CVEs published September 23, 2019
39 CVEs were published on September 23, 2019: 0 critical, 5 high. 1 is now in CISA KEV.
- Published
- 39
- Critical
- 0
- High
- 5
- Medium
- 1
- Low
- 1
- Unrated
- 32
- Now in CISA KEV
- 1
- Fix available
- 10
Most affected products
- Apache JSPWiki · org.apache.jspwiki:jspwiki-war
- 4
- Red Lion Controls Crimson
- 4
- Apache JSPWiki · org.apache.jspwiki:jspwiki-war +1
- 1
- Apereo CAS · org.apereo.cas:cas-server-support-simple-mfa +5
- 1
- Cloud Foundry CF NFS volume release · Cloud Foundry CF Depl…
- 1
- consul
- 1
- homeassistant
- 1
- Microsoft Internet Explorer
- 1
- Microsoft Security Essentials · Microsoft System Center +13
- 1
- PAC4J For SAML Protocol · org.pac4j:pac4j-saml
- 1
High 5
- CVE-2019-1367A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2019-11277Volume Services is vulnerable to an LDAP injection attackCloud Foundry CF NFS volume release · Cloud Foundry CF Depl…
- CVE-2019-10984Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited whRed Lion Controls Crimson
- CVE-2019-10996Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited whRed Lion Controls Crimson
- CVE-2019-3416All versions up to V81511329.1008 of ZTE ZXV10 B860A products are impacted by input validation vulnerability.ZTE ZXV10 B860A
Medium, low and unrated 34
- CVE-2019-10755The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes tPAC4J For SAML Protocol · org.pac4j:pac4j-saml
- CVE-2019-10754Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generaApereo CAS · org.apereo.cas:cas-server-support-simple-mfa +5
- CVE-2019-1255A denial of service vulnerability exists when Microsoft Defender improperly handles files, aka 'Microsoft Defender Denial of Service VulneraMicrosoft Security Essentials · Microsoft System Center +13
- CVE-2019-15635An issue was discovered in Grafana 5.4.0.
- CVE-2019-10978Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited whRed Lion Controls Crimson
- CVE-2019-10990Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected fRed Lion Controls Crimson
- CVE-2019-12407On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki,Apache JSPWiki · org.apache.jspwiki:jspwiki-war +1
- CVE-2019-10090On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki,Apache JSPWiki · org.apache.jspwiki:jspwiki-war
- CVE-2018-21019Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's homeassistant
- CVE-2019-16377The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.consul
- CVE-2019-13063Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on th
- CVE-2019-12404On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki,Apache JSPWiki · org.apache.jspwiki:jspwiki-war
- CVE-2019-10089On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki,Apache JSPWiki · org.apache.jspwiki:jspwiki-war
- CVE-2019-10087On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki,Apache JSPWiki · org.apache.jspwiki:jspwiki-war
- CVE-2019-16723In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a
- CVE-2019-16518An issue was discovered on Swell Kit Mod devices that use the Vandy Vape platform.
- CVE-2019-16719WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS.
- CVE-2019-16721NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user.
- CVE-2019-16722ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an str_ireplace operatio
- CVE-2019-16720ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demons
- CVE-2019-16718In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c.
- CVE-2019-16707Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
- CVE-2019-16708ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage.
- CVE-2019-16709ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage.
- CVE-2019-16710ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in MagickCore/memory.c.
- CVE-2019-16711ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c.
- CVE-2019-16712ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by WritePS3Image.
- CVE-2019-16713ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in MagickCore/constitute.c.
- CVE-2019-16714In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack m
- CVE-2019-16706kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cms_user_add.php.
- CVE-2019-16705Ming (aka libming) 0.4.8 has an out of bounds read vulnerability in the function OpCode() in the decompile.c file in libutil.a.
- CVE-2019-16704admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS.
- CVE-2019-16703admin/infolist_add.php in PHPMyWind 5.6 has stored XSS.
- CVE-2019-16702Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /Logi