CVEs published September 20, 2019
77 CVEs were published on September 20, 2019: 0 critical, 1 high.
- Published
- 77
- Critical
- 0
- High
- 1
- Medium
- 3
- Low
- 1
- Unrated
- 72
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Linux kernel
- 2
- F5 Networks BIG-IP ASM
- 1
- F5 Networks BIG-IP, Enterprise Manager
- 1
- Forcepoint VPN Client for Windows
- 1
- html-pdf
- 1
- IBM Security Key Lifecycle Manager
- 1
- IBM WebSphere Application Server
- 1
- mautic/core
- 1
- Pivotal Application Service
- 1
- VMware ESXi · VMware Workstation +1
- 1
High 1
Medium, low and unrated 76
- CVE-2019-6145Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability.Forcepoint VPN Client for Windows
- CVE-2019-6649F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise ManageF5 Networks BIG-IP, Enterprise Manager
- CVE-2019-6650F5 BIG-IP ASM 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 may expose sensitF5 Networks BIG-IP ASM
- CVE-2014-10397The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php.
- CVE-2014-10396The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php.
- CVE-2015-9406Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a ..
- CVE-2019-15138The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/html-pdf
- CVE-2019-14814There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, thaLinux kernel
- CVE-2019-14816There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that alloLinux kernel
- CVE-2019-11327An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2.
- CVE-2019-16645An issue was discovered in Embedthis GoAhead 2.5.0.
- CVE-2019-11326An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2.
- CVE-2018-17789Prospecta Master Data Online (MDO) allows CSRF.
- CVE-2019-5521VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6) and VMware ESXi · VMware Workstation +1
- CVE-2018-11200An issue was discovered in Mautic 2.13.1.mautic/core
- CVE-2019-4565IBM Security Key Lifecycle Manager 3.0 and 3.0.1 does not require that users should have strong passwords by default, which makes it easier IBM Security Key Lifecycle Manager
- CVE-2019-4505IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Network Deployment could allow a remote attacker to obtain sensitive information, caIBM WebSphere Application Server
- CVE-2019-16534On DrayTek Vigor2925 devices with firmware 3.8.4.3, XSS exists via a crafted WAN name on the General Setup screen.
- CVE-2019-16533On DrayTek Vigor2925 devices with firmware 3.8.4.3, Incorrect Access Control exists in loginset.htm, and can be used to trigger XSS.
- CVE-2015-9408The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.
- CVE-2015-9407The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS.
- CVE-2019-16644App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring.
- CVE-2015-9405The wp-piwik plugin before 1.0.5 for WordPress has XSS.
- CVE-2015-9404The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS.
- CVE-2015-9403The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.
- CVE-2015-9402The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.
- CVE-2015-9401The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.
- CVE-2015-9400The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.
- CVE-2015-9399The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.
- CVE-2015-9398The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection.
- CVE-2015-9397The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.
- CVE-2019-16643An issue was discovered in ZrLog 2.1.1.
- CVE-2015-9396The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS.
- CVE-2015-9395The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.
- CVE-2015-9394The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.
- CVE-2015-9393The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.
- CVE-2015-9392The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.
- CVE-2015-9391The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter.
- CVE-2015-9390The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled.
- CVE-2015-9389The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name.
- CVE-2015-9388The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.
- CVE-2015-9386The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.
- CVE-2015-9387The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF.
- CVE-2015-9385The quotes-and-tips plugin before 1.20 for WordPress has XSS.
- CVE-2015-9384The relevant plugin before 1.0.8 for WordPress has XSS.
- CVE-2016-11013The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS.
- CVE-2016-11012The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.
- CVE-2016-11011The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.
- CVE-2016-11010The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.
- CVE-2016-11009The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.
- CVE-2016-11008The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.
- CVE-2016-11007The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.
- CVE-2016-11006The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.
- CVE-2016-11005The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS.
- CVE-2016-11004The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation.
- CVE-2016-11002The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation.
- CVE-2016-11003The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation.
- CVE-2016-11001The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field.
- CVE-2016-11000The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter.
- CVE-2019-16642App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring.
- CVE-2016-10999The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter.
- CVE-2016-10998The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS.
- CVE-2016-10997The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php.
- CVE-2016-10996The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.
- CVE-2019-15089An issue was discovered in PRiSE adAS 1.7.0.
- CVE-2019-15088An issue was discovered in PRiSE adAS 1.7.0.
- CVE-2019-15087An issue was discovered in PRiSE adAS 1.7.0.
- CVE-2019-15086An issue was discovered in PRiSE adAS 1.7.0.
- CVE-2019-15085An issue was discovered in PRiSE adAS 1.7.0.
- CVE-2019-14916An issue was discovered in PRiSE adAS 1.7.0.
- CVE-2019-14915An issue was discovered in PRiSE adAS 1.7.0.
- CVE-2019-14914An issue was discovered in PRiSE adAS 1.7.0.
- CVE-2019-14913An issue was discovered in PRiSE adAS 1.7.0.
- CVE-2019-14912An issue was discovered in PRiSE adAS 1.7.0.
- CVE-2019-14911An issue was discovered in PRiSE adAS 1.7.0.
- CVE-2019-16531LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.