# CVEs published 2019-09-13 50 CVEs were published on September 13, 2019: 0 critical, 0 high. Days are UTC. - [CVE-2019-16303](https://cve.now/CVE-2019-16303.md): A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of (no CVSS, generator-jhipster-kotlin) - [CVE-2019-5485](https://cve.now/CVE-2019-5485.md): NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. (no CVSS, gitlabhook) - [CVE-2019-5484](https://cve.now/CVE-2019-5484.md): Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attacke (no CVSS, bower) - [CVE-2019-11660](https://cve.now/CVE-2019-11660.md): Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40. (no CVSS, Data Protector) - [CVE-2019-13548](https://cve.now/CVE-2019-13548.md): CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could caus (no CVSS, CODESYS V3 web server) - [CVE-2019-13532](https://cve.now/CVE-2019-13532.md): CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow (no CVSS, CODESYS V3 web server) - [CVE-2019-5315](https://cve.now/CVE-2019-5315.md): A command injection vulnerability is present in the web management interface of ArubaOS that permits an authenticated user to execute arbitr (no CVSS, Aruba Mobility Controllers) - [CVE-2019-5314](https://cve.now/CVE-2019-5314.md): Some web components in the ArubaOS software are vulnerable to HTTP Response splitting (CRLF injection) and Reflected XSS. (no CVSS, Aruba Mobility Controllers) - [CVE-2018-7081](https://cve.now/CVE-2018-7081.md): A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. (no CVSS, Aruba Mobility Controllers) - [CVE-2019-10937](https://cve.now/CVE-2019-10937.md): A vulnerability has been identified in SIMATIC TDC CP51M1 (All versions \< V1.1.7). (no CVSS, Siemens AG SIMATIC TDC CP51M1) - [CVE-2019-13918](https://cve.now/CVE-2019-13918.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V2.0 SP1). (no CVSS, Siemens AG SINEMA Remote Connect Server) - [CVE-2019-13919](https://cve.now/CVE-2019-13919.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V2.0 SP1). (no CVSS, Siemens AG SINEMA Remote Connect Server) - [CVE-2019-13920](https://cve.now/CVE-2019-13920.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V2.0 SP1). (no CVSS, Siemens AG SINEMA Remote Connect Server) - [CVE-2019-13922](https://cve.now/CVE-2019-13922.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V2.0 SP1). (no CVSS, Siemens AG SINEMA Remote Connect Server) - [CVE-2019-13923](https://cve.now/CVE-2019-13923.md): A vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway (All versions). (no CVSS, Siemens AG IE/WSN-PA Link WirelessHART Gateway) - [CVE-2019-16293](https://cve.now/CVE-2019-16293.md): The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted va (no CVSS) - [CVE-2010-5333](https://cve.now/CVE-2010-5333.md): The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an admini (no CVSS) - [CVE-2019-16288](https://cve.now/CVE-2019-16288.md): On Tenda N301 wireless routers, a long string in the wifiSSID parameter of a goform/setWifi POST request causes the device to crash. (no CVSS) - [CVE-2019-16289](https://cve.now/CVE-2019-16289.md): The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp\_item parameter. (no CVSS) - [CVE-2019-3646](https://cve.now/CVE-2019-3646.md): McAfee Total Protection - Free Antivirus Trial: DLL Search Order Hijacking vulnerability (CVSS 6.9, McAfee Total Protection - Free Antivirus Trial) - [CVE-2019-15031](https://cve.now/CVE-2019-15031.md): In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via an interrup (no CVSS) - [CVE-2019-15030](https://cve.now/CVE-2019-15030.md): In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility (no CVSS) - [CVE-2019-12922](https://cve.now/CVE-2019-12922.md): A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page. (no CVSS, phpmyadmin/phpmyadmin) - [CVE-2019-13364](https://cve.now/CVE-2019-13364.md): admin.php?page=account\_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter. (no CVSS) - [CVE-2019-13363](https://cve.now/CVE-2019-13363.md): admin.php?page=notification\_by\_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_se (no CVSS) - [CVE-2019-12517](https://cve.now/CVE-2019-12517.md): An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. (no CVSS) - [CVE-2019-12516](https://cve.now/CVE-2019-12516.md): The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=s (no CVSS) - [CVE-2016-10955](https://cve.now/CVE-2016-10955.md): The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking. (no CVSS) - [CVE-2016-10954](https://cve.now/CVE-2016-10954.md): The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload. (no CVSS) - [CVE-2016-10953](https://cve.now/CVE-2016-10953.md): The Headway theme before 3.8.9 for WordPress has XSS via the license key field. (no CVSS) - [CVE-2016-10952](https://cve.now/CVE-2016-10952.md): The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter. (no CVSS) - [CVE-2016-10951](https://cve.now/CVE-2016-10951.md): The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter. (no CVSS) - [CVE-2016-10950](https://cve.now/CVE-2016-10950.md): The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter. (no CVSS) - [CVE-2016-10949](https://cve.now/CVE-2016-10949.md): The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization. (no CVSS) - [CVE-2016-10948](https://cve.now/CVE-2016-10948.md): The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function. (no CVSS) - [CVE-2016-10947](https://cve.now/CVE-2016-10947.md): The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin. (no CVSS) - [CVE-2016-10946](https://cve.now/CVE-2016-10946.md): The wp-d3 plugin before 2.4.1 for WordPress has CSRF. (no CVSS) - [CVE-2016-10945](https://cve.now/CVE-2016-10945.md): The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF. (no CVSS) - [CVE-2016-10944](https://cve.now/CVE-2016-10944.md): The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF. (no CVSS) - [CVE-2016-10943](https://cve.now/CVE-2016-10943.md): The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter. (no CVSS) - [CVE-2016-10942](https://cve.now/CVE-2016-10942.md): The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert\_id parameter exploitable via (no CVSS) - [CVE-2016-10941](https://cve.now/CVE-2016-10941.md): The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF. (no CVSS) - [CVE-2016-10940](https://cve.now/CVE-2016-10940.md): The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter. (no CVSS) - [CVE-2016-10939](https://cve.now/CVE-2016-10939.md): The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter. (no CVSS) - [CVE-2016-10938](https://cve.now/CVE-2016-10938.md): The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location. (no CVSS) - [CVE-2017-18615](https://cve.now/CVE-2017-18615.md): The kama-clic-counter plugin before 3.5.0 for WordPress has XSS. (no CVSS) - [CVE-2017-18614](https://cve.now/CVE-2017-18614.md): The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter. (no CVSS) - [CVE-2017-18613](https://cve.now/CVE-2017-18613.md): The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter. (no CVSS) - [CVE-2017-18612](https://cve.now/CVE-2017-18612.md): The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter. (no CVSS) - [CVE-2019-16277](https://cve.now/CVE-2019-16277.md): PicoC 2.1 has a heap-based buffer overflow in StringStrcpy in cstdlib/string.c when called from ExpressionParseFunctionCall in expression.c. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-09-13 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.