CVEs published September 13, 2019
50 CVEs were published on September 13, 2019: 0 critical, 0 high.
- Published
- 50
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 49
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Siemens AG SINEMA Remote Connect Server
- 4
- Aruba Mobility Controllers
- 3
- CODESYS V3 web server
- 2
- bower
- 1
- Data Protector
- 1
- generator-jhipster-kotlin
- 1
- gitlabhook
- 1
- McAfee Total Protection - Free Antivirus Trial
- 1
- phpmyadmin/phpmyadmin
- 1
- Siemens AG IE/WSN-PA Link WirelessHART Gateway
- 1
Medium, low and unrated 50
- CVE-2019-16303A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of generator-jhipster-kotlin
- CVE-2019-5485NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability.gitlabhook
- CVE-2019-5484Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackebower
- CVE-2019-11660Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40.Data Protector
- CVE-2019-13548CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could causCODESYS V3 web server
- CVE-2019-13532CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow CODESYS V3 web server
- CVE-2019-5315A command injection vulnerability is present in the web management interface of ArubaOS that permits an authenticated user to execute arbitrAruba Mobility Controllers
- CVE-2019-5314Some web components in the ArubaOS software are vulnerable to HTTP Response splitting (CRLF injection) and Reflected XSS.Aruba Mobility Controllers
- CVE-2018-7081A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS.Aruba Mobility Controllers
- CVE-2019-10937A vulnerability has been identified in SIMATIC TDC CP51M1 (All versions < V1.1.7).Siemens AG SIMATIC TDC CP51M1
- CVE-2019-13918A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1).Siemens AG SINEMA Remote Connect Server
- CVE-2019-13919A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1).Siemens AG SINEMA Remote Connect Server
- CVE-2019-13920A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1).Siemens AG SINEMA Remote Connect Server
- CVE-2019-13922A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1).Siemens AG SINEMA Remote Connect Server
- CVE-2019-13923A vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway (All versions).Siemens AG IE/WSN-PA Link WirelessHART Gateway
- CVE-2019-16293The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted va
- CVE-2010-5333The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an admini
- CVE-2019-16288On Tenda N301 wireless routers, a long string in the wifiSSID parameter of a goform/setWifi POST request causes the device to crash.
- CVE-2019-16289The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.
- CVE-2019-3646McAfee Total Protection - Free Antivirus Trial: DLL Search Order Hijacking vulnerabilityMcAfee Total Protection - Free Antivirus Trial
- CVE-2019-15031In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via an interrup
- CVE-2019-15030In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility
- CVE-2019-12922A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.phpmyadmin/phpmyadmin
- CVE-2019-13364admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter.
- CVE-2019-13363admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_se
- CVE-2019-12517An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress.
- CVE-2019-12516The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=s
- CVE-2016-10955The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.
- CVE-2016-10954The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.
- CVE-2016-10953The Headway theme before 3.8.9 for WordPress has XSS via the license key field.
- CVE-2016-10952The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter.
- CVE-2016-10951The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter.
- CVE-2016-10950The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter.
- CVE-2016-10949The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization.
- CVE-2016-10948The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function.
- CVE-2016-10947The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.
- CVE-2016-10946The wp-d3 plugin before 2.4.1 for WordPress has CSRF.
- CVE-2016-10945The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.
- CVE-2016-10944The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.
- CVE-2016-10943The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter.
- CVE-2016-10942The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via
- CVE-2016-10941The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.
- CVE-2016-10940The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.
- CVE-2016-10939The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.
- CVE-2016-10938The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.
- CVE-2017-18615The kama-clic-counter plugin before 3.5.0 for WordPress has XSS.
- CVE-2017-18614The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter.
- CVE-2017-18613The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter.
- CVE-2017-18612The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.
- CVE-2019-16277PicoC 2.1 has a heap-based buffer overflow in StringStrcpy in cstdlib/string.c when called from ExpressionParseFunctionCall in expression.c.