# CVEs published 2019-10-02

74 CVEs were published on October 2, 2019: 2 critical, 25 high. Days are UTC.

- [CVE-2019-11651](https://cve.now/CVE-2019-11651.md): Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patc (no CVSS, Micro Focus Enterprise Developer and Enterprise Server)
- [CVE-2019-11929](https://cve.now/CVE-2019-11929.md): Insufficient boundary checks when formatting numbers in number\_format allows read/write access to out-of-bounds memory, potentially leading (no CVSS, Facebook HHVM)
- [CVE-2019-1915](https://cve.now/CVE-2019-1915.md): Multiple Cisco Unified Communications Products Cross-Site Request Forgery Vulnerability (CVSS 6.5, Cisco Unified Communications Manager)
- [CVE-2019-15272](https://cve.now/CVE-2019-15272.md): Cisco Unified Communications Manager Security Bypass Vulnerability (CVSS 6.5, Cisco Unified Communications Manager)
- [CVE-2019-15259](https://cve.now/CVE-2019-15259.md): Cisco Unified Contact Center Express HTTP Response Splitting Vulnerability (CVSS 6.1, Cisco Unified Contact Center Express)
- [CVE-2019-15256](https://cve.now/CVE-2019-15256.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IKEv1 Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-12716](https://cve.now/CVE-2019-12716.md): Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unified Communications Manager)
- [CVE-2019-12715](https://cve.now/CVE-2019-12715.md): Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unified Communications Manager)
- [CVE-2019-12714](https://cve.now/CVE-2019-12714.md): Cisco IC3000 Industrial Compute Gateway Denial of Service Vulnerability (CVSS 6.5, Cisco IC3000 Industrial Compute Gateway)
- [CVE-2019-12713](https://cve.now/CVE-2019-12713.md): Cisco Prime Infrastructure Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Prime Infrastructure)
- [CVE-2019-12712](https://cve.now/CVE-2019-12712.md): Cisco Prime Infrastructure Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Prime Infrastructure)
- [CVE-2019-12711](https://cve.now/CVE-2019-12711.md): Cisco Unified Communications Manager XML External Expansion Vulnerability (CVSS 6.1, Cisco Unified Communications Manager)
- [CVE-2019-12710](https://cve.now/CVE-2019-12710.md): Cisco Unified Communications Manager SQL Injection Vulnerability (CVSS 4.9, Cisco Unified Communications Manager)
- [CVE-2019-12707](https://cve.now/CVE-2019-12707.md): Multiple Cisco Unified Communications Products Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unity Connection)
- [CVE-2019-12706](https://cve.now/CVE-2019-12706.md): Cisco Email Security Appliance Filter Bypass Vulnerability (CVSS 6.5, Cisco Email Security Appliance)
- [CVE-2019-12701](https://cve.now/CVE-2019-12701.md): Cisco Firepower Management Center Software File and Malware Policy Bypass Vulnerability (CVSS 5.8, Cisco Firepower Management Center)
- [CVE-2019-12700](https://cve.now/CVE-2019-12700.md): Cisco FTD, FMC, and FXOS Software Pluggable Authentication Module Denial of Service Vulnerability (CVSS 7.7, Cisco Firepower Management Center)
- [CVE-2019-12699](https://cve.now/CVE-2019-12699.md): Cisco FXOS Software and Firepower Threat Defense Software Command Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Extensible Operating System)
- [CVE-2019-12698](https://cve.now/CVE-2019-12698.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software WebVPN CPU Denial of Service Vulnerability (CVSS 5.3, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-12697](https://cve.now/CVE-2019-12697.md): Cisco Firepower System Software Detection Engine RTF and RAR Malware and File Policy Bypass Vulnerabilities (CVSS 5.8, Cisco FireSIGHT System Software)
- [CVE-2019-12696](https://cve.now/CVE-2019-12696.md): Cisco Firepower System Software Detection Engine RTF and RAR Malware and File Policy Bypass Vulnerabilities (CVSS 5.8, Cisco FireSIGHT System Software)
- [CVE-2019-12695](https://cve.now/CVE-2019-12695.md): Cisco Adaptive Security Appliance and Firepower Threat Defense Software WebVPN Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-12694](https://cve.now/CVE-2019-12694.md): Cisco Firepower Threat Defense Software Command Injection Vulnerability (CVSS 6.7, Cisco Firepower Threat Defense Software)
- [CVE-2019-12693](https://cve.now/CVE-2019-12693.md): Cisco Adaptive Security Appliance Software Secure Copy Denial of Service Vulnerability (CVSS 6.8, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-12691](https://cve.now/CVE-2019-12691.md): Cisco Firepower Management Center Directory Traversal Vulnerability (CVSS 4.1, Cisco Firepower Management Center)
- [CVE-2019-12690](https://cve.now/CVE-2019-12690.md): Cisco Firepower Management Center Command Injection Vulnerability (CVSS 7.2, Cisco Firepower Management Center)
- [CVE-2019-12689](https://cve.now/CVE-2019-12689.md): Cisco Firepower Management Center Remote Code Execution Vulnerability (CVSS 7.5, Cisco Firepower Management Center)
- [CVE-2019-12688](https://cve.now/CVE-2019-12688.md): Cisco Firepower Management Center Remote Code Execution Vulnerability (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12687](https://cve.now/CVE-2019-12687.md): Cisco Firepower Management Center Remote Code Execution Vulnerability (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12686](https://cve.now/CVE-2019-12686.md): Cisco Firepower Management Center SQL Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12685](https://cve.now/CVE-2019-12685.md): Cisco Firepower Management Center SQL Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12684](https://cve.now/CVE-2019-12684.md): Cisco Firepower Management Center SQL Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12683](https://cve.now/CVE-2019-12683.md): Cisco Firepower Management Center SQL Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12682](https://cve.now/CVE-2019-12682.md): Cisco Firepower Management Center SQL Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12681](https://cve.now/CVE-2019-12681.md): Cisco Firepower Management Center SQL Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12680](https://cve.now/CVE-2019-12680.md): Cisco Firepower Management Center SQL Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12679](https://cve.now/CVE-2019-12679.md): Cisco Firepower Management Center SQL Injection Vulnerabilities (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2019-12678](https://cve.now/CVE-2019-12678.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SIP Inspection Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-12677](https://cve.now/CVE-2019-12677.md): Cisco Adaptive Security Appliance Software SSL VPN Denial of Service Vulnerability (CVSS 7.7, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-12676](https://cve.now/CVE-2019-12676.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software OSPF LSA Processing Denial of Service Vulnerability (CVSS 7.4, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-12675](https://cve.now/CVE-2019-12675.md): Cisco Firepower Threat Defense Software Multi-instance Container Escape Vulnerabilities (CVSS 8.2, Cisco Firepower Threat Defense Software)
- [CVE-2019-12674](https://cve.now/CVE-2019-12674.md): Cisco Firepower Threat Defense Software Multi-instance Container Escape Vulnerabilities (CVSS 8.2, Cisco Firepower Threat Defense Software)
- [CVE-2019-12673](https://cve.now/CVE-2019-12673.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software FTP Inspection Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-12156](https://cve.now/CVE-2019-12156.md): Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity ver (no CVSS)
- [CVE-2019-12157](https://cve.now/CVE-2019-12157.md): In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands. (no CVSS)
- [CVE-2019-12736](https://cve.now/CVE-2019-12736.md): JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command injec (no CVSS)
- [CVE-2019-12737](https://cve.now/CVE-2019-12737.md): UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials. (no CVSS)
- [CVE-2019-13957](https://cve.now/CVE-2019-13957.md): In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter. (no CVSS)
- [CVE-2019-14956](https://cve.now/CVE-2019-14956.md): JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project name (no CVSS)
- [CVE-2019-14958](https://cve.now/CVE-2019-14958.md): JetBrains PyCharm before 2019.2 was allocating a buffer of unknown size for one of the connection processes. (no CVSS)
- [CVE-2019-14959](https://cve.now/CVE-2019-14959.md): JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection. (no CVSS)
- [CVE-2019-15036](https://cve.now/CVE-2019-15036.md): An issue was discovered in JetBrains TeamCity 2018.2.4. (no CVSS)
- [CVE-2019-15037](https://cve.now/CVE-2019-15037.md): An issue was discovered in JetBrains TeamCity 2018.2.4. (no CVSS)
- [CVE-2019-15040](https://cve.now/CVE-2019-15040.md): JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page. (no CVSS)
- [CVE-2019-16171](https://cve.now/CVE-2019-16171.md): In JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page. (no CVSS)
- [CVE-2019-10212](https://cve.now/CVE-2019-10212.md): A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. (CVSS 4.8, RedHat undertow · io.undertow:undertow-core)
- [CVE-2019-12631](https://cve.now/CVE-2019-12631.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2019-12630](https://cve.now/CVE-2019-12630.md): Cisco Security Manager Java Deserialization Vulnerability (CVSS 6.5, Cisco Security Manager)
- [CVE-2019-16407](https://cve.now/CVE-2019-16407.md): JetBrains ReSharper installers for versions before 2019.2 had a DLL Hijacking vulnerability. (no CVSS)
- [CVE-2019-8462](https://cve.now/CVE-2019-8462.md): In a rare scenario, Check Point R80.30 Security Gateway before JHF Take 50 managed by Check Point R80.30 Management crashes with a unique co (no CVSS, Check Point Security Gateway)
- [CVE-2019-13658](https://cve.now/CVE-2019-13658.md): CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary comman (CVSS 9.8, CA Technologies, a Broadcom Company CA Network Flow Analysis)
- [CVE-2019-5031](https://cve.now/CVE-2019-5031.md): An exploitable memory corruption vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.4.1.16828. (CVSS 8.8, Foxit)
- [CVE-2019-13343](https://cve.now/CVE-2019-13343.md): Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. (CVSS 9.9)
- [CVE-2019-16116](https://cve.now/CVE-2019-16116.md): EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file. (no CVSS)
- [CVE-2019-13025](https://cve.now/CVE-2019-13025.md): Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices have Incorrect Access Control because of Improper Input Validation. (no CVSS)
- [CVE-2019-4549](https://cve.now/CVE-2019-4549.md): IBM Security Directory Server 6.4.0 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM Security Directory Server)
- [CVE-2019-4542](https://cve.now/CVE-2019-4542.md): IBM Security Directory Server 6.4.0 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Security Directory Server)
- [CVE-2019-4539](https://cve.now/CVE-2019-4539.md): IBM Security Directory Server 6.4.0 does not properly neutralize special elements that are used in XML, allowing attackers to modify the syn (CVSS 7.1, IBM Security Directory Server)
- [CVE-2019-4538](https://cve.now/CVE-2019-4538.md): IBM Security Directory Server 6.4.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (CVSS 7.4, IBM Security Directory Server)
- [CVE-2019-4520](https://cve.now/CVE-2019-4520.md): IBM Security Directory Server 6.4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account cre (CVSS 7.5, IBM Security Directory Server)
- [CVE-2019-17091](https://cve.now/CVE-2019-17091.md): faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces (no CVSS, org.glassfish:javax.faces · org.glassfish:jakarta.faces)
- [CVE-2019-17080](https://cve.now/CVE-2019-17080.md): mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a REVIEWS\_CACHE file is controlled by an attacker, because (no CVSS)
- [CVE-2019-14454](https://cve.now/CVE-2019-14454.md): SuiteCRM 7.11.x and 7.10.x before 7.11.8 and 7.10.20 is vulnerable to vertical privilege escalation. (no CVSS)
- [CVE-2019-13335](https://cve.now/CVE-2019-13335.md): SalesAgility SuiteCRM 7.10.x 7.10.19 and 7.11.x before and 7.11.7 has SSRF. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.