# CVEs published 2019-09-24 30 CVEs were published on September 24, 2019: 1 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2019-13528](https://cve.now/CVE-2019-13528.md): A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 (JACE 3e, JACE 6e, JACE 7, JACE-800 (no CVSS, Niagara) - [CVE-2019-5094](https://cve.now/CVE-2019-5094.md): An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. (CVSS 7.5, E2fsprogs) - [CVE-2019-13527](https://cve.now/CVE-2019-13527.md): In Rockwell Automation Arena Simulation Software Cat. (no CVSS, Rockwell Automation Arena Simulation Software Cat. 9502-Ax,…) - [CVE-2019-16759](https://cve.now/CVE-2019-16759.md): vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig\[code\] parameter in an ajax/render/widget\_php routestring re (CVSS 9.8, KEV) - [CVE-2019-16724](https://cve.now/CVE-2019-16724.md): File Sharing Wizard 1.5.0 allows a remote attacker to obtain arbitrary code execution by exploiting a Structured Exception Handler (SEH) bas (no CVSS) - [CVE-2019-14220](https://cve.now/CVE-2019-14220.md): An issue was discovered in BlueStacks 4.110 and below on macOS and on 4.120 and below on Windows. (no CVSS) - [CVE-2019-16725](https://cve.now/CVE-2019-16725.md): In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates. (no CVSS, joomla/joomla-cms) - [CVE-2019-12068](https://cve.now/CVE-2019-12068.md): In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), w (no CVSS) - [CVE-2019-5505](https://cve.now/CVE-2019-5505.md): ONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in plaintext. (no CVSS, ONTAP Select Deploy administration utility) - [CVE-2019-5504](https://cve.now/CVE-2019-5504.md): ONTAP Select Deploy administration utility versions 2.12 & 2.12.1 ship with an HTTP service bound to the network allowing unauthenticated re (no CVSS, ONTAP Select Deploy administration utility) - [CVE-2019-16410](https://cve.now/CVE-2019-16410.md): An issue was discovered in Suricata 4.1.4. (no CVSS) - [CVE-2019-16411](https://cve.now/CVE-2019-16411.md): An issue was discovered in Suricata 4.1.4. (no CVSS) - [CVE-2019-15699](https://cve.now/CVE-2019-15699.md): An issue was discovered in app-layer-ssl.c in Suricata 4.1.4. (no CVSS) - [CVE-2019-14239](https://cve.now/CVE-2019-14239.md): On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only ac (no CVSS) - [CVE-2019-14238](https://cve.now/CVE-2019-14238.md): On STMicroelectronics STM32F7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated with a (no CVSS) - [CVE-2019-16754](https://cve.now/CVE-2019-16754.md): RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation (asymcute), potentially allowing an attacker to crash a netwo (no CVSS) - [CVE-2019-16751](https://cve.now/CVE-2019-16751.md): An issue was discovered in Devise Token Auth through 1.1.2. (no CVSS, devise\_token\_auth) - [CVE-2019-14753](https://cve.now/CVE-2019-14753.md): SICK FX0-GPNT00000 and FX0-GENT00000 devices through 3.4.0 have a Buffer Overflow (no CVSS) - [CVE-2019-3726](https://cve.now/CVE-2019-3726.md): An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versions prior to 19.1.0. (CVSS 6.7, Dell EMC Servers: Networking and Fibre Channel Drivers:… +1) - [CVE-2019-16383](https://cve.now/CVE-2019-16383.md): MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthentic (no CVSS) - [CVE-2019-13355](https://cve.now/CVE-2019-13355.md): In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\\TotalDefense\\Consumer\\ISS\\9\\ used by ccschedu (no CVSS) - [CVE-2019-13356](https://cve.now/CVE-2019-13356.md): In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\\TotalDefense\\Consumer\\ISS\\9\\bd\\TDUpdate2\\ use (no CVSS) - [CVE-2019-13357](https://cve.now/CVE-2019-13357.md): In Total Defense Anti-virus 9.0.0.773, resource acquisition from the untrusted search path C:\\ used by caschelp.exe allows local attackers t (no CVSS) - [CVE-2019-4566](https://cve.now/CVE-2019-4566.md): IBM Security Key Lifecycle Manager 3.0 and 3.0.1 stores user credentials in plain in clear text which can be read by a local user. (CVSS 6.2, IBM Security Key Lifecycle Manager) - [CVE-2019-4515](https://cve.now/CVE-2019-4515.md): IBM Security Key Lifecycle Manager 3.0 and 3.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malici (CVSS 4.3, IBM Security Key Lifecycle Manager) - [CVE-2018-9090](https://cve.now/CVE-2018-9090.md): CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials (admin/admin) for the (no CVSS) - [CVE-2019-16748](https://cve.now/CVE-2019-16748.md): In wolfSSL through 4.1.0, there is a missing sanity check of memory accesses in parsing ASN.1 certificate data while handshaking. (no CVSS) - [CVE-2019-16746](https://cve.now/CVE-2019-16746.md): An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. (no CVSS) - [CVE-2019-16729](https://cve.now/CVE-2019-16729.md): pam-python before 1.0.7-1 has an issue in regard to the default environment variable handling of Python, which could allow for local root es (no CVSS) - [CVE-2019-16728](https://cve.now/CVE-2019-16728.md): DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome a (no CVSS, dompurify) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-09-24 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.