CVEs published September 17, 2019
72 CVEs were published on September 17, 2019: 0 critical, 2 high.
- Published
- 72
- Critical
- 0
- High
- 2
- Medium
- 10
- Low
- 2
- Unrated
- 58
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- IBM WebSphere Application Server
- 5
- Micro Focus Service Manager
- 3
- U.motion Servers
- 3
- IBM Cognos Analytics
- 2
- IBM Cognos Controller
- 2
- Schneider Electric SE BMXNOR0200H Ethernet / Serial RTU mod…
- 2
- Schneider Electric SE Modicon M580 · Schneider Electric… +2
- 2
- Schneider Electric SE U.motion Server
- 2
- 3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server
- 1
- CVE-2019-6813 BMXNOR0200H Ethernet / Serial RTU module · CV…
- 1
High 2
- CVE-2019-6829A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware version prior to V2.90) and Modicon M340 (firmware version prioSchneider Electric SE Modicon M580 · Schneider Electric SE…
- CVE-2019-14835A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue Linux kernel
Medium, low and unrated 70
- CVE-2019-16395GnuCOBOL 2.2 has a stack-based buffer overflow in the cb_name() function in cobc/tree.c via crafted COBOL source code.
- CVE-2019-16396GnuCOBOL 2.2 has a use-after-free in the end_scope_of_program_name() function in cobc/parser.y via crafted COBOL source code.
- CVE-2019-16199eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web i
- CVE-2019-16391SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the
- CVE-2019-16392SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.
- CVE-2019-16393SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character.
- CVE-2019-16394SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail add
- CVE-2019-6828A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2.90), Modicon M340 (firmware version prior to VSchneider Electric SE Modicon M580 · Schneider Electric… +2
- CVE-2019-6826A CWE-426: Untrusted Search Path vulnerability exists in SoMachine HVAC v2.4.1 and earlier versions, which could cause arbitrary code executSchneider Electric SE SoMachine HVAC
- CVE-2019-6813A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmwaCVE-2019-6813 BMXNOR0200H Ethernet / Serial RTU module · CV…
- CVE-2019-6811An Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability exists in Modicon Quantum 140 NOE771x1 version 6.9 and earliSchneider Electric SE Modicon Quantum 140 NOE771x1
- CVE-2019-6810CWE-284: Improper Access Control vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which could causeSchneider Electric SE BMXNOR0200H Ethernet / Serial RTU mod…
- CVE-2019-6809A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware versions prior to V2.90), Modicon M340 (firmware versions priorSchneider Electric SE Modicon M580 · Schneider Electric… +2
- CVE-2018-7820A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could cause Remote MonitoriSchneider Electric SE APC UPS Network Management Card 2 AOS
- CVE-2019-6833A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels (all versions of - HMIGTO, HMISTSchneider Electric SE Magelis HMI Panels
- CVE-2019-6832A CWE-287: Authentication vulnerability exists in spaceLYnk (all versions before 2.4.0) and Wiser for KNX (all versions before 2.4.0 - formeSchneider Electric SE spaceLYnk · Schneider Electric SE Wis…
- CVE-2019-6831A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmwaSchneider Electric SE BMXNOR0200H Ethernet / Serial RTU mod…
- CVE-2019-6830A CWE-248: Uncaught Exception vulnerability exists IN Modicon M580 all versions prior to V2.80, which could cause a possible denial of serviSchneider Electric SE Modicon M580
- CVE-2019-6840A Format String: CWE-134 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server PluSchneider Electric SE U.motion Server
- CVE-2019-6839A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6U.motion Servers
- CVE-2019-6838A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX U.motion Servers
- CVE-2019-6837A Server-Side Request Forgery (SSRF): CWE-918 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.CVE-2019-6837 U.motion Server
- CVE-2019-6836A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX U.motion Servers
- CVE-2019-6835A Cross-Site Scripting (XSS) CWE-79 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNXSchneider Electric SE U.motion Server
- CVE-2019-4477IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a user with access to audit logs to obtain sensitive information, causedIBM WebSphere Application Server
- CVE-2019-4442IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the file system.IBM WebSphere Application Server
- CVE-2019-4342IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting.IBM Cognos Analytics
- CVE-2019-4271IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin console is vulnerable to a Client-side HTTP parameter pollution vulnerability.IBM WebSphere Application Server
- CVE-2019-4270IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site scripting.IBM WebSphere Application Server
- CVE-2019-4268IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system.IBM WebSphere Application Server
- CVE-2019-4183IBM Cognos Analytics 11.0, and 11.1 is vulnerable to a denial of service attack that could allow a remote user to send specially crafted reqIBM Cognos Analytics
- CVE-2019-4175IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to IBM Cognos Controller
- CVE-2019-4171IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or session cookies.IBM Cognos Controller
- CVE-2019-4086IBM Cloud Application Performance Management 8.1.4 could allow a remote attacker to hijack the clicking action of the victim.IBM Cloud Application Performance Management
- CVE-2019-135383S-Smart Software Solutions GmbH CODESYS V3 Library Manager, all versions prior to 3.5.16.0, allows the system to display active library con
- CVE-2019-11665Data exposure in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, Micro Focus Service Manager
- CVE-2019-135423S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to send crafted requests fr3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server
- CVE-2019-11666Insecure deserialization of untrusted data in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9Micro Focus Service Manager
- CVE-2019-11667Unauthorized access to contact information in Micro Focus Service Manager, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62.Micro Focus Service Manager
- CVE-2019-9681Online upgrade information in some firmware packages of Dahua products is not encrypted.Dahua IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-H…
- CVE-2018-20336An issue was discovered in ASUSWRT 3.0.0.4.384.20308.
- CVE-2019-12755Norton Password Manager, prior to 6.5.0.2104, may be susceptible to an information disclosure issue, which is a type of vulnerability wherebSymantec Norton Password Manager
- CVE-2019-9009An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 .
- CVE-2019-14826A flaw was found in FreeIPA versions 4.5.0 and later.Red Hat ipa
- CVE-2019-11559A reflected Cross-site scripting (XSS) vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web script or HTML via
- CVE-2016-10993The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter.
- CVE-2016-10992The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.
- CVE-2019-15729An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1.
- CVE-2016-10991The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion.
- CVE-2016-10990The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.
- CVE-2016-10989The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF.
- CVE-2016-10988The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description
- CVE-2016-10987The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.
- CVE-2016-10986The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret.
- CVE-2016-10985The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.
- CVE-2016-10984The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.
- CVE-2016-10983The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.
- CVE-2016-10982The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.
- CVE-2016-10981The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_t
- CVE-2016-10980The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo.
- CVE-2016-10979The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS.
- CVE-2016-10978The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.
- CVE-2016-10977The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.
- CVE-2016-10976The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
- CVE-2016-10975The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter.
- CVE-2016-10974The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS.
- CVE-2019-9008An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30.
- CVE-2019-15131In Code42 Enterprise 6.7.5 and earlier, 6.8.4 through 6.8.8, and 7.0.0 a vulnerability has been identified that may allow arbitrary files to
- CVE-2019-16239process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk
- CVE-2019-16378OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which migh