CVEs published October 3, 2019
53 CVEs were published on October 3, 2019: 5 critical, 20 high.
- Published
- 53
- Critical
- 5
- High
- 20
- Medium
- 3
- Low
- 1
- Unrated
- 24
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Foxit Reader
- 7
- Foxit Studio Photo
- 3
- IBM Security Guardium
- 1
- IBM WebSphere Application Server
- 1
- koral-- android-gif-drawable · pl.droidsonroids.gif:android…
- 1
- RedHat struts
- 1
- rpyc
- 1
- The Tcpdump Group tcpdump
- 1
- wolfcrypt
- 1
Critical 5
- CVE-2018-16451The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIPE\LANMAN.
- CVE-2018-16230The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI).
- CVE-2018-16228The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix().
- CVE-2018-14882The ICMPv6 parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp6.c.
- CVE-2018-14881The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_RESTART).
High 20
- CVE-2019-13329This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.Foxit Reader
- CVE-2019-13330This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723.Foxit Reader
- CVE-2019-13331This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723.Foxit Reader
- CVE-2019-13326This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723.Foxit Reader
- CVE-2019-13327This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723.Foxit Reader
- CVE-2019-13328This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723.Foxit Reader
- CVE-2019-13332This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25114.Foxit Reader
- CVE-2019-13323This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.909.Foxit Studio Photo
- CVE-2019-13324This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.909.Foxit Studio Photo
- CVE-2019-13325This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.909.Foxit Studio Photo
- CVE-2018-16452The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion.
- CVE-2018-16300The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited recursion.
- CVE-2018-14879The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:get_next_file().
- CVE-2018-14470The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2().
- CVE-2018-14468The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print().
- CVE-2018-14467The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP).
- CVE-2018-14465The RSVP parser in tcpdump before 4.9.3 has a buffer over-read in print-rsvp.c:rsvp_obj_print().
- CVE-2018-14462The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().
- CVE-2018-14461The LDP parser in tcpdump before 4.9.3 has a buffer over-read in print-ldp.c:ldp_tlv_print().
- CVE-2019-4422IBM Security Guardium 9.0, 9.5, and 10.6 are vulnerable to a privilege escalation which could allow an authenticated user to change the acceIBM Security Guardium
Medium, low and unrated 28
- CVE-2019-17113In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict th
- CVE-2019-11932A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in Wkoral-- android-gif-drawable · pl.droidsonroids.gif:android…
- CVE-2019-16198KSLabs KSWEB 3.93 allows ../ directory traversal, as demonstrated by the hostFile parameter.
- CVE-2019-15766The KSLABS KSWEB (aka ru.kslabs.ksweb) application 3.93 for Android allows authenticated remote code execution via a POST request to the AJA
- CVE-2019-16328In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes crpyc
- CVE-2019-16866Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query.
- CVE-2019-15165sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.
- CVE-2019-15164rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source.
- CVE-2019-16931A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript w
- CVE-2019-15163rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daemon crash) if a crypt
- CVE-2019-15162rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which might make it easie
- CVE-2019-15161rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse of a variable.
- CVE-2019-15166lmp_print in tcpdump lacks certain boundary checks
- CVE-2018-16301The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile().The Tcpdump Group tcpdump
- CVE-2018-16229The DCCP parser in tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option().
- CVE-2018-16227The IEEE 802.11 parser in tcpdump before 4.9.3 has a buffer over-read in print-802_11.c for the Mesh Flags subfield.
- CVE-2018-14880The OSPFv3 parser in tcpdump before 4.9.3 has a buffer over-read in print-ospf6.c:ospf6_print_lshdr().
- CVE-2018-14469The IKEv1 parser in tcpdump before 4.9.3 has a buffer over-read in print-isakmp.c:ikev1_n_print().
- CVE-2018-14466The Rx parser in tcpdump before 4.9.3 has a buffer over-read in print-rx.c:rx_cache_find() and rx_cache_insert().
- CVE-2018-14464The LMP parser in tcpdump before 4.9.3 has a buffer over-read in print-lmp.c:lmp_print_data_link_subobjs().
- CVE-2018-14463The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 2, a different vulnerability th
- CVE-2018-10105tcpdump before 4.9.3 mishandles the printing of SMB data (issue 2 of 2).
- CVE-2018-10103tcpdump before 4.9.3 mishandles the printing of SMB data (issue 1 of 2).
- CVE-2019-4441IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack IBM WebSphere Application Server
- CVE-2019-3834It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON).RedHat struts
- CVE-2019-13629MatrixSSL 4.2.1 and earlier contains a timing side channel in ECDSA signature generation.
- CVE-2019-13628wolfSSL and wolfCrypt 4.0.0 and earlier (when configured without --enable-fpecc, --enable-sp, or --enable-sp-math) contain a timing side chawolfcrypt
- CVE-2019-15809Smart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, contain a timing side channel in E