerability in apng-drawable 1.0.0 to 1.6.0 allows an attacker to cause a denial of service (DoS) condition or execute arapng-drawable 1.0.0 to
- CVE-2019-6009Open redirect vulnerability in SHIRASAGI v1.7.0 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phiSHIRASAGI Project SHIRASAGI
- CVE-2019-16238Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the admin
- CVE-2019-16261Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated
- CVE-2019-10392Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git lsJenkins project Jenkins Git Client Plugin · org.jenkins-ci.…
- CVE-2019-10393A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expJenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2019-10394A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property exprJenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2019-10395Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerabilJenkins project Jenkins Build Environment Plugin · org.jenk…
- CVE-2019-10396Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitaJenkins project Jenkins Dashboard View Plugin · org.jenkins…
- CVE-2019-10397Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuratioJenkins project Jenkins Aqua Security Serverless Scanner Pl…
- CVE-2019-10398Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where thJenkins project Jenkins Beaker Builder Plugin · org.jenkins…
- CVE-2019-10399A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property exprJenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2019-10400A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment andJenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2019-16257Some Motorola devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve