# CVEs published 2019-09-26

68 CVEs were published on September 26, 2019: 0 critical, 4 high. Days are UTC.

- [CVE-2019-11279](https://cve.now/CVE-2019-11279.md): Privilege Escalation via Scope Manipulation in UAA (CVSS 8.7, Cloud Foundry UAA Release)
- [CVE-2019-11278](https://cve.now/CVE-2019-11278.md): Privilege Escalation via Blind SCIM Injection in UAA (CVSS 8.7, Cloud Foundry UAA Release)
- [CVE-2019-15891](https://cve.now/CVE-2019-15891.md): An issue was discovered in CKFinder through 2.6.2.1 and 3.x through 3.5.0. (no CVSS)
- [CVE-2019-15862](https://cve.now/CVE-2019-15862.md): An issue was discovered in CKFinder through 2.6.2.1. (no CVSS)
- [CVE-2019-12562](https://cve.now/CVE-2019-12562.md): Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into th (no CVSS, DotNetNuke.Core)
- [CVE-2019-16667](https://cve.now/CVE-2019-16667.md): diag\_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. (no CVSS)
- [CVE-2019-16914](https://cve.now/CVE-2019-16914.md): An XSS issue was discovered in pfSense through 2.4.4-p3. (no CVSS)
- [CVE-2019-16915](https://cve.now/CVE-2019-16915.md): An issue was discovered in pfSense through 2.4.4-p3. (no CVSS)
- [CVE-2019-0203](https://cve.now/CVE-2019-0203.md): In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends (no CVSS, Apache Subversion)
- [CVE-2018-11782](https://cve.now/CVE-2018-11782.md): In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed r (no CVSS, Apache Subversion)
- [CVE-2019-16524](https://cve.now/CVE-2019-16524.md): The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfan (no CVSS)
- [CVE-2019-16869](https://cve.now/CVE-2019-16869.md): Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads (no CVSS, io.netty:netty-all · org.jboss.netty:netty +1)
- [CVE-2019-16755](https://cve.now/CVE-2019-16755.md): BMC Remedy ITSM Suite is prone to unspecified vulnerabilities in both DWP and SmartIT components, which can permit remote attackers to perfo (no CVSS)
- [CVE-2019-6161](https://cve.now/CVE-2019-6161.md): An internal product security audit discovered a session handling vulnerability in the web interface of ThinkAgile CP-SB (Storage Block) BMC (no CVSS, Lenovo ThinkAgile CP-SB)
- [CVE-2019-6175](https://cve.now/CVE-2019-6175.md): System Update Vulnerability (no CVSS, Lenovo System Update)
- [CVE-2019-12091](https://cve.now/CVE-2019-12091.md): Netskope client command injections vulnerability (CVSS 7.8, Netskope client)
- [CVE-2019-10882](https://cve.now/CVE-2019-10882.md): Netskope client buffer overflow vulnerability (CVSS 5.5, Netskope client)
- [CVE-2019-4378](https://cve.now/CVE-2019-4378.md): IBM MQ 7.5.0.0 - 7.5.0.9, 7.1.0.0 - 7.1.0.9, 8.0.0.0 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 command server is v (CVSS 5.3, IBM MQ)
- [CVE-2019-4262](https://cve.now/CVE-2019-4262.md): IBM QRadar SIEM 7.2 and 7.3 is vulnerable to Server Side Request Forgery (SSRF). (CVSS 5.3, IBM QRadar SIEM)
- [CVE-2019-10082](https://cve.now/CVE-2019-10082.md): In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, (no CVSS, Apache HTTP Server)
- [CVE-2019-16409](https://cve.now/CVE-2019-16409.md): In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess (no CVSS, symbiote/silverstripe-versionedfiles · silverstripe/framewo…)
- [CVE-2019-16894](https://cve.now/CVE-2019-16894.md): download.php in inoERP 4.15 allows SQL injection through insecure deserialization. (no CVSS)
- [CVE-2019-16532](https://cve.now/CVE-2019-16532.md): An HTTP Host header injection vulnerability exists in YzmCMS V5.3. (no CVSS)
- [CVE-2019-13523](https://cve.now/CVE-2019-13523.md): In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to (no CVSS, Honeywell Performance IP Cameras · Honeywell Performance NV…)
- [CVE-2019-10097](https://cve.now/CVE-2019-10097.md): In Apache HTTP Server 2.4.32-2.4.39, when mod\_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, (no CVSS, Apache HTTP Server)
- [CVE-2019-10092](https://cve.now/CVE-2019-10092.md): In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod\_proxy error page. (no CVSS, Apache HTTP Server)
- [CVE-2019-12617](https://cve.now/CVE-2019-12617.md): In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution. (no CVSS, silverstripe/framework)
- [CVE-2019-14272](https://cve.now/CVE-2019-14272.md): In SilverStripe asset-admin 4.0, there is XSS in file titles managed through the CMS. (no CVSS, silverstripe/framework)
- [CVE-2019-14844](https://cve.now/CVE-2019-14844.md): A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending o (CVSS 7.5, MIT krb5)
- [CVE-2019-14273](https://cve.now/CVE-2019-14273.md): In SilverStripe assets 4.0, there is broken access control on files. (no CVSS, silverstripe/framework)
- [CVE-2019-16904](https://cve.now/CVE-2019-16904.md): TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an admi (no CVSS, nilsteampassnet/teampass)
- [CVE-2019-16903](https://cve.now/CVE-2019-16903.md): Platinum UPnP SDK 1.2.0 allows Directory Traversal in Core/PltHttpServer.cpp because it checks for /.. (no CVSS)
- [CVE-2015-9441](https://cve.now/CVE-2015-9441.md): The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php. (no CVSS)
- [CVE-2015-9442](https://cve.now/CVE-2015-9442.md): The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir\_plugin. (no CVSS)
- [CVE-2015-9443](https://cve.now/CVE-2015-9443.md): The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page= (no CVSS)
- [CVE-2015-9444](https://cve.now/CVE-2015-9444.md): The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ P (no CVSS)
- [CVE-2015-9445](https://cve.now/CVE-2015-9445.md): The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery\_ajax\_action (no CVSS)
- [CVE-2015-9446](https://cve.now/CVE-2015-9446.md): The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data\[galleryID\] to wp-admin/admin-ajax.php. (no CVSS)
- [CVE-2015-9447](https://cve.now/CVE-2015-9447.md): The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters. (no CVSS)
- [CVE-2015-9448](https://cve.now/CVE-2015-9448.md): The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter. (no CVSS)
- [CVE-2015-9440](https://cve.now/CVE-2015-9440.md): The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new. (no CVSS)
- [CVE-2015-9439](https://cve.now/CVE-2015-9439.md): The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis\_social\_widget p (no CVSS)
- [CVE-2019-16738](https://cve.now/CVE-2019-16738.md): In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup. (no CVSS, mediawiki/core)
- [CVE-2015-9438](https://cve.now/CVE-2015-9438.md): The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw\_show\_widget id\_base, widget\_number, o (no CVSS)
- [CVE-2015-9437](https://cve.now/CVE-2015-9437.md): The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page\_limit (no CVSS)
- [CVE-2015-9436](https://cve.now/CVE-2015-9436.md): The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term\_tree prefix or widget\_id paramete (no CVSS)
- [CVE-2015-9435](https://cve.now/CVE-2015-9435.md): The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers. (no CVSS)
- [CVE-2015-9434](https://cve.now/CVE-2015-9434.md): The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post\_type=kwlogos&page=kwlogo (no CVSS)
- [CVE-2015-9433](https://cve.now/CVE-2015-9433.md): The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twit (no CVSS)
- [CVE-2015-9432](https://cve.now/CVE-2015-9432.md): The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?pag (no CVSS)
- [CVE-2015-9431](https://cve.now/CVE-2015-9431.md): The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json\_c (no CVSS)
- [CVE-2019-16899](https://cve.now/CVE-2019-16899.md): In Advantech WebAccess/HMI Designer 2.1.9.31, Data from a Faulting Address controls Code Flow starting at PM\_V3!CTagInfoThreadBase::GetNICIn (no CVSS)
- [CVE-2019-16900](https://cve.now/CVE-2019-16900.md): Advantech WebAccess/HMI Designer 2.1.9.31 has a User Mode Write AV starting at MSVCR90!memcpy+0x000000000000015c. (no CVSS)
- [CVE-2019-16901](https://cve.now/CVE-2019-16901.md): Advantech WebAccess/HMI Designer 2.1.9.31 has Exception Handler Chain corruption starting at Unknown Symbol @ 0x0000000000000000 called from (no CVSS)
- [CVE-2015-9449](https://cve.now/CVE-2015-9449.md): The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php accou (no CVSS)
- [CVE-2015-9430](https://cve.now/CVE-2015-9430.md): The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header. (no CVSS)
- [CVE-2015-9429](https://cve.now/CVE-2015-9429.md): The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mo (no CVSS)
- [CVE-2015-9428](https://cve.now/CVE-2015-9428.md): The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-busi (no CVSS)
- [CVE-2015-9427](https://cve.now/CVE-2015-9427.md): The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID o (no CVSS)
- [CVE-2015-9426](https://cve.now/CVE-2015-9426.md): The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic\_editor\_window (no CVSS)
- [CVE-2015-9425](https://cve.now/CVE-2015-9425.md): The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post\_type=opanda-item&page=license (no CVSS)
- [CVE-2015-9424](https://cve.now/CVE-2015-9424.md): The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.ph (no CVSS)
- [CVE-2015-9423](https://cve.now/CVE-2015-9423.md): The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple\_fields\_field\_type\_post\_dia (no CVSS)
- [CVE-2015-9422](https://cve.now/CVE-2015-9422.md): The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple\_fields (no CVSS)
- [CVE-2015-9421](https://cve.now/CVE-2015-9421.md): The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc\_popup id (no CVSS)
- [CVE-2015-9420](https://cve.now/CVE-2015-9420.md): The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get\_soundcloud\_player id parameter. (no CVSS)
- [CVE-2015-9419](https://cve.now/CVE-2015-9419.md): The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section. (no CVSS)
- [CVE-2019-16910](https://cve.now/CVE-2019-16910.md): Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for b (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-09-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.