# CVEs published 2019-09-23

39 CVEs were published on September 23, 2019: 0 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-10755](https://cve.now/CVE-2019-10755.md): The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes t (no CVSS, PAC4J For SAML Protocol · org.pac4j:pac4j-saml)
- [CVE-2019-10754](https://cve.now/CVE-2019-10754.md): Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID genera (no CVSS, Apereo CAS · org.apereo.cas:cas-server-support-simple-mfa +5)
- [CVE-2019-1255](https://cve.now/CVE-2019-1255.md): A denial of service vulnerability exists when Microsoft Defender improperly handles files, aka 'Microsoft Defender Denial of Service Vulnera (no CVSS, Microsoft Security Essentials · Microsoft System Center +13)
- [CVE-2019-1367](https://cve.now/CVE-2019-1367.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip (CVSS 7.5, KEV, Microsoft Internet Explorer)
- [CVE-2019-11277](https://cve.now/CVE-2019-11277.md): Volume Services is vulnerable to an LDAP injection attack (CVSS 8.4, Cloud Foundry CF NFS volume release · Cloud Foundry CF Depl…)
- [CVE-2019-15635](https://cve.now/CVE-2019-15635.md): An issue was discovered in Grafana 5.4.0. (no CVSS)
- [CVE-2019-10984](https://cve.now/CVE-2019-10984.md): Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited wh (CVSS 7.8, Red Lion Controls Crimson)
- [CVE-2019-10978](https://cve.now/CVE-2019-10978.md): Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited wh (CVSS 3.3, Red Lion Controls Crimson)
- [CVE-2019-10996](https://cve.now/CVE-2019-10996.md): Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited wh (CVSS 7.8, Red Lion Controls Crimson)
- [CVE-2019-10990](https://cve.now/CVE-2019-10990.md): Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected f (CVSS 6.5, Red Lion Controls Crimson)
- [CVE-2019-12407](https://cve.now/CVE-2019-12407.md): On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, (no CVSS, Apache JSPWiki · org.apache.jspwiki:jspwiki-war +1)
- [CVE-2019-10090](https://cve.now/CVE-2019-10090.md): On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, (no CVSS, Apache JSPWiki · org.apache.jspwiki:jspwiki-war)
- [CVE-2018-21019](https://cve.now/CVE-2018-21019.md): Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's (no CVSS, homeassistant)
- [CVE-2019-16377](https://cve.now/CVE-2019-16377.md): The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control. (no CVSS, consul)
- [CVE-2019-13063](https://cve.now/CVE-2019-13063.md): Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on th (no CVSS)
- [CVE-2019-12404](https://cve.now/CVE-2019-12404.md): On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, (no CVSS, Apache JSPWiki · org.apache.jspwiki:jspwiki-war)
- [CVE-2019-10089](https://cve.now/CVE-2019-10089.md): On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, (no CVSS, Apache JSPWiki · org.apache.jspwiki:jspwiki-war)
- [CVE-2019-10087](https://cve.now/CVE-2019-10087.md): On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, (no CVSS, Apache JSPWiki · org.apache.jspwiki:jspwiki-war)
- [CVE-2019-16723](https://cve.now/CVE-2019-16723.md): In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph\_json.php request with a (no CVSS)
- [CVE-2019-16518](https://cve.now/CVE-2019-16518.md): An issue was discovered on Swell Kit Mod devices that use the Vandy Vape platform. (no CVSS)
- [CVE-2019-3416](https://cve.now/CVE-2019-3416.md): All versions up to V81511329.1008 of ZTE ZXV10 B860A products are impacted by input validation vulnerability. (CVSS 8.1, ZTE ZXV10 B860A)
- [CVE-2019-16719](https://cve.now/CVE-2019-16719.md): WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS. (no CVSS)
- [CVE-2019-16721](https://cve.now/CVE-2019-16721.md): NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user. (no CVSS)
- [CVE-2019-16722](https://cve.now/CVE-2019-16722.md): ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an str\_ireplace operatio (no CVSS)
- [CVE-2019-16720](https://cve.now/CVE-2019-16720.md): ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demons (no CVSS)
- [CVE-2019-16718](https://cve.now/CVE-2019-16718.md): In radare2 before 3.9.0, a command injection vulnerability exists in bin\_symbols() in libr/core/cbin.c. (no CVSS)
- [CVE-2019-16707](https://cve.now/CVE-2019-16707.md): Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx. (no CVSS)
- [CVE-2019-16708](https://cve.now/CVE-2019-16708.md): ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (no CVSS)
- [CVE-2019-16709](https://cve.now/CVE-2019-16709.md): ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (no CVSS)
- [CVE-2019-16710](https://cve.now/CVE-2019-16710.md): ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in MagickCore/memory.c. (no CVSS)
- [CVE-2019-16711](https://cve.now/CVE-2019-16711.md): ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (no CVSS)
- [CVE-2019-16712](https://cve.now/CVE-2019-16712.md): ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by WritePS3Image. (no CVSS)
- [CVE-2019-16713](https://cve.now/CVE-2019-16713.md): ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in MagickCore/constitute.c. (no CVSS)
- [CVE-2019-16714](https://cve.now/CVE-2019-16714.md): In the Linux kernel before 5.2.14, rds6\_inc\_info\_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack m (no CVSS)
- [CVE-2019-16706](https://cve.now/CVE-2019-16706.md): kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cms\_user\_add.php. (no CVSS)
- [CVE-2019-16705](https://cve.now/CVE-2019-16705.md): Ming (aka libming) 0.4.8 has an out of bounds read vulnerability in the function OpCode() in the decompile.c file in libutil.a. (no CVSS)
- [CVE-2019-16704](https://cve.now/CVE-2019-16704.md): admin/infoclass\_update.php in PHPMyWind 5.6 has stored XSS. (no CVSS)
- [CVE-2019-16703](https://cve.now/CVE-2019-16703.md): admin/infolist\_add.php in PHPMyWind 5.6 has stored XSS. (no CVSS)
- [CVE-2019-16702](https://cve.now/CVE-2019-16702.md): Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /Logi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-09-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.