CVEs published October 1, 2019
47 CVEs were published on October 1, 2019: 1 critical, 1 high.
- Published
- 47
- Critical
- 1
- High
- 1
- Medium
- 3
- Low
- 2
- Unrated
- 40
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- abcprintf Online Store
- 5
- IBM Jazz Reporting Service
- 3
- com.fasterxml.jackson.core:jackson-databind
- 2
- Apache Software Foundation Apache MINA · org.apache.mina:mi…
- 1
- Elastic Code
- 1
- IBM Daeja ViewONE Virtual
- 1
- Jenkins project Jenkins Dingding[钉钉] Plugin · io.jenkins.pl…
- 1
- Jenkins project Jenkins HTML Publisher Plugin · org.jenkins…
- 1
- Jenkins project Jenkins LDAP Email Plugin · com.mtvi.platen…
- 1
- Jenkins project Jenkins Script Security Plugin · org.jenkin…
- 1
Critical 1
High 1
Medium, low and unrated 45
- CVE-2019-17075An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2.
- CVE-2019-8288Vulnerability in Online Store v1.0, Stored XSS in user_view.php where adidas_member_user variable is not sanitized.abcprintf Online Store
- CVE-2019-8289Vulnerability in Online Store v1.0, stored XSS in admin/user_view.php adidas_member_email variableabcprintf Online Store
- CVE-2019-8290Vulnerability in Online Store v1.0, The registration form requirements for the member email format can be bypassed by posting directly to seabcprintf Online Store
- CVE-2019-8291Online Store System v1.0 delete_file.php doesn't check to see if a user has administrative rights nor does it check for path traversal.abcprintf Online Store
- CVE-2019-8292Online Store System v1.0 delete_product.php doesn't check to see if a user authtenticated or has administrative rights allowing arbitrary prabcprintf Online Store
- CVE-2019-0231Apache MINA SSLFilter security IssueApache Software Foundation Apache MINA · org.apache.mina:mi…
- CVE-2019-15041JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted C
- CVE-2019-15035An issue was discovered in JetBrains TeamCity 2018.2.4.
- CVE-2019-17073emlog through 6.0.0beta allows remote authenticated users to delete arbitrary files via admin/template.php?action=del&tpl=../ directory trav
- CVE-2019-17074An issue was discovered in XunRuiCMS 4.3.1.
- CVE-2019-7618A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2.Elastic Code
- CVE-2019-17067PuTTY before 0.73 on Windows improperly opens port-forwarding listening sockets, which allows attackers to listen on the same port to steal
- CVE-2019-17068PuTTY before 0.73 mishandles the "bracketed paste mode" protection mechanism, which may allow a session to be affected by malicious clipboar
- CVE-2019-14961JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS.
- CVE-2019-15042An issue was discovered in JetBrains TeamCity 2018.2.4.
- CVE-2019-16942A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10.com.fasterxml.jackson.core:jackson-databind
- CVE-2019-14960JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file.
- CVE-2019-14955In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration p
- CVE-2019-14953JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser.
- CVE-2019-15038An issue was discovered in JetBrains TeamCity 2018.2.4.
- CVE-2019-14957The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vim_settings.xml file.
- CVE-2019-17064Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor.
- CVE-2019-17063In Snowtide PDFxStream before 3.7.1 (for Java), a crafted PDF file can trigger an extremely long running computation because of page-tree mi
- CVE-2019-4497IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting.IBM Jazz Reporting Service
- CVE-2019-4495IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting.IBM Jazz Reporting Service
- CVE-2019-4494IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting.IBM Jazz Reporting Service
- CVE-2019-4246IBM Daeja ViewONE Virtual 5.0 through 5.0.6 could expose internal parameters to ViewONE clients that could be used in further attacks againsIBM Daeja ViewONE Virtual
- CVE-2019-11275CSV Injection in usage report downloaded from Pivotal Application ManagerPivotal Apps Manager
- CVE-2019-10433Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users wJenkins project Jenkins Dingding[钉钉] Plugin · io.jenkins.pl…
- CVE-2019-10434Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulJenkins project Jenkins LDAP Email Plugin · com.mtvi.platen…
- CVE-2019-10435Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in Jenkins project Jenkins SourceGear Vault Plugin · org.jenki…
- CVE-2019-10431A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions iJenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2019-10432Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a cJenkins project Jenkins HTML Publisher Plugin · org.jenkins…
- CVE-2019-14952JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.
- CVE-2019-14954JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection.
- CVE-2019-15039An issue was discovered in JetBrains TeamCity 2018.2.4.
- CVE-2019-17052ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAP_NET_RAW, which m
- CVE-2019-17053ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_
- CVE-2019-17054atalk_create in net/appletalk/ddp.c in the AF_APPLETALK network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which
- CVE-2019-17055base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW
- CVE-2019-17056llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which m
- CVE-2019-15940Victure PC530 devices allow unauthenticated TELNET access as root.
- CVE-2019-16508The Imagination Technologies driver for Chrome OS before R74-11895.B, R75 before R75-12105.B, and R76 before R76-12208.0.0 allows attackers
- CVE-2019-17069PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNE