# CVEs published 2019-10-05

8 CVEs were published on October 5, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-17206](https://cve.now/CVE-2019-17206.md): Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper (aka Redis Wrapper) before 0.3.0 allows attackers t (no CVSS, rediswrapper)
- [CVE-2019-17203](https://cve.now/CVE-2019-17203.md): TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder. (no CVSS, nilsteampassnet/teampass)
- [CVE-2019-17204](https://cve.now/CVE-2019-17204.md): TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item. (no CVSS, nilsteampassnet/teampass)
- [CVE-2019-17205](https://cve.now/CVE-2019-17205.md): TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. (no CVSS, nilsteampassnet/teampass)
- [CVE-2019-17199](https://cve.now/CVE-2019-17199.md): www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal (for reading arbitrary files) because of an unanchored regula (no CVSS)
- [CVE-2019-17197](https://cve.now/CVE-2019-17197.md): OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical\_rules.php that affects library/pati (no CVSS)
- [CVE-2019-17191](https://cve.now/CVE-2019-17191.md): The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user inter (no CVSS)
- [CVE-2019-17192](https://cve.now/CVE-2019-17192.md): The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.