# CVEs published 2019-10-04 31 CVEs were published on October 4, 2019: 0 critical, 8 high. Days are UTC. - [CVE-2019-17184](https://cve.now/CVE-2019-17184.md): Xerox AtlaLink B8045/B8055/B8065/B8075/B8090 C8030/C8035/C8045/C8055/C8070 printers with software before 101.00x.089.22600 allow an attacker (no CVSS) - [CVE-2019-17188](https://cve.now/CVE-2019-17188.md): An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. (no CVSS) - [CVE-2019-16865](https://cve.now/CVE-2019-16865.md): An issue was discovered in Pillow before 6.2.0. (no CVSS, pillow) - [CVE-2019-17183](https://cve.now/CVE-2019-17183.md): Foxit Reader before 9.7 allows an Access Violation and crash if insufficient memory exists. (no CVSS) - [CVE-2019-17180](https://cve.now/CVE-2019-17180.md): Valve Steam Client before 2019-09-12 allows placing or appending partially controlled filesystem content, as demonstrated by file modificati (no CVSS) - [CVE-2019-11656](https://cve.now/CVE-2019-11656.md): Stored XSS vulnerability in Micro Focus ArcSight Logger, affects versions prior to Logger 6.7.1 HotFix 6.7.1.8262.0. (no CVSS, ArcSight Logger.) - [CVE-2019-11655](https://cve.now/CVE-2019-11655.md): Unrestricted file upload vulnerability in Micro Focus ArcSight Logger, version 6.7.0 and later. (no CVSS, ArcSight Logger.) - [CVE-2019-17179](https://cve.now/CVE-2019-17179.md): 4.1.0, 4.1.1, 4.1.2, 4.1.2.3, 4.1.2.6, 4.1.2.7, 4.2.0, 4.2.1, 4.2.2, 5.0.0, 5.0.0.5, 5.0.0.6, 5.0.1, 5.0.1.1, 5.0.1.2, 5.0.1.3, 5.0.1.4, 5.0 (no CVSS) - [CVE-2019-6015](https://cve.now/CVE-2019-6015.md): FON2601E-SE, FON2601E-RE, FON2601E-FSW-S, and FON2601E-FSW-B with firmware versions 1.1.7 and earlier contain an issue where they may behave (no CVSS, FON Wireless Limited FON2601E-SE, FON2601E-RE, FON2601E-FSW…) - [CVE-2019-13320](https://cve.now/CVE-2019-13320.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. (CVSS 7.8, Foxit Reader) - [CVE-2019-6774](https://cve.now/CVE-2019-6774.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.4.1.16828. (CVSS 7.8, Foxit Reader) - [CVE-2019-6775](https://cve.now/CVE-2019-6775.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. (CVSS 7.8, Foxit Reader) - [CVE-2019-6776](https://cve.now/CVE-2019-6776.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. (CVSS 7.8, Foxit PhantomPDF) - [CVE-2019-13315](https://cve.now/CVE-2019-13315.md): This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. (CVSS 7.8, Foxit Reader) - [CVE-2019-13317](https://cve.now/CVE-2019-13317.md): This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. (CVSS 7.8, Foxit PhantomPDF) - [CVE-2019-13318](https://cve.now/CVE-2019-13318.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 9.5.0.20723. (CVSS 5.5, Foxit Reader) - [CVE-2019-13319](https://cve.now/CVE-2019-13319.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. (CVSS 7.8, Foxit Reader) - [CVE-2019-13316](https://cve.now/CVE-2019-13316.md): This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. (CVSS 7.8, Foxit PhantomPDF) - [CVE-2019-17177](https://cve.now/CVE-2019-17177.md): libfreerdp/codec/region.c in FreeRDP through 1.1.x and 2.x through 2.0.0-rc4 has memory leaks because a supplied realloc pointer (i.e., the (no CVSS) - [CVE-2019-17178](https://cve.now/CVE-2019-17178.md): HuffmanTree\_makeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as used in WinPR in FreeRDP and other products, has a memory lea (no CVSS) - [CVE-2019-17175](https://cve.now/CVE-2019-17175.md): joyplus-cms 1.6.0 allows manager/admin\_pic.php?rootpath= absolute path traversal. (no CVSS) - [CVE-2019-4564](https://cve.now/CVE-2019-4564.md): IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Security Key Lifecycle Manager) - [CVE-2019-4514](https://cve.now/CVE-2019-4514.md): IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM Security Key Lifecycle Manager) - [CVE-2019-4227](https://cve.now/CVE-2019-4227.md): IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauthorized user to conduc (CVSS 5.6, IBM MQ) - [CVE-2018-11768](https://cve.now/CVE-2018-11768.md): In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupte (no CVSS, Apache Hadoop · org.apache.hadoop:hadoop-main) - [CVE-2019-17133](https://cve.now/CVE-2019-17133.md): In the Linux kernel through 5.3.2, cfg80211\_mgd\_wext\_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer (no CVSS) - [CVE-2019-17132](https://cve.now/CVE-2019-17132.md): vBulletin through 5.5.4 mishandles custom avatars. (no CVSS) - [CVE-2019-17131](https://cve.now/CVE-2019-17131.md): vBulletin before 5.5.4 allows clickjacking. (no CVSS) - [CVE-2019-17130](https://cve.now/CVE-2019-17130.md): vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories. (no CVSS) - [CVE-2019-17121](https://cve.now/CVE-2019-17121.md): REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values. (no CVSS) - [CVE-2019-16891](https://cve.now/CVE-2019-16891.md): Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload. (no CVSS, com.liferay.portal:release.portal.bom) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-10-04 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.