# CVEs published 2019-09-25

102 CVEs were published on September 25, 2019: 1 critical, 11 high. Days are UTC.

- [CVE-2015-9418](https://cve.now/CVE-2015-9418.md): The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes. (no CVSS)
- [CVE-2015-9417](https://cve.now/CVE-2015-9417.md): The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS. (no CVSS)
- [CVE-2015-9416](https://cve.now/CVE-2015-9416.md): The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header. (no CVSS)
- [CVE-2015-9415](https://cve.now/CVE-2015-9415.md): The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion. (no CVSS)
- [CVE-2015-9414](https://cve.now/CVE-2015-9414.md): The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get\_album\_item.php?size parameter. (no CVSS)
- [CVE-2015-9413](https://cve.now/CVE-2015-9413.md): The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title paramete (no CVSS)
- [CVE-2015-9412](https://cve.now/CVE-2015-9412.md): The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter. (no CVSS)
- [CVE-2015-9411](https://cve.now/CVE-2015-9411.md): The Postmatic plugin before 1.4.6 for WordPress has XSS. (no CVSS)
- [CVE-2015-9410](https://cve.now/CVE-2015-9410.md): The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter. (no CVSS)
- [CVE-2017-18635](https://cve.now/CVE-2017-18635.md): An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page (no CVSS, @novnc/novnc)
- [CVE-2019-16253](https://cve.now/CVE-2019-16253.md): The Text-to-speech Engine (aka SamsungTTS) application before 3.0.02.7 and 3.0.00.101 for Android allows a local attacker to escalate privil (no CVSS)
- [CVE-2019-16890](https://cve.now/CVE-2019-16890.md): Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments. (no CVSS)
- [CVE-2019-12717](https://cve.now/CVE-2019-12717.md): Cisco NX-OS Software Virtualization Manager Command Injection Vulnerability (CVSS 6.7, Cisco NX-OS Software 5.0(3)A1)
- [CVE-2019-12672](https://cve.now/CVE-2019-12672.md): Cisco IOS XE Software Arbitrary Code Execution Vulnerability (CVSS 6.2, Cisco IOS XE Software)
- [CVE-2019-12670](https://cve.now/CVE-2019-12670.md): Cisco IOS XE Software IOx Guest Shell Namespace Protection Vulnerability (CVSS 6.7, Cisco IOS XE Software 3.2.11aSG)
- [CVE-2019-12668](https://cve.now/CVE-2019-12668.md): Cisco IOS and IOS XE Software Stored Banner Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco IOS XE Software)
- [CVE-2019-12666](https://cve.now/CVE-2019-12666.md): Cisco IOS XE Software Path Traversal Vulnerability (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2019-12664](https://cve.now/CVE-2019-12664.md): Cisco IOS XE Software ISDN Data Leak Vulnerability (CVSS 4.7, Cisco IOS XE Software)
- [CVE-2019-12662](https://cve.now/CVE-2019-12662.md): Cisco NX-OS and IOS XE Software Virtual Service Image Signature Bypass Vulnerability (CVSS 6.7, Cisco NX-OS Software 6.0(2)A1)
- [CVE-2019-12660](https://cve.now/CVE-2019-12660.md): Cisco IOS XE Software ASIC Register Write Vulnerability (CVSS 5.5, Cisco IOS XE Software 3.2.11aSG)
- [CVE-2019-12658](https://cve.now/CVE-2019-12658.md): Cisco IOS XE Software Filesystem Exhaustion Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2019-12656](https://cve.now/CVE-2019-12656.md): Cisco IOx Application Environment Denial of Service Vulnerability (CVSS 7.5, Cisco Industrial Routers Operating System Software)
- [CVE-2019-12654](https://cve.now/CVE-2019-12654.md): Cisco IOS and IOS XE Software Session Initiation Protocol Denial of Service Vulnerability (CVSS 8.6, Cisco IOS 15.0(1)XA2)
- [CVE-2019-12652](https://cve.now/CVE-2019-12652.md): Cisco Catalyst 4000 Series Switches TCP Denial of Service Vulnerability (CVSS 8.6, Cisco IOS 15.0(1)XO1)
- [CVE-2019-12709](https://cve.now/CVE-2019-12709.md): Cisco IOS XR Software for Cisco ASR 9000 VMAN CLI Privilege Escalation Vulnerability (CVSS 6.7, Cisco IOS XR Software)
- [CVE-2019-12671](https://cve.now/CVE-2019-12671.md): Cisco IOS XE Software Consent Token Bypass Vulnerability (CVSS 6.7, Cisco IOS XE Software 3.2.9SG)
- [CVE-2019-12669](https://cve.now/CVE-2019-12669.md): Cisco IOS and IOS XE Software Change of Authorization Denial of Service Vulnerability (CVSS 6.8, Cisco IOS XE Software 3.2.9SG)
- [CVE-2019-12667](https://cve.now/CVE-2019-12667.md): Cisco IOS XE Software Stored Cross-Site Scripting Vulnerability (CVSS 5.5, Cisco IOS XE Software)
- [CVE-2019-12665](https://cve.now/CVE-2019-12665.md): Cisco IOS and IOS XE Software HTTP Client Information Disclosure Vulnerability (CVSS 4.8, Cisco IOS 12.2(15)B)
- [CVE-2019-12663](https://cve.now/CVE-2019-12663.md): Cisco IOS XE Software TrustSec Protected Access Credential Provisioning Denial of Service Vulnerability (CVSS 6.8, Cisco IOS XE Software)
- [CVE-2019-12661](https://cve.now/CVE-2019-12661.md): Cisco IOS XE Software Virtualization Manager CLI Command Injection Vulnerability (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2019-12659](https://cve.now/CVE-2019-12659.md): Cisco IOS XE Software HTTP Server Denial of Service Vulnerability (CVSS 5.3, Cisco IOS XE Software 3.2.0JA)
- [CVE-2019-12657](https://cve.now/CVE-2019-12657.md): Cisco IOS XE Software Unified Threat Defense Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2019-12655](https://cve.now/CVE-2019-12655.md): Cisco IOS XE Software FTP Application Layer Gateway for NAT, NAT64, and ZBFW Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2019-12653](https://cve.now/CVE-2019-12653.md): Cisco IOS XE Software Raw Socket Transport Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2019-12651](https://cve.now/CVE-2019-12651.md): Cisco IOS XE Software Web UI Command Injection Vulnerabilities (CVSS 7.6, Cisco IOS XE Software 3.2.11aSG)
- [CVE-2019-12647](https://cve.now/CVE-2019-12647.md): Cisco IOS and IOS XE Software IP Ident Denial of Service Vulnerability (CVSS 8.6, Cisco IOS)
- [CVE-2019-4571](https://cve.now/CVE-2019-4571.md): IBM Content Navigator 3.0CD is vulnerable to cross-site scripting. (CVSS 5.4, IBM Content Navigator)
- [CVE-2019-12648](https://cve.now/CVE-2019-12648.md): Cisco IOx for IOS Software Guest Operating System Unauthorized Access Vulnerability (CVSS 9.9, Cisco IOS 15.7(3)M)
- [CVE-2019-12649](https://cve.now/CVE-2019-12649.md): Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability (CVSS 6.7, Cisco IOS XE Software 3.2.11aSG)
- [CVE-2019-12650](https://cve.now/CVE-2019-12650.md): Cisco IOS XE Software Web UI Command Injection Vulnerabilities (CVSS 7.6, Cisco IOS XE Software 3.2.11aSG)
- [CVE-2019-12646](https://cve.now/CVE-2019-12646.md): Cisco IOS XE Software NAT Session Initiation Protocol Application Layer Gateway Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2019-16889](https://cve.now/CVE-2019-16889.md): Ubiquiti EdgeMAX devices before 2.0.3 allow remote attackers to cause a denial of service (disk consumption) because \*.cache files in /var/r (no CVSS)
- [CVE-2019-15941](https://cve.now/CVE-2019-15941.md): OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect a (no CVSS)
- [CVE-2019-14666](https://cve.now/CVE-2019-14666.md): GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. (no CVSS)
- [CVE-2019-6656](https://cve.now/CVE-2019-6656.md): BIG-IP APM Edge Client before version 7.1.8 (7180.2019.508.705) logs the full apm session ID in the log files. (no CVSS, BIG-IP APM Edge Client)
- [CVE-2019-6655](https://cve.now/CVE-2019-6655.md): On versions 13.0.0-13.1.0.1, 12.1.0-12.1.4.1, 11.6.1-11.6.4, and 11.5.1-11.5.9, BIG-IP platforms where AVR, ASM, APM, PEM, AFM, and/or AAM i (no CVSS, BIG-IP AVR, ASM, APM, PEM, AFM, and/or AAM)
- [CVE-2019-6654](https://cve.now/CVE-2019-6654.md): On versions 14.0.0-14.1.2, 13.0.0-13.1.3, 12.1.0-12.1.5, and 11.5.1-11.6.5, the BIG-IP system fails to perform Martian Address Filtering (As (no CVSS, BIG-IP)
- [CVE-2019-12205](https://cve.now/CVE-2019-12205.md): SilverStripe through 4.3.3 has Flash Clipboard Reflected XSS. (no CVSS, silverstripe/framework · silverstripe/admin)
- [CVE-2019-12203](https://cve.now/CVE-2019-12203.md): SilverStripe through 4.3.3 allows session fixation in the "change password" form. (no CVSS, silverstripe/framework)
- [CVE-2019-12245](https://cve.now/CVE-2019-12245.md): SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). (no CVSS, silverstripe/framework · silverstripe/assets)
- [CVE-2019-12204](https://cve.now/CVE-2019-12204.md): In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access. (no CVSS, silverstripe/cms · silverstripe/framework)
- [CVE-2019-15069](https://cve.now/CVE-2019-15069.md): An unsafe authentication interface was discovered in Smart Battery A4 (no CVSS, Gigastone Smart Battery A4)
- [CVE-2019-15068](https://cve.now/CVE-2019-15068.md): A broken access control vulnerability discovered in Smart Battery A4 (no CVSS, Gigastone Smart Battery A4)
- [CVE-2019-15067](https://cve.now/CVE-2019-15067.md): An authentication bypass vulnerability discovered in Smart Battery A2-25DE (no CVSS, Gigastone Smart Battery A2-25DE)
- [CVE-2019-6653](https://cve.now/CVE-2019-6653.md): There is a Stored Cross Site Scripting vulnerability in the undisclosed page of a BIG-IQ 6.0.0-6.1.0 or 5.2.0-5.4.0 system. (no CVSS, BIG-IQ)
- [CVE-2019-6652](https://cve.now/CVE-2019-6652.md): In BIG-IQ 6.0.0-6.1.0, services for stats do not require authentication nor do they implement any form of Transport Layer Security (TLS). (no CVSS, BIG-IQ)
- [CVE-2019-16887](https://cve.now/CVE-2019-16887.md): In IrfanView 4.53, Data from a Faulting Address controls a subsequent Write Address starting at image00400000+0x000000000001dcfc. (no CVSS)
- [CVE-2019-6651](https://cve.now/CVE-2019-6651.md): In BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.5.1-11.6.4, BIG-IQ 7.0.0, 6.0.0-6.1.0,5.2.0-5.4.0, (no CVSS, BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager)
- [CVE-2015-9409](https://cve.now/CVE-2015-9409.md): The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php. (no CVSS)
- [CVE-2019-16882](https://cve.now/CVE-2019-16882.md): An issue was discovered in the string-interner crate before 0.7.1 for Rust. (no CVSS, string-interner)
- [CVE-2019-16881](https://cve.now/CVE-2019-16881.md): An issue was discovered in the portaudio-rs crate through 0.3.1 for Rust. (no CVSS, portaudio-rs)
- [CVE-2019-10098](https://cve.now/CVE-2019-10098.md): In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod\_rewrite that were intended to be self-referential might be fooled by en (no CVSS, Apache HTTP Server)
- [CVE-2019-16880](https://cve.now/CVE-2019-16880.md): An issue was discovered in the linea crate through 0.9.4 for Rust. (no CVSS, linea)
- [CVE-2019-16188](https://cve.now/CVE-2019-16188.md): HCL AppScan Source before 9.03.13 is susceptible to XML External Entity (XXE) attacks in multiple locations. (no CVSS)
- [CVE-2019-16701](https://cve.now/CVE-2019-16701.md): pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec\_php call containing sh (no CVSS)
- [CVE-2019-16194](https://cve.now/CVE-2019-16194.md): SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc\_id parameter in include/monitoring/status/Services/xml/mak (no CVSS, centreon/centreon)
- [CVE-2019-10424](https://cve.now/CVE-2019-10424.md): Jenkins elOyente Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by us (no CVSS, Jenkins project Jenkins elOyente Plugin · com.technicolor:e…)
- [CVE-2019-10425](https://cve.now/CVE-2019-10425.md): Jenkins Google Calendar Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by user (no CVSS, Jenkins project Jenkins Google Calendar Plugin · org.jenkin…)
- [CVE-2019-10426](https://cve.now/CVE-2019-10426.md): Jenkins Gem Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed (no CVSS, Jenkins project Jenkins Gem Publisher Plugin · net.arangama…)
- [CVE-2019-10427](https://cve.now/CVE-2019-10427.md): Jenkins Aqua MicroScanner Plugin 1.0.7 and earlier transmitted configured credentials in plain text as part of the global Jenkins configurat (no CVSS, Jenkins project Jenkins Aqua MicroScanner Plugin · org.jenk…)
- [CVE-2019-10428](https://cve.now/CVE-2019-10428.md): Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins confi (no CVSS, Jenkins project Jenkins Aqua Security Scanner Plugin · org.…)
- [CVE-2019-10429](https://cve.now/CVE-2019-10429.md): Jenkins GitLab Logo Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by (no CVSS, Jenkins project Jenkins GitLab Logo Plugin · org.jenkins-ci…)
- [CVE-2019-10430](https://cve.now/CVE-2019-10430.md): Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkin (no CVSS, Jenkins project Jenkins NeuVector Vulnerability Scanner Plu…)
- [CVE-2019-10412](https://cve.now/CVE-2019-10412.md): Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration for (no CVSS, Jenkins project Jenkins Inedo ProGet Plugin · com.inedo.pro…)
- [CVE-2019-10413](https://cve.now/CVE-2019-10413.md): Jenkins Data Theorem: CI/CD Plugin 1.3 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they c (no CVSS, Jenkins project Jenkins Data Theorem: CI/CD Plugin · com.da…)
- [CVE-2019-10414](https://cve.now/CVE-2019-10414.md): Jenkins Git Changelog Plugin 2.17 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could (no CVSS, Jenkins project Jenkins Git Changelog Plugin · de.wellnerbo…)
- [CVE-2019-10415](https://cve.now/CVE-2019-10415.md): Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins (no CVSS, Jenkins project Jenkins Violation Comments to GitLab Plugin…)
- [CVE-2019-10416](https://cve.now/CVE-2019-10416.md): Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master wh (no CVSS, Jenkins project Jenkins Violation Comments to GitLab Plugin…)
- [CVE-2019-10417](https://cve.now/CVE-2019-10417.md): Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke a (no CVSS, Jenkins project Jenkins Kubernetes :: Pipeline :: Kubernete…)
- [CVE-2019-10418](https://cve.now/CVE-2019-10418.md): Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke a (no CVSS, Jenkins project Jenkins Kubernetes :: Pipeline :: Arquillia…)
- [CVE-2019-10419](https://cve.now/CVE-2019-10419.md): Jenkins vFabric Application Director Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they (no CVSS, Jenkins project Jenkins vFabric Application Director Plugin…)
- [CVE-2019-10420](https://cve.now/CVE-2019-10420.md): Jenkins Assembla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by us (no CVSS, Jenkins project Jenkins Assembla Plugin · org.jenkins-ci.pl…)
- [CVE-2019-10421](https://cve.now/CVE-2019-10421.md): Jenkins Azure Event Grid Build Notifier Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can b (no CVSS, Jenkins project Jenkins Azure Event Grid Build Notifier Plu…)
- [CVE-2019-10422](https://cve.now/CVE-2019-10422.md): Jenkins Call Remote Job Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by user (no CVSS, Jenkins project Jenkins Call Remote Job Plugin · org.ukiuni…)
- [CVE-2019-10423](https://cve.now/CVE-2019-10423.md): Jenkins CodeScan Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by us (no CVSS, Jenkins project Jenkins CodeScan Plugin · com.villagechief.…)
- [CVE-2019-10401](https://cve.now/CVE-2019-10401.md): In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, r (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2019-10402](https://cve.now/CVE-2019-10402.md): In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a store (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2019-10403](https://cve.now/CVE-2019-10403.md): Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2019-10404](https://cve.now/CVE-2019-10404.md): Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a stored (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2019-10405](https://cve.now/CVE-2019-10405.md): Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attac (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2019-10406](https://cve.now/CVE-2019-10406.md): Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulti (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2019-10407](https://cve.now/CVE-2019-10407.md): Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive v (no CVSS, Jenkins Project Inheritance Plugin · hudson.plugins:project…)
- [CVE-2019-10408](https://cve.now/CVE-2019-10408.md): A cross-site request forgery vulnerability in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers to trigger project gene (no CVSS, Jenkins Project Inheritance Plugin · hudson.plugins:project…)
- [CVE-2019-10409](https://cve.now/CVE-2019-10409.md): A missing permission check in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers with Overall/Read permission to trigger (no CVSS, Jenkins Project Inheritance Plugin · hudson.plugins:project…)
- [CVE-2019-10410](https://cve.now/CVE-2019-10410.md): Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message, resulting in a cross-site scripting vulnerability exploitable by (no CVSS, Jenkins project Jenkins Log Parser Plugin · org.jenkins-ci.…)
- [CVE-2019-10411](https://cve.now/CVE-2019-10411.md): Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configurat (no CVSS, Jenkins project Jenkins Inedo BuildMaster Plugin · com.ined…)
- [CVE-2019-13627](https://cve.now/CVE-2019-13627.md): It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. (no CVSS)
- [CVE-2019-16868](https://cve.now/CVE-2019-16868.md): emlog through 6.0.0beta has an arbitrary file deletion vulnerability via an admin/data.php?action=dell\_all\_bak request with directory traver (no CVSS)
- [CVE-2019-16867](https://cve.now/CVE-2019-16867.md): HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue (no CVSS)
- [CVE-2019-16884](https://cve.now/CVE-2019-16884.md): runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/roo (no CVSS, github.com/opencontainers/runc · github.com/opencontainers/…)
- [CVE-2019-16892](https://cve.now/CVE-2019-16892.md): In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be (no CVSS, rubyzip)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-09-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.