CVEs published September 24, 2019
30 CVEs were published on September 24, 2019: 1 critical, 1 high. 1 is now in CISA KEV.
- Published
- 30
- Critical
- 1
- High
- 1
- Medium
- 3
- Low
- 0
- Unrated
- 25
- Now in CISA KEV
- 1
- Fix available
- 4
Most affected products
- IBM Security Key Lifecycle Manager
- 2
- ONTAP Select Deploy administration utility
- 2
- Dell EMC Servers: Networking and Fibre Channel Drivers:… +1
- 1
- devise_token_auth
- 1
- dompurify
- 1
- E2fsprogs
- 1
- joomla/joomla-cms
- 1
- Niagara
- 1
- Rockwell Automation Arena Simulation Software Cat. 9502-Ax,…
- 1
Critical 1
High 1
Medium, low and unrated 28
- CVE-2019-13528A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 (JACE 3e, JACE 6e, JACE 7, JACE-800Niagara
- CVE-2019-13527In Rockwell Automation Arena Simulation Software Cat.Rockwell Automation Arena Simulation Software Cat. 9502-Ax,…
- CVE-2019-16724File Sharing Wizard 1.5.0 allows a remote attacker to obtain arbitrary code execution by exploiting a Structured Exception Handler (SEH) bas
- CVE-2019-14220An issue was discovered in BlueStacks 4.110 and below on macOS and on 4.120 and below on Windows.
- CVE-2019-16725In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates.joomla/joomla-cms
- CVE-2019-12068In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), w
- CVE-2019-5505ONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in plaintext.ONTAP Select Deploy administration utility
- CVE-2019-5504ONTAP Select Deploy administration utility versions 2.12 & 2.12.1 ship with an HTTP service bound to the network allowing unauthenticated reONTAP Select Deploy administration utility
- CVE-2019-16410An issue was discovered in Suricata 4.1.4.
- CVE-2019-16411An issue was discovered in Suricata 4.1.4.
- CVE-2019-15699An issue was discovered in app-layer-ssl.c in Suricata 4.1.4.
- CVE-2019-14239On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only ac
- CVE-2019-14238On STMicroelectronics STM32F7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated with a
- CVE-2019-16754RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation (asymcute), potentially allowing an attacker to crash a netwo
- CVE-2019-16751An issue was discovered in Devise Token Auth through 1.1.2.devise_token_auth
- CVE-2019-14753SICK FX0-GPNT00000 and FX0-GENT00000 devices through 3.4.0 have a Buffer Overflow
- CVE-2019-3726An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versions prior to 19.1.0.Dell EMC Servers: Networking and Fibre Channel Drivers:… +1
- CVE-2019-16383MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthentic
- CVE-2019-13355In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\ used by ccschedu
- CVE-2019-13356In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\bd\TDUpdate2\ use
- CVE-2019-13357In Total Defense Anti-virus 9.0.0.773, resource acquisition from the untrusted search path C:\ used by caschelp.exe allows local attackers t
- CVE-2019-4566IBM Security Key Lifecycle Manager 3.0 and 3.0.1 stores user credentials in plain in clear text which can be read by a local user.IBM Security Key Lifecycle Manager
- CVE-2019-4515IBM Security Key Lifecycle Manager 3.0 and 3.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute maliciIBM Security Key Lifecycle Manager
- CVE-2018-9090CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials (admin/admin) for the
- CVE-2019-16748In wolfSSL through 4.1.0, there is a missing sanity check of memory accesses in parsing ASN.1 certificate data while handshaking.
- CVE-2019-16746An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17.
- CVE-2019-16729pam-python before 1.0.7-1 has an issue in regard to the default environment variable handling of Python, which could allow for local root es
- CVE-2019-16728DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome adompurify