# CVEs published 2019-10-01

47 CVEs were published on October 1, 2019: 1 critical, 1 high. Days are UTC.

- [CVE-2019-17075](https://cve.now/CVE-2019-17075.md): An issue was discovered in write\_tpt\_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. (no CVSS)
- [CVE-2019-8288](https://cve.now/CVE-2019-8288.md): Vulnerability in Online Store v1.0, Stored XSS in user\_view.php where adidas\_member\_user variable is not sanitized. (no CVSS, abcprintf Online Store)
- [CVE-2019-8289](https://cve.now/CVE-2019-8289.md): Vulnerability in Online Store v1.0, stored XSS in admin/user\_view.php adidas\_member\_email variable (no CVSS, abcprintf Online Store)
- [CVE-2019-8290](https://cve.now/CVE-2019-8290.md): Vulnerability in Online Store v1.0, The registration form requirements for the member email format can be bypassed by posting directly to se (no CVSS, abcprintf Online Store)
- [CVE-2019-8291](https://cve.now/CVE-2019-8291.md): Online Store System v1.0 delete\_file.php doesn't check to see if a user has administrative rights nor does it check for path traversal. (no CVSS, abcprintf Online Store)
- [CVE-2019-8292](https://cve.now/CVE-2019-8292.md): Online Store System v1.0 delete\_product.php doesn't check to see if a user authtenticated or has administrative rights allowing arbitrary pr (no CVSS, abcprintf Online Store)
- [CVE-2019-0231](https://cve.now/CVE-2019-0231.md): Apache MINA SSLFilter security Issue (no CVSS, Apache Software Foundation Apache MINA · org.apache.mina:mi…)
- [CVE-2019-15041](https://cve.now/CVE-2019-15041.md): JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted C (no CVSS)
- [CVE-2019-15035](https://cve.now/CVE-2019-15035.md): An issue was discovered in JetBrains TeamCity 2018.2.4. (no CVSS)
- [CVE-2019-17073](https://cve.now/CVE-2019-17073.md): emlog through 6.0.0beta allows remote authenticated users to delete arbitrary files via admin/template.php?action=del&tpl=../ directory trav (no CVSS)
- [CVE-2019-17074](https://cve.now/CVE-2019-17074.md): An issue was discovered in XunRuiCMS 4.3.1. (no CVSS)
- [CVE-2019-7618](https://cve.now/CVE-2019-7618.md): A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. (no CVSS, Elastic Code)
- [CVE-2019-17067](https://cve.now/CVE-2019-17067.md): PuTTY before 0.73 on Windows improperly opens port-forwarding listening sockets, which allows attackers to listen on the same port to steal (no CVSS)
- [CVE-2019-17068](https://cve.now/CVE-2019-17068.md): PuTTY before 0.73 mishandles the "bracketed paste mode" protection mechanism, which may allow a session to be affected by malicious clipboar (no CVSS)
- [CVE-2019-14961](https://cve.now/CVE-2019-14961.md): JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS. (no CVSS)
- [CVE-2019-15042](https://cve.now/CVE-2019-15042.md): An issue was discovered in JetBrains TeamCity 2018.2.4. (no CVSS)
- [CVE-2019-16943](https://cve.now/CVE-2019-16943.md): A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. (CVSS 9.8, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2019-16942](https://cve.now/CVE-2019-16942.md): A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2019-14960](https://cve.now/CVE-2019-14960.md): JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file. (no CVSS)
- [CVE-2019-14955](https://cve.now/CVE-2019-14955.md): In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration p (no CVSS)
- [CVE-2019-14953](https://cve.now/CVE-2019-14953.md): JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser. (no CVSS)
- [CVE-2019-15038](https://cve.now/CVE-2019-15038.md): An issue was discovered in JetBrains TeamCity 2018.2.4. (no CVSS)
- [CVE-2019-14957](https://cve.now/CVE-2019-14957.md): The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vim\_settings.xml file. (no CVSS)
- [CVE-2019-17064](https://cve.now/CVE-2019-17064.md): Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor. (no CVSS)
- [CVE-2019-17063](https://cve.now/CVE-2019-17063.md): In Snowtide PDFxStream before 3.7.1 (for Java), a crafted PDF file can trigger an extremely long running computation because of page-tree mi (no CVSS)
- [CVE-2019-4497](https://cve.now/CVE-2019-4497.md): IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Jazz Reporting Service)
- [CVE-2019-4495](https://cve.now/CVE-2019-4495.md): IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Jazz Reporting Service)
- [CVE-2019-4494](https://cve.now/CVE-2019-4494.md): IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Jazz Reporting Service)
- [CVE-2019-4246](https://cve.now/CVE-2019-4246.md): IBM Daeja ViewONE Virtual 5.0 through 5.0.6 could expose internal parameters to ViewONE clients that could be used in further attacks agains (CVSS 3.7, IBM Daeja ViewONE Virtual)
- [CVE-2019-10202](https://cve.now/CVE-2019-10202.md): A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. (CVSS 8.1, RedHat codehaus · org.codehaus.jackson:jackson-mapper-asl)
- [CVE-2019-11275](https://cve.now/CVE-2019-11275.md): CSV Injection in usage report downloaded from Pivotal Application Manager (CVSS 3.5, Pivotal Apps Manager)
- [CVE-2019-10433](https://cve.now/CVE-2019-10433.md): Jenkins Dingding\[钉钉\] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users w (no CVSS, Jenkins project Jenkins Dingding\[钉钉\] Plugin · io.jenkins.pl…)
- [CVE-2019-10434](https://cve.now/CVE-2019-10434.md): Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resul (no CVSS, Jenkins project Jenkins LDAP Email Plugin · com.mtvi.platen…)
- [CVE-2019-10435](https://cve.now/CVE-2019-10435.md): Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in (no CVSS, Jenkins project Jenkins SourceGear Vault Plugin · org.jenki…)
- [CVE-2019-10431](https://cve.now/CVE-2019-10431.md): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions i (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2019-10432](https://cve.now/CVE-2019-10432.md): Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a c (no CVSS, Jenkins project Jenkins HTML Publisher Plugin · org.jenkins…)
- [CVE-2019-14952](https://cve.now/CVE-2019-14952.md): JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles. (no CVSS)
- [CVE-2019-14954](https://cve.now/CVE-2019-14954.md): JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection. (no CVSS)
- [CVE-2019-15039](https://cve.now/CVE-2019-15039.md): An issue was discovered in JetBrains TeamCity 2018.2.4. (no CVSS)
- [CVE-2019-17052](https://cve.now/CVE-2019-17052.md): ax25\_create in net/ax25/af\_ax25.c in the AF\_AX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAP\_NET\_RAW, which m (no CVSS)
- [CVE-2019-17053](https://cve.now/CVE-2019-17053.md): ieee802154\_create in net/ieee802154/socket.c in the AF\_IEEE802154 network module in the Linux kernel through 5.3.2 does not enforce CAP\_NET\_ (no CVSS)
- [CVE-2019-17054](https://cve.now/CVE-2019-17054.md): atalk\_create in net/appletalk/ddp.c in the AF\_APPLETALK network module in the Linux kernel through 5.3.2 does not enforce CAP\_NET\_RAW, which (no CVSS)
- [CVE-2019-17055](https://cve.now/CVE-2019-17055.md): base\_sock\_create in drivers/isdn/mISDN/socket.c in the AF\_ISDN network module in the Linux kernel through 5.3.2 does not enforce CAP\_NET\_RAW (no CVSS)
- [CVE-2019-17056](https://cve.now/CVE-2019-17056.md): llcp\_sock\_create in net/nfc/llcp\_sock.c in the AF\_NFC network module in the Linux kernel through 5.3.2 does not enforce CAP\_NET\_RAW, which m (no CVSS)
- [CVE-2019-15940](https://cve.now/CVE-2019-15940.md): Victure PC530 devices allow unauthenticated TELNET access as root. (no CVSS)
- [CVE-2019-16508](https://cve.now/CVE-2019-16508.md): The Imagination Technologies driver for Chrome OS before R74-11895.B, R75 before R75-12105.B, and R76 before R76-12208.0.0 allows attackers (no CVSS)
- [CVE-2019-17069](https://cve.now/CVE-2019-17069.md): PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1\_MSG\_DISCONNE (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.