# CVEs published 2019-09-21

17 CVEs were published on September 21, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-16681](https://cve.now/CVE-2019-16681.md): The Traveloka application 3.14.0 for Android exports com.traveloka.android.activity.common.WebViewActivity, leading to the opening of arbitr (no CVSS)
- [CVE-2019-16680](https://cve.now/CVE-2019-16680.md): An issue was discovered in GNOME file-roller before 3.29.91. (no CVSS)
- [CVE-2019-16679](https://cve.now/CVE-2019-16679.md): Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion. (no CVSS)
- [CVE-2019-16677](https://cve.now/CVE-2019-16677.md): An issue was discovered in idreamsoft iCMS V7.0. (no CVSS)
- [CVE-2019-16678](https://cve.now/CVE-2019-16678.md): admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route. (no CVSS)
- [CVE-2019-16669](https://cve.now/CVE-2019-16669.md): The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is e (no CVSS, pagekit/pagekit)
- [CVE-2019-16664](https://cve.now/CVE-2019-16664.md): An issue was discovered in ThinkSAAS 2.91. (no CVSS)
- [CVE-2019-16665](https://cve.now/CVE-2019-16665.md): An issue was discovered in ThinkSAAS 2.91. (no CVSS)
- [CVE-2019-16655](https://cve.now/CVE-2019-16655.md): joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available. (no CVSS)
- [CVE-2019-16656](https://cve.now/CVE-2019-16656.md): joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of an object in the dat (no CVSS)
- [CVE-2019-16657](https://cve.now/CVE-2019-16657.md): TuziCMS 2.0.6 has XSS via the PATH\_INFO to a group URI, as demonstrated by index.php/article/group/id/2/. (no CVSS)
- [CVE-2019-16658](https://cve.now/CVE-2019-16658.md): TuziCMS 2.0.6 has index.php/manage/notice/do\_add CSRF. (no CVSS)
- [CVE-2019-16659](https://cve.now/CVE-2019-16659.md): TuziCMS 2.0.6 has index.php/manage/link/do\_add CSRF. (no CVSS)
- [CVE-2019-16660](https://cve.now/CVE-2019-16660.md): joyplus-cms 1.6.0 has admin\_ajax.php?action=savexml&tab=vodplay CSRF. (no CVSS)
- [CVE-2019-16661](https://cve.now/CVE-2019-16661.md): Ogma CMS 0.5 has XSS via creation of a new blog. (no CVSS)
- [CVE-2019-16649](https://cve.now/CVE-2019-16649.md): On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service (no CVSS)
- [CVE-2019-16650](https://cve.now/CVE-2019-16650.md): On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket fil (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-09-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.