# CVEs published 2019-09-12

42 CVEs were published on September 12, 2019: 2 critical, 2 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-16275](https://cve.now/CVE-2019-16275.md): hostapd before 2.10 and wpa\_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source addre (no CVSS)
- [CVE-2019-13530](https://cve.now/CVE-2019-13530.md): Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, (no CVSS, Philips IntelliVue WLAN, portable patient monitors)
- [CVE-2019-13534](https://cve.now/CVE-2019-13534.md): Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, (no CVSS, Philips IntelliVue WLAN, portable patient monitors)
- [CVE-2019-11899](https://cve.now/CVE-2019-11899.md): An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a client installation. (CVSS 8.8, Bosch Access Professional Edition)
- [CVE-2019-11898](https://cve.now/CVE-2019-11898.md): Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. (CVSS 9.9, Bosch Access Professional Edition)
- [CVE-2019-8070](https://cve.now/CVE-2019-8070.md): Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use after free vulnerability. (no CVSS, Adobe Flash Player)
- [CVE-2019-8076](https://cve.now/CVE-2019-8076.md): Adobe application manager installer version 10.0 have an Insecure Library Loading (DLL hijacking) vulnerability. (no CVSS, Adobe Application Manager)
- [CVE-2019-8069](https://cve.now/CVE-2019-8069.md): Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Same Origin Method Execution vulnerability. (no CVSS, Adobe Flash Player)
- [CVE-2019-14237](https://cve.now/CVE-2019-14237.md): On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only ac (no CVSS)
- [CVE-2019-14236](https://cve.now/CVE-2019-14236.md): On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a soft (no CVSS)
- [CVE-2019-11773](https://cve.now/CVE-2019-11773.md): Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users. (no CVSS, The Eclipse Foundation Eclipse OMR)
- [CVE-2019-11774](https://cve.now/CVE-2019-11774.md): Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop (no CVSS, The Eclipse Foundation Eclipse OMR)
- [CVE-2019-5956](https://cve.now/CVE-2019-5956.md): Directory traversal vulnerability in WonderCMS 2.6.0 and earlier allows remote attackers to delete arbitrary files via unspecified vectors. (no CVSS, WonderCMS 2.6.0 and earlier)
- [CVE-2019-5975](https://cve.now/CVE-2019-5975.md): DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary web (no CVSS, Inc." Cybozu Garoon)
- [CVE-2019-5976](https://cve.now/CVE-2019-5976.md): Cybozu Garoon 4.0.0 to 4.10.2 allows an attacker with administrative rights to cause a denial of service condition via unspecified vectors. (no CVSS, Inc." Cybozu Garoon)
- [CVE-2019-5977](https://cve.now/CVE-2019-5977.md): Mail header injection vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 may allow a remote authenticated attackers to alter mail header via the (no CVSS, Inc." Cybozu Garoon)
- [CVE-2019-5978](https://cve.now/CVE-2019-5978.md): Open redirect vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 allows remote attackers to redirect users to arbitrary web sites and conduct ph (no CVSS, Cybozu Garoon)
- [CVE-2019-5985](https://cve.now/CVE-2019-5985.md): Cross-site scripting vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TE (no CVSS, Hikari Denwa router/Home GateWay provided by NIPPON TELEGRA…)
- [CVE-2019-5986](https://cve.now/CVE-2019-5986.md): Cross-site request forgery (CSRF) vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TEL (no CVSS, Hikari Denwa router/Home GateWay provided by NIPPON TELEGRA…)
- [CVE-2019-5991](https://cve.now/CVE-2019-5991.md): SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.3 allows remote authenticated attackers to execute arbitrary SQL commands via (no CVSS, Inc." Cybozu Garoon)
- [CVE-2019-5992](https://cve.now/CVE-2019-5992.md): Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to h (no CVSS, WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier)
- [CVE-2019-5993](https://cve.now/CVE-2019-5993.md): Cross-site request forgery (CSRF) vulnerability in Category Specific RSS feed Subscription version v2.0 and earlier allows remote attackers (no CVSS, Category Specific RSS feed Subscription)
- [CVE-2019-5996](https://cve.now/CVE-2019-5996.md): SQL injection vulnerability in the Video Insight VMS 7.3.2.5 and earlier allows remote authenticated attackers to execute arbitrary SQL comm (no CVSS, Video Insight VMS 7.3.2.5 and earlier)
- [CVE-2019-6003](https://cve.now/CVE-2019-6003.md): Cross-site scripting vulnerability in EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13' version 2.4.2 and earlier allows remote attackers to inje (no CVSS, LTD." EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13')
- [CVE-2019-6004](https://cve.now/CVE-2019-6004.md): Open redirect vulnerability in ApeosWare Management Suite Ver.1.4.0.18 and earlier, and ApeosWare Management Suite 2 Ver.2.1.2.4 and earlier (no CVSS, Fuji Xerox Co. ApeosWare Management Suite and ApeosWare Man…)
- [CVE-2019-6005](https://cve.now/CVE-2019-6005.md): Smart TV Box firmware version prior to 1300 allows remote attackers to bypass access restriction to conduct arbitrary operations on the devi (no CVSS, Smart TV Box firmware)
- [CVE-2019-6007](https://cve.now/CVE-2019-6007.md): Integer overflow vulnerability in apng-drawable 1.0.0 to 1.6.0 allows an attacker to cause a denial of service (DoS) condition or execute ar (no CVSS, apng-drawable 1.0.0 to)
- [CVE-2019-6009](https://cve.now/CVE-2019-6009.md): Open redirect vulnerability in SHIRASAGI v1.7.0 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phi (no CVSS, SHIRASAGI Project SHIRASAGI)
- [CVE-2019-16238](https://cve.now/CVE-2019-16238.md): Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the admin (no CVSS)
- [CVE-2019-3638](https://cve.now/CVE-2019-3638.md): Web Gateway (MWG) - Reflected Cross Site Scripting vulnerability (CVSS 8.1, McAfee Web Gateway)
- [CVE-2019-16261](https://cve.now/CVE-2019-16261.md): Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated (no CVSS)
- [CVE-2019-10392](https://cve.now/CVE-2019-10392.md): Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls (no CVSS, Jenkins project Jenkins Git Client Plugin · org.jenkins-ci.…)
- [CVE-2019-10393](https://cve.now/CVE-2019-10393.md): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call exp (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2019-10394](https://cve.now/CVE-2019-10394.md): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expr (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2019-10395](https://cve.now/CVE-2019-10395.md): Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerabil (no CVSS, Jenkins project Jenkins Build Environment Plugin · org.jenk…)
- [CVE-2019-10396](https://cve.now/CVE-2019-10396.md): Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploita (no CVSS, Jenkins project Jenkins Dashboard View Plugin · org.jenkins…)
- [CVE-2019-10397](https://cve.now/CVE-2019-10397.md): Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuratio (no CVSS, Jenkins project Jenkins Aqua Security Serverless Scanner Pl…)
- [CVE-2019-10398](https://cve.now/CVE-2019-10398.md): Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where th (no CVSS, Jenkins project Jenkins Beaker Builder Plugin · org.jenkins…)
- [CVE-2019-10399](https://cve.now/CVE-2019-10399.md): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expr (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2019-10400](https://cve.now/CVE-2019-10400.md): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment and (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2019-16256](https://cve.now/CVE-2019-16256.md): Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve l (CVSS 9.8, KEV)
- [CVE-2019-16257](https://cve.now/CVE-2019-16257.md): Some Motorola devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-09-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.