CVEs published September 14, 2019
11 CVEs were published on September 14, 2019: 0 critical, 0 high.
- Published
- 11
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- pimcore/pimcore
- 2
Medium, low and unrated 11
- CVE-2019-16317In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameterpimcore/pimcore
- CVE-2019-16318In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstpimcore/pimcore
- CVE-2019-16307A Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp and deleteWebExMeetingCheck.jsp in Fuji Xe
- CVE-2019-16294SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafte
- CVE-2019-16309FlameCMS 3.3.5 has SQL injection in account/login.php via accountName.
- CVE-2019-16310NIUSHOP V1.11 has XSS via the index.php?s=/admin URI.
- CVE-2019-16311NIUSHOP V1.11 has CSRF via search_info to index.php.
- CVE-2019-16312s-cms V3.0 has XSS in index.php?type=text via the S_id parameter.
- CVE-2019-16313ifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML source code.
- CVE-2019-16314Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2.
- CVE-2019-16305In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection.