# CVEs published 2019-09-17

72 CVEs were published on September 17, 2019: 0 critical, 2 high. Days are UTC.

- [CVE-2019-16395](https://cve.now/CVE-2019-16395.md): GnuCOBOL 2.2 has a stack-based buffer overflow in the cb\_name() function in cobc/tree.c via crafted COBOL source code. (no CVSS)
- [CVE-2019-16396](https://cve.now/CVE-2019-16396.md): GnuCOBOL 2.2 has a use-after-free in the end\_scope\_of\_program\_name() function in cobc/parser.y via crafted COBOL source code. (no CVSS)
- [CVE-2019-16199](https://cve.now/CVE-2019-16199.md): eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web i (no CVSS)
- [CVE-2019-16391](https://cve.now/CVE-2019-16391.md): SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the (no CVSS)
- [CVE-2019-16392](https://cve.now/CVE-2019-16392.md): SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages. (no CVSS)
- [CVE-2019-16393](https://cve.now/CVE-2019-16393.md): SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character. (no CVSS)
- [CVE-2019-16394](https://cve.now/CVE-2019-16394.md): SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail add (no CVSS)
- [CVE-2019-6828](https://cve.now/CVE-2019-6828.md): A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2.90), Modicon M340 (firmware version prior to V (no CVSS, Schneider Electric SE Modicon M580 · Schneider Electric… +2)
- [CVE-2019-6826](https://cve.now/CVE-2019-6826.md): A CWE-426: Untrusted Search Path vulnerability exists in SoMachine HVAC v2.4.1 and earlier versions, which could cause arbitrary code execut (no CVSS, Schneider Electric SE SoMachine HVAC)
- [CVE-2019-6813](https://cve.now/CVE-2019-6813.md): A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmwa (no CVSS, CVE-2019-6813 BMXNOR0200H Ethernet / Serial RTU module · CV…)
- [CVE-2019-6811](https://cve.now/CVE-2019-6811.md): An Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability exists in Modicon Quantum 140 NOE771x1 version 6.9 and earli (no CVSS, Schneider Electric SE Modicon Quantum 140 NOE771x1)
- [CVE-2019-6810](https://cve.now/CVE-2019-6810.md): CWE-284: Improper Access Control vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which could cause (no CVSS, Schneider Electric SE BMXNOR0200H Ethernet / Serial RTU mod…)
- [CVE-2019-6809](https://cve.now/CVE-2019-6809.md): A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware versions prior to V2.90), Modicon M340 (firmware versions prior (no CVSS, Schneider Electric SE Modicon M580 · Schneider Electric… +2)
- [CVE-2018-7820](https://cve.now/CVE-2018-7820.md): A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could cause Remote Monitori (no CVSS, Schneider Electric SE APC UPS Network Management Card 2 AOS)
- [CVE-2019-6829](https://cve.now/CVE-2019-6829.md): A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware version prior to V2.90) and Modicon M340 (firmware version prio (CVSS 7.5, Schneider Electric SE Modicon M580 · Schneider Electric SE…)
- [CVE-2019-6833](https://cve.now/CVE-2019-6833.md): A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels (all versions of - HMIGTO, HMIST (CVSS 6.5, Schneider Electric SE Magelis HMI Panels)
- [CVE-2019-6832](https://cve.now/CVE-2019-6832.md): A CWE-287: Authentication vulnerability exists in spaceLYnk (all versions before 2.4.0) and Wiser for KNX (all versions before 2.4.0 - forme (no CVSS, Schneider Electric SE spaceLYnk · Schneider Electric SE Wis…)
- [CVE-2019-6831](https://cve.now/CVE-2019-6831.md): A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmwa (no CVSS, Schneider Electric SE BMXNOR0200H Ethernet / Serial RTU mod…)
- [CVE-2019-6830](https://cve.now/CVE-2019-6830.md): A CWE-248: Uncaught Exception vulnerability exists IN Modicon M580 all versions prior to V2.80, which could cause a possible denial of servi (no CVSS, Schneider Electric SE Modicon M580)
- [CVE-2019-6840](https://cve.now/CVE-2019-6840.md): A Format String: CWE-134 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plu (no CVSS, Schneider Electric SE U.motion Server)
- [CVE-2019-6839](https://cve.now/CVE-2019-6839.md): A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6 (no CVSS, U.motion Servers)
- [CVE-2019-6838](https://cve.now/CVE-2019-6838.md): A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX (no CVSS, U.motion Servers)
- [CVE-2019-6837](https://cve.now/CVE-2019-6837.md): A Server-Side Request Forgery (SSRF): CWE-918 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U. (no CVSS, CVE-2019-6837 U.motion Server)
- [CVE-2019-6836](https://cve.now/CVE-2019-6836.md): A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX (no CVSS, U.motion Servers)
- [CVE-2019-6835](https://cve.now/CVE-2019-6835.md): A Cross-Site Scripting (XSS) CWE-79 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX (no CVSS, Schneider Electric SE U.motion Server)
- [CVE-2019-4477](https://cve.now/CVE-2019-4477.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a user with access to audit logs to obtain sensitive information, caused (CVSS 5.3, IBM WebSphere Application Server)
- [CVE-2019-4442](https://cve.now/CVE-2019-4442.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the file system. (CVSS 4.3, IBM WebSphere Application Server)
- [CVE-2019-4342](https://cve.now/CVE-2019-4342.md): IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Cognos Analytics)
- [CVE-2019-4271](https://cve.now/CVE-2019-4271.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin console is vulnerable to a Client-side HTTP parameter pollution vulnerability. (CVSS 3.5, IBM WebSphere Application Server)
- [CVE-2019-4270](https://cve.now/CVE-2019-4270.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site scripting. (CVSS 5.4, IBM WebSphere Application Server)
- [CVE-2019-4268](https://cve.now/CVE-2019-4268.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. (CVSS 5.3, IBM WebSphere Application Server)
- [CVE-2019-4183](https://cve.now/CVE-2019-4183.md): IBM Cognos Analytics 11.0, and 11.1 is vulnerable to a denial of service attack that could allow a remote user to send specially crafted req (CVSS 5.9, IBM Cognos Analytics)
- [CVE-2019-4175](https://cve.now/CVE-2019-4175.md): IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to (CVSS 5.9, IBM Cognos Controller)
- [CVE-2019-4171](https://cve.now/CVE-2019-4171.md): IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or session cookies. (CVSS 3.7, IBM Cognos Controller)
- [CVE-2019-4086](https://cve.now/CVE-2019-4086.md): IBM Cloud Application Performance Management 8.1.4 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 6.1, IBM Cloud Application Performance Management)
- [CVE-2019-13538](https://cve.now/CVE-2019-13538.md): 3S-Smart Software Solutions GmbH CODESYS V3 Library Manager, all versions prior to 3.5.16.0, allows the system to display active library con (no CVSS)
- [CVE-2019-11665](https://cve.now/CVE-2019-11665.md): Data exposure in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, (no CVSS, Micro Focus Service Manager)
- [CVE-2019-13542](https://cve.now/CVE-2019-13542.md): 3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to send crafted requests fr (no CVSS, 3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server)
- [CVE-2019-11666](https://cve.now/CVE-2019-11666.md): Insecure deserialization of untrusted data in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9 (no CVSS, Micro Focus Service Manager)
- [CVE-2019-11667](https://cve.now/CVE-2019-11667.md): Unauthorized access to contact information in Micro Focus Service Manager, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. (no CVSS, Micro Focus Service Manager)
- [CVE-2019-9681](https://cve.now/CVE-2019-9681.md): Online upgrade information in some firmware packages of Dahua products is not encrypted. (no CVSS, Dahua IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-H…)
- [CVE-2018-20336](https://cve.now/CVE-2018-20336.md): An issue was discovered in ASUSWRT 3.0.0.4.384.20308. (no CVSS)
- [CVE-2019-12755](https://cve.now/CVE-2019-12755.md): Norton Password Manager, prior to 6.5.0.2104, may be susceptible to an information disclosure issue, which is a type of vulnerability whereb (no CVSS, Symantec Norton Password Manager)
- [CVE-2019-9009](https://cve.now/CVE-2019-9009.md): An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . (no CVSS)
- [CVE-2019-14835](https://cve.now/CVE-2019-14835.md): A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue (CVSS 7.2, Linux kernel)
- [CVE-2019-14826](https://cve.now/CVE-2019-14826.md): A flaw was found in FreeIPA versions 4.5.0 and later. (CVSS 5.6, Red Hat ipa)
- [CVE-2019-11559](https://cve.now/CVE-2019-11559.md): A reflected Cross-site scripting (XSS) vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2016-10993](https://cve.now/CVE-2016-10993.md): The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter. (no CVSS)
- [CVE-2016-10992](https://cve.now/CVE-2016-10992.md): The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from\_year parameter. (no CVSS)
- [CVE-2019-15729](https://cve.now/CVE-2019-15729.md): An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. (no CVSS)
- [CVE-2016-10991](https://cve.now/CVE-2016-10991.md): The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion. (no CVSS)
- [CVE-2016-10990](https://cve.now/CVE-2016-10990.md): The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header. (no CVSS)
- [CVE-2016-10989](https://cve.now/CVE-2016-10989.md): The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme\_facebook CSRF. (no CVSS)
- [CVE-2016-10988](https://cve.now/CVE-2016-10988.md): The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook\_message, facebook\_linkname, facebook\_caption, facebook\_description (no CVSS)
- [CVE-2016-10987](https://cve.now/CVE-2016-10987.md): The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps\_sms\_numbers XSS. (no CVSS)
- [CVE-2016-10986](https://cve.now/CVE-2016-10986.md): The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer\_key, consumer\_secret, access\_token, and access\_token\_secret. (no CVSS)
- [CVE-2016-10985](https://cve.now/CVE-2016-10985.md): The echosign plugin before 1.2 for WordPress has XSS via the templates/add\_templates.php id parameter. (no CVSS)
- [CVE-2016-10984](https://cve.now/CVE-2016-10984.md): The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter. (no CVSS)
- [CVE-2016-10983](https://cve.now/CVE-2016-10983.md): The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data. (no CVSS)
- [CVE-2016-10982](https://cve.now/CVE-2016-10982.md): The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc\_settings CSRF. (no CVSS)
- [CVE-2016-10981](https://cve.now/CVE-2016-10981.md): The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento\_pvc\_numbers\_lang, kento\_pvc\_today\_text, or kento\_pvc\_t (no CVSS)
- [CVE-2016-10980](https://cve.now/CVE-2016-10980.md): The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento\_pvc\_geo. (no CVSS)
- [CVE-2016-10979](https://cve.now/CVE-2016-10979.md): The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS. (no CVSS)
- [CVE-2016-10978](https://cve.now/CVE-2016-10978.md): The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF. (no CVSS)
- [CVE-2016-10977](https://cve.now/CVE-2016-10977.md): The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal. (no CVSS)
- [CVE-2016-10976](https://cve.now/CVE-2016-10976.md): The safe-editor plugin before 1.2 for WordPress has no se\_save authentication, with resultant XSS. (no CVSS)
- [CVE-2016-10975](https://cve.now/CVE-2016-10975.md): The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter. (no CVSS)
- [CVE-2016-10974](https://cve.now/CVE-2016-10974.md): The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs\_save CSRF with resultant stored XSS. (no CVSS)
- [CVE-2019-9008](https://cve.now/CVE-2019-9008.md): An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. (no CVSS)
- [CVE-2019-15131](https://cve.now/CVE-2019-15131.md): In Code42 Enterprise 6.7.5 and earlier, 6.8.4 through 6.8.8, and 7.0.0 a vulnerability has been identified that may allow arbitrary files to (no CVSS)
- [CVE-2019-16239](https://cve.now/CVE-2019-16239.md): process\_http\_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk (no CVSS)
- [CVE-2019-16378](https://cve.now/CVE-2019-16378.md): OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which migh (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-09-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.