# CVEs published 2019-09-19

18 CVEs were published on September 19, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2019-9720](https://cve.now/CVE-2019-9720.md): A stack-based buffer overflow in the subtitle decoder in Libav 12.3 allows attackers to corrupt the stack via a crafted video file in Matros (no CVSS)
- [CVE-2019-9719](https://cve.now/CVE-2019-9719.md): A stack-based buffer overflow in the subtitle decoder in Libav 12.3 allows attackers to corrupt the stack via a crafted video file in Matros (no CVSS)
- [CVE-2019-9717](https://cve.now/CVE-2019-9717.md): In Libav 12.3, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, beca (no CVSS)
- [CVE-2019-16525](https://cve.now/CVE-2019-16525.md): An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. (no CVSS)
- [CVE-2019-14821](https://cve.now/CVE-2019-14821.md): An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements t (CVSS 7.5, Linux Kernel)
- [CVE-2019-15033](https://cve.now/CVE-2019-15033.md): Pydio 6.0.8 allows Authenticated SSRF during a Remote Link Feature download. (no CVSS)
- [CVE-2019-15032](https://cve.now/CVE-2019-15032.md): Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the remote-upload option is used with the http:/ (no CVSS)
- [CVE-2019-16511](https://cve.now/CVE-2019-16511.md): An issue was discovered in DTF in FireGiant WiX Toolset before 3.11.2. (no CVSS)
- [CVE-2019-16510](https://cve.now/CVE-2019-16510.md): libIEC61850 through 1.3.3 has a use-after-free in MmsServer\_waitReady in mms/iso\_mms/server/mms\_server.c, as demonstrated by server\_example\_ (no CVSS)
- [CVE-2019-16412](https://cve.now/CVE-2019-16412.md): In goform/setSysTools on Tenda N301 wireless routers, attackers can trigger a device crash via a zero wanMTU value. (no CVSS)
- [CVE-2019-16398](https://cve.now/CVE-2019-16398.md): On Keeper K5 20.1.0.25 and 20.1.0.63 devices, remote code execution can occur by inserting an SD card containing a file named zskj\_script\_ru (no CVSS)
- [CVE-2019-15001](https://cve.now/CVE-2019-15001.md): The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0 (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2019-15000](https://cve.now/CVE-2019-15000.md): The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 (the fixed version for 5.16.x ), from 6.0.0 before 6.0.10 ( (no CVSS, Atlassian Bitbucket Server · Atlassian Bitbucket Data Center)
- [CVE-2019-14994](https://cve.now/CVE-2019-14994.md): The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before version 3.9.16, from version 3.10 (no CVSS, Atlassian Jira Service Desk Server · Atlassian Jira Service…)
- [CVE-2019-6010](https://cve.now/CVE-2019-6010.md): Integer overflow vulnerability in LINE(Android) from 4.4.0 to the version before 9.15.1 allows remote attackers to cause a denial of service (no CVSS, LINE)
- [CVE-2019-11779](https://cve.now/CVE-2019-11779.md): In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of appro (no CVSS, The Eclipse Foundation Eclipse Mosquitto)
- [CVE-2019-3689](https://cve.now/CVE-2019-3689.md): nfs-utils: root-owned files stored in insecure /var/lib/nfs directory (CVSS 5.1, SUSE Linux Enterprise Server)
- [CVE-2019-15943](https://cve.now/CVE-2019-15943.md): vphysics.dll in Counter-Strike: Global Offensive before 1.37.1.1 allows remote attackers to achieve code execution or denial of service by c (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-09-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.