CVEs published September 18, 2019
42 CVEs were published on September 18, 2019: 4 critical, 2 high.
- Published
- 42
- Critical
- 4
- High
- 2
- Medium
- 7
- Low
- 0
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Dahua Technology IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HF…
- 4
- Micro Focus Service Manager
- 4
- WebAccess
- 4
- Dell RSA BSAFE Crypto-J
- 3
- Cisco HyperFlex HX-Series
- 2
- Dell RSA Archer
- 2
- Talos Aspose
- 2
- TIBCO Software TIBCO Enterprise Runtime for R - Server Edit…
- 2
- VMware vCenter Server
- 2
- bagisto/bagisto
- 1
Critical 4
- CVE-2019-11211TIBCO Enterprise Runtime for R Server Running On Linux With Containerized TERR Service Vulnerable To Remote Code ExecutionTIBCO Software TIBCO Enterprise Runtime for R - Server Edit…
- CVE-2019-11210TIBCO Enterprise Runtime for R Server Exposes Remote Code ExecutionTIBCO Software TIBCO Enterprise Runtime for R - Server Edit…
- CVE-2019-5067An uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object pointers.Talos Aspose
- CVE-2019-5066An exploitable use-after-free vulnerability exists in the way LZW-compressed streams are processed in Aspose.PDF 19.2 for C++.Talos Aspose
High 2
Medium, low and unrated 36
- CVE-2019-16413An issue was discovered in the Linux kernel before 5.0.4.
- CVE-2019-11778If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay inteThe Eclipse Foundation Eclipse Mosquitto
- CVE-2019-3756RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability.Dell RSA Archer
- CVE-2019-3740RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA kDell RSA BSAFE Crypto-J
- CVE-2019-3739RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA keDell RSA BSAFE Crypto-J
- CVE-2019-3738RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability.Dell RSA BSAFE Crypto-J
- CVE-2019-11662Class and method names in error message in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50Micro Focus Service Manager
- CVE-2019-11661Allow changes to some table by non-SysAdmin in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, Micro Focus Service Manager
- CVE-2019-5531VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMwareVMware vSphere ESXi · VMware vCenter Server
- CVE-2019-11664Clear text password in browser in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9Micro Focus Service Manager
- CVE-2019-11663Clear text credentials are used to access managers app in Tomcat in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.3Micro Focus Service Manager
- CVE-2019-13558In WebAccess versions 8.4.1 and prior, an exploit executed over the network may cause improper control of generation of code, which may alloWebAccess
- CVE-2019-13556In WebAccess versions 8.4.1 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of theWebAccess
- CVE-2019-13552In WebAccess versions 8.4.1 and prior, multiple command injection vulnerabilities are caused by a lack of proper validation of user-suppliedWebAccess
- CVE-2019-15301A SQL injection vulnerability in the method Terrasoft.Core.DB.Column.Const() in Terrasoft Bpm'online CRM-System SDK 7.13 allows attackers to
- CVE-2019-13550In WebAccess, versions 8.4.1 and prior, an improper authorization vulnerability may allow an attacker to disclose sensitive information, cauWebAccess
- CVE-2019-5532VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerabilityVMware vCenter Server
- CVE-2019-5534VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerabilityVMware vCenter Server
- CVE-2019-9677The specific fields of CGI interface of some Dahua products are not strictly verified, an attacker can cause a buffer overflow by constructiDahua Technology IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HF…
- CVE-2019-9678Some Dahua products have the problem of denial of service during the login process.Dahua Technology IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HF…
- CVE-2019-9680Some Dahua products have information leakage issues.Dahua Technology IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HF…
- CVE-2019-9679Some of Dahua's Debug functions do not have permission separation.Dahua Technology IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HF…
- CVE-2019-14458VIVOTEK IP Camera devices with firmware before 0x20x allow a denial of service via a crafted HTTP header.
- CVE-2019-12620Cisco HyperFlex Software Counter Value Injection VulnerabilityCisco HyperFlex HX-Series
- CVE-2019-1975Cisco HyperFlex Software Cross-Frame Scripting VulnerabilityCisco HyperFlex HX-Series
- CVE-2019-14254An issue was discovered in the secure portal in Publisure 2.1.2.
- CVE-2019-14253An issue was discovered in servletcontroller in the secure portal in Publisure 2.1.2.
- CVE-2019-14252An issue was discovered in the secure portal in Publisure 2.1.2.
- CVE-2018-1847IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) v2.0.0.0 through 2.0.0.5, v2.1.0.0 through 2.1.0.4, v2.1.1.0 through 2.1.1.4IBM Financial Transaction Manager
- CVE-2019-15843A malicious file upload vulnerability was discovered in Xiaomi Millet mobile phones 1-6.3.9.3.
- CVE-2019-16399Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ direc
- CVE-2019-16403In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can alsbagisto/bagisto
- CVE-2019-16216Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files.
- CVE-2016-10994The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter.
- CVE-2019-16215The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking.
- CVE-2016-10995The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single_upload.php or single-upload.php.