# CVEs published 2019-09-30

62 CVEs were published on September 30, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2019-3733](https://cve.now/CVE-2019-3733.md): RSA BSAFE Crypto-C Micro Edition, all versions prior to 4.1.4, is vulnerable to three (3) different Improper Clearing of Heap Memory Before (CVSS 4.4, Dell RSA BSAFE Crypto-C Micro Edition · Dell RSA BSAFE MES)
- [CVE-2019-3732](https://cve.now/CVE-2019-3732.md): RSA BSAFE Crypto-C Micro Edition, versions prior to 4.0.5.3 (in 4.0.x) and versions prior to 4.1.3.3 (in 4.1.x), and RSA Micro Edition Suite (CVSS 5.9, Dell RSA BSAFE Crypto-C Micro Edition · Dell RSA BSAFE MES)
- [CVE-2019-3731](https://cve.now/CVE-2019-3731.md): RSA BSAFE Crypto-C Micro Edition versions prior to 4.1.4 and RSA Micro Edition Suite versions prior to 4.4 are vulnerable to an Information (CVSS 5.9, Dell RSA BSAFE Crypto-C Micro Edition · Dell RSA BSAFE MES)
- [CVE-2019-3730](https://cve.now/CVE-2019-3730.md): RSA BSAFE Micro Edition Suite versions prior to 4.1.6.3 (in 4.1.x) and prior to 4.4 (in 4.2.x and 4.3.x), are vulnerable to an Information E (CVSS 5.9, Dell RSA BSAFE MES)
- [CVE-2019-3729](https://cve.now/CVE-2019-3729.md): RSA BSAFE Micro Edition Suite versions prior to 4.4 (in 4.0.x, 4.1.x, 4.2.x and 4.3.x) are vulnerable to a Heap-based Buffer Overflow vulner (CVSS 2.4, Dell RSA BSAFE MES)
- [CVE-2019-3728](https://cve.now/CVE-2019-3728.md): RSA BSAFE Crypto-C Micro Edition versions from 4.0.0.0 before 4.0.5.4 and from 4.1.0 before 4.1.4, RSA BSAFE Micro Edition Suite versions fr (CVSS 7.5, Dell RSA BSAFE Crypto-C Micro Edition · Dell RSA BSAFE M… +1)
- [CVE-2019-16760](https://cve.now/CVE-2019-16760.md): Cargo prior to Rust 1.26.0 may download the wrong dependency (CVSS 4.6, rust cargo · cargo)
- [CVE-2019-13124](https://cve.now/CVE-2019-13124.md): Foxit Reader 9.6.0.25114 and earlier has two unique RecursiveCall bugs involving 3 functions exhausting available stack memory because of Un (no CVSS)
- [CVE-2019-13123](https://cve.now/CVE-2019-13123.md): Foxit Reader 9.6.0.25114 and earlier has two unique RecursiveCall bugs involving 3 functions exhausting available stack memory because of Un (no CVSS)
- [CVE-2019-17051](https://cve.now/CVE-2019-17051.md): Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attachment files, as demon (no CVSS)
- [CVE-2019-17050](https://cve.now/CVE-2019-17050.md): An issue was discovered in the Voyager package through 1.2.7 for Laravel. (no CVSS)
- [CVE-2019-16276](https://cve.now/CVE-2019-16276.md): Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling. (no CVSS, stdlib)
- [CVE-2019-17049](https://cve.now/CVE-2019-17049.md): NETGEAR SRX5308 4.3.5-3 devices allow SQL Injection, as exploited in the wild in September 2019 to add a new user account. (no CVSS)
- [CVE-2019-13467](https://cve.now/CVE-2019-13467.md): Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable t (no CVSS)
- [CVE-2019-13466](https://cve.now/CVE-2019-13466.md): Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. (no CVSS)
- [CVE-2019-15810](https://cve.now/CVE-2019-15810.md): Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter. (no CVSS)
- [CVE-2019-10489](https://cve.now/CVE-2019-10489.md): Possible null-pointer dereference can occur while parsing avi clip during copy in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer I (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10492](https://cve.now/CVE-2019-10492.md): Boot image not getting verified by AVB in Snapdragon Auto, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W, Qualcomm 215, SD 21 (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Mobile, Snapdragon Wea…)
- [CVE-2019-10497](https://cve.now/CVE-2019-10497.md): Use after free issue occurs If another instance of open for voice\_svc node has been called from application without closing the previous one (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-10498](https://cve.now/CVE-2019-10498.md): Buffer overflow scenario if the client sends more than 5 io\_vec requests to the server in Snapdragon Auto, Snapdragon Compute, Snapdragon Co (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10499](https://cve.now/CVE-2019-10499.md): Improper validation of read and write index of tx and rx fifo\`s before using for data copy from fifo can lead to out-of-bound access. (no CVSS, Qualcomm Snapdragon Mobile, Snapdragon Voice & Music, Snapd…)
- [CVE-2019-10501](https://cve.now/CVE-2019-10501.md): Possible use after free issue due to improper input validation in volume listener library in Snapdragon Auto, Snapdragon Compute, Snapdragon (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10506](https://cve.now/CVE-2019-10506.md): While processing QCA\_NL80211\_VENDOR\_SUBCMD\_AVOID\_FREQUENCY vendor command, driver does not validate the data obtained from the user space wh (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-10507](https://cve.now/CVE-2019-10507.md): Lack of check of extscan change results received from firmware can lead to an out of buffer read in Snapdragon Auto, Snapdragon Consumer Ele (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-10508](https://cve.now/CVE-2019-10508.md): Lack of input validation for data received from user space can lead to OOB access in WLAN in Snapdragon Auto, Snapdragon Consumer Electronic (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-10509](https://cve.now/CVE-2019-10509.md): Device record of the pairing device used after free during ACL disconnection in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10510](https://cve.now/CVE-2019-10510.md): BT process died and BT toggled due to null pointer dereference when invalid vendor pass through command sent from remote in Snapdragon Auto, (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-10538](https://cve.now/CVE-2019-10538.md): Lack of check of address range received from firmware response allows modem to respond arbitrary pages into its address range which can comp (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10539](https://cve.now/CVE-2019-10539.md): Possible buffer overflow issue due to lack of length check when parsing the extended cap IE header length in Snapdragon Auto, Snapdragon Com (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10540](https://cve.now/CVE-2019-10540.md): Buffer overflow in WLAN NAN function due to lack of check of count value received in NAN availability attribute in Snapdragon Auto, Snapdrag (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2252](https://cve.now/CVE-2019-2252.md): Classic buffer overflow vulnerability while playing the specific video whose Decode picture buffer size is more than 16 in Snapdragon Auto, (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2284](https://cve.now/CVE-2019-2284.md): Possible use-after-free issue due to a race condition while calling camera ioctl concurrently in Snapdragon Compute, Snapdragon Consumer IOT (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…)
- [CVE-2019-2294](https://cve.now/CVE-2019-2294.md): Usage of hard-coded magic number for calculating heap guard bytes can allow users to corrupt heap blocks without heap algorithm knowledge in (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2333](https://cve.now/CVE-2019-2333.md): Buffer overflow due to improper validation of buffer size while IPA driver processing to perform read operation in Snapdragon Auto, Snapdrag (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2341](https://cve.now/CVE-2019-2341.md): Buffer overflow when the audio buffer size provided by user is larger than the maximum allowable audio buffer size. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-16684](https://cve.now/CVE-2019-16684.md): An issue was discovered in the image-manager in Xoops 2.5.10. (no CVSS)
- [CVE-2019-4423](https://cve.now/CVE-2019-4423.md): IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 could allow a remote attacker to traverse directories on the system. (CVSS 5.3, IBM Sterling File Gateway)
- [CVE-2019-4305](https://cve.now/CVE-2019-4305.md): IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a c (CVSS 5.3, IBM WebSphere Application Server)
- [CVE-2019-4304](https://cve.now/CVE-2019-4304.md): IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session validati (CVSS 6.3, IBM WebSphere Application Server)
- [CVE-2019-4280](https://cve.now/CVE-2019-4280.md): IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 displays sensitive information in HTTP requests which could be used in further attacks aga (CVSS 5.3, IBM Sterling File Gateway)
- [CVE-2019-4115](https://cve.now/CVE-2019-4115.md): IBM WebSphere eXtreme Scale 8.6 Admin API is vulnerable to cross-site scripting. (CVSS 5.4, IBM WebSphere eXtreme Scale)
- [CVE-2019-4112](https://cve.now/CVE-2019-4112.md): IBM WebSphere eXtreme Scale 8.6 Admin Console allows web pages to be stored locally which can be read by another user on the system. (CVSS 4.0, IBM WebSphere eXtreme Scale)
- [CVE-2019-4109](https://cve.now/CVE-2019-4109.md): IBM WebSphere eXtreme Scale 8.6 Admin Console could allow a remote attacker to hijack the clicking action of the victim. (CVSS 6.1, IBM WebSphere eXtreme Scale)
- [CVE-2019-4106](https://cve.now/CVE-2019-4106.md): IBM WebSphere eXtreme Scale 8.6 Admin Console is vulnerable to cross-site scripting. (CVSS 4.8, IBM WebSphere eXtreme Scale)
- [CVE-2019-16683](https://cve.now/CVE-2019-16683.md): An issue was discovered in the image-manager in Xoops 2.5.10. (no CVSS)
- [CVE-2019-16932](https://cve.now/CVE-2019-16932.md): A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data. (no CVSS)
- [CVE-2019-17046](https://cve.now/CVE-2019-17046.md): Ilch 2.1.22 allows remote code execution because php is listed under "Allowed files" on the index.php/admin/media/settings/index page. (no CVSS)
- [CVE-2019-17045](https://cve.now/CVE-2019-17045.md): Ilch 2.1.22 allows stored XSS via the title, text, or email id to the Jobs Tab. (no CVSS)
- [CVE-2019-17040](https://cve.now/CVE-2019-17040.md): contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled. (no CVSS)
- [CVE-2019-16997](https://cve.now/CVE-2019-16997.md): In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language\_general.class.php via the admin/?n=language&c=lan (no CVSS)
- [CVE-2019-16996](https://cve.now/CVE-2019-16996.md): In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product\_admin.class.php via the admin/?n=product&c=product\_ (no CVSS)
- [CVE-2017-18636](https://cve.now/CVE-2017-18636.md): CDG through 2017-01-01 allows downloadDocument.jsp?command=download&pathAndName= directory traversal. (no CVSS)
- [CVE-2019-16999](https://cve.now/CVE-2019-16999.md): CloudBoot through 2019-03-08 allows SQL Injection via a crafted Status field in JSON data to the api/osinstall/v1/device/getNumByStatus URI. (no CVSS)
- [CVE-2019-16745](https://cve.now/CVE-2019-16745.md): eBrigade before 5.0 has evenement\_choice.php chxCal SQL Injection. (no CVSS)
- [CVE-2019-16744](https://cve.now/CVE-2019-16744.md): eBrigade before 5.0 has evenements.php cid SQL Injection. (no CVSS)
- [CVE-2019-14752](https://cve.now/CVE-2019-14752.md): SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS. (no CVSS)
- [CVE-2019-16414](https://cve.now/CVE-2019-16414.md): A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's clear (no CVSS)
- [CVE-2019-16743](https://cve.now/CVE-2019-16743.md): eBrigade before 5.0 has evenement\_ical.php evenement SQL Injection. (no CVSS)
- [CVE-2019-16995](https://cve.now/CVE-2019-16995.md): In the Linux kernel before 5.0.3, a memory leak exits in hsr\_dev\_finalize() in net/hsr/hsr\_device.c if hsr\_add\_port fails to add a port, whi (no CVSS)
- [CVE-2019-16994](https://cve.now/CVE-2019-16994.md): In the Linux kernel before 5.0, a memory leak exists in sit\_init\_net() in net/ipv6/sit.c when register\_netdev() fails to register sitn-\>fb\_t (no CVSS)
- [CVE-2019-16676](https://cve.now/CVE-2019-16676.md): Plataformatec Simple Form has Incorrect Access Control in file\_method? in lib/simple\_form/form\_builder.rb, because a user-supplied string is (no CVSS, simple\_form)
- [CVE-2019-16993](https://cve.now/CVE-2019-16993.md): In phpBB before 3.1.7-PL1, includes/acp/acp\_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration C (no CVSS, phpbb/phpbb)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-09-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.