# CVEs published 2019-09-18

42 CVEs were published on September 18, 2019: 4 critical, 2 high. Days are UTC.

- [CVE-2019-16413](https://cve.now/CVE-2019-16413.md): An issue was discovered in the Linux kernel before 5.0.4. (no CVSS)
- [CVE-2019-11778](https://cve.now/CVE-2019-11778.md): If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay inte (no CVSS, The Eclipse Foundation Eclipse Mosquitto)
- [CVE-2019-3758](https://cve.now/CVE-2019-3758.md): RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability. (CVSS 8.1, Dell RSA Archer)
- [CVE-2019-3756](https://cve.now/CVE-2019-3756.md): RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. (CVSS 6.5, Dell RSA Archer)
- [CVE-2019-3740](https://cve.now/CVE-2019-3740.md): RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA k (CVSS 6.5, Dell RSA BSAFE Crypto-J)
- [CVE-2019-3739](https://cve.now/CVE-2019-3739.md): RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA ke (CVSS 6.5, Dell RSA BSAFE Crypto-J)
- [CVE-2019-3738](https://cve.now/CVE-2019-3738.md): RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. (CVSS 6.5, Dell RSA BSAFE Crypto-J)
- [CVE-2019-11211](https://cve.now/CVE-2019-11211.md): TIBCO Enterprise Runtime for R Server Running On Linux With Containerized TERR Service Vulnerable To Remote Code Execution (CVSS 9.9, TIBCO Software TIBCO Enterprise Runtime for R - Server Edit…)
- [CVE-2019-11210](https://cve.now/CVE-2019-11210.md): TIBCO Enterprise Runtime for R Server Exposes Remote Code Execution (CVSS 10.0, TIBCO Software TIBCO Enterprise Runtime for R - Server Edit…)
- [CVE-2019-11662](https://cve.now/CVE-2019-11662.md): Class and method names in error message in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50 (no CVSS, Micro Focus Service Manager)
- [CVE-2019-11661](https://cve.now/CVE-2019-11661.md): Allow changes to some table by non-SysAdmin in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, (no CVSS, Micro Focus Service Manager)
- [CVE-2019-5531](https://cve.now/CVE-2019-5531.md): VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware (no CVSS, VMware vSphere ESXi · VMware vCenter Server)
- [CVE-2019-11664](https://cve.now/CVE-2019-11664.md): Clear text password in browser in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9 (no CVSS, Micro Focus Service Manager)
- [CVE-2019-11663](https://cve.now/CVE-2019-11663.md): Clear text credentials are used to access managers app in Tomcat in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.3 (no CVSS, Micro Focus Service Manager)
- [CVE-2019-13558](https://cve.now/CVE-2019-13558.md): In WebAccess versions 8.4.1 and prior, an exploit executed over the network may cause improper control of generation of code, which may allo (no CVSS, WebAccess)
- [CVE-2019-13556](https://cve.now/CVE-2019-13556.md): In WebAccess versions 8.4.1 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the (no CVSS, WebAccess)
- [CVE-2019-13552](https://cve.now/CVE-2019-13552.md): In WebAccess versions 8.4.1 and prior, multiple command injection vulnerabilities are caused by a lack of proper validation of user-supplied (no CVSS, WebAccess)
- [CVE-2019-15301](https://cve.now/CVE-2019-15301.md): A SQL injection vulnerability in the method Terrasoft.Core.DB.Column.Const() in Terrasoft Bpm'online CRM-System SDK 7.13 allows attackers to (no CVSS)
- [CVE-2019-13550](https://cve.now/CVE-2019-13550.md): In WebAccess, versions 8.4.1 and prior, an improper authorization vulnerability may allow an attacker to disclose sensitive information, cau (no CVSS, WebAccess)
- [CVE-2019-5042](https://cve.now/CVE-2019-5042.md): An exploitable Use-After-Free vulnerability exists in the way FunctionType 0 PDF elements are processed in Aspose.PDF 19.2 for C++. (CVSS 8.8, Talos Aspose.PDF for C++)
- [CVE-2019-5532](https://cve.now/CVE-2019-5532.md): VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability (no CVSS, VMware vCenter Server)
- [CVE-2019-5534](https://cve.now/CVE-2019-5534.md): VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability (no CVSS, VMware vCenter Server)
- [CVE-2019-5067](https://cve.now/CVE-2019-5067.md): An uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object pointers. (CVSS 9.8, Talos Aspose)
- [CVE-2019-5066](https://cve.now/CVE-2019-5066.md): An exploitable use-after-free vulnerability exists in the way LZW-compressed streams are processed in Aspose.PDF 19.2 for C++. (CVSS 9.8, Talos Aspose)
- [CVE-2019-9677](https://cve.now/CVE-2019-9677.md): The specific fields of CGI interface of some Dahua products are not strictly verified, an attacker can cause a buffer overflow by constructi (no CVSS, Dahua Technology IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HF…)
- [CVE-2019-9678](https://cve.now/CVE-2019-9678.md): Some Dahua products have the problem of denial of service during the login process. (no CVSS, Dahua Technology IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HF…)
- [CVE-2019-9680](https://cve.now/CVE-2019-9680.md): Some Dahua products have information leakage issues. (no CVSS, Dahua Technology IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HF…)
- [CVE-2019-9679](https://cve.now/CVE-2019-9679.md): Some of Dahua's Debug functions do not have permission separation. (no CVSS, Dahua Technology IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HF…)
- [CVE-2019-14458](https://cve.now/CVE-2019-14458.md): VIVOTEK IP Camera devices with firmware before 0x20x allow a denial of service via a crafted HTTP header. (no CVSS)
- [CVE-2019-12620](https://cve.now/CVE-2019-12620.md): Cisco HyperFlex Software Counter Value Injection Vulnerability (CVSS 5.3, Cisco HyperFlex HX-Series)
- [CVE-2019-1975](https://cve.now/CVE-2019-1975.md): Cisco HyperFlex Software Cross-Frame Scripting Vulnerability (CVSS 6.5, Cisco HyperFlex HX-Series)
- [CVE-2019-14254](https://cve.now/CVE-2019-14254.md): An issue was discovered in the secure portal in Publisure 2.1.2. (no CVSS)
- [CVE-2019-14253](https://cve.now/CVE-2019-14253.md): An issue was discovered in servletcontroller in the secure portal in Publisure 2.1.2. (no CVSS)
- [CVE-2019-14252](https://cve.now/CVE-2019-14252.md): An issue was discovered in the secure portal in Publisure 2.1.2. (no CVSS)
- [CVE-2018-1847](https://cve.now/CVE-2018-1847.md): IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) v2.0.0.0 through 2.0.0.5, v2.1.0.0 through 2.1.0.4, v2.1.1.0 through 2.1.1.4 (CVSS 5.0, IBM Financial Transaction Manager)
- [CVE-2019-15843](https://cve.now/CVE-2019-15843.md): A malicious file upload vulnerability was discovered in Xiaomi Millet mobile phones 1-6.3.9.3. (no CVSS)
- [CVE-2019-16399](https://cve.now/CVE-2019-16399.md): Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ direc (no CVSS)
- [CVE-2019-16403](https://cve.now/CVE-2019-16403.md): In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can als (no CVSS, bagisto/bagisto)
- [CVE-2019-16216](https://cve.now/CVE-2019-16216.md): Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. (no CVSS)
- [CVE-2016-10994](https://cve.now/CVE-2016-10994.md): The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter. (no CVSS)
- [CVE-2019-16215](https://cve.now/CVE-2019-16215.md): The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. (no CVSS)
- [CVE-2016-10995](https://cve.now/CVE-2016-10995.md): The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single\_upload.php or single-upload.php. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-09-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.