# CVEs published 2019-10-06

15 CVEs were published on October 6, 2019: 1 critical, 0 high. Days are UTC.

- [CVE-2019-17269](https://cve.now/CVE-2019-17269.md): Intellian Remote Access 3.18 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the Ping Test field. (no CVSS)
- [CVE-2019-17267](https://cve.now/CVE-2019-17267.md): A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. (CVSS 9.8, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2019-17266](https://cve.now/CVE-2019-17266.md): libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup\_ntlm\_parse\_challenge() in soup-auth-ntlm.c does no (no CVSS)
- [CVE-2019-17264](https://cve.now/CVE-2019-17264.md): In libyal liblnk before 20191006, liblnk\_location\_information\_read\_data in liblnk\_location\_information.c has a heap-based buffer over-read b (no CVSS)
- [CVE-2019-17263](https://cve.now/CVE-2019-17263.md): In libyal libfwsi before 20191006, libfwsi\_extension\_block\_copy\_from\_byte\_stream in libfwsi\_extension\_block.c has a heap-based buffer over-r (no CVSS)
- [CVE-2019-17240](https://cve.now/CVE-2019-17240.md): bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X- (CVSS 3.7)
- [CVE-2019-17226](https://cve.now/CVE-2019-17226.md): CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin \> Module Manager \> Search Term field. (no CVSS)
- [CVE-2019-17225](https://cve.now/CVE-2019-17225.md): Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue. (no CVSS)
- [CVE-2019-17215](https://cve.now/CVE-2019-17215.md): An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. (no CVSS)
- [CVE-2019-17216](https://cve.now/CVE-2019-17216.md): An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. (no CVSS)
- [CVE-2019-17217](https://cve.now/CVE-2019-17217.md): An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. (no CVSS)
- [CVE-2019-17218](https://cve.now/CVE-2019-17218.md): An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. (no CVSS)
- [CVE-2019-17219](https://cve.now/CVE-2019-17219.md): An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. (no CVSS)
- [CVE-2019-17213](https://cve.now/CVE-2019-17213.md): The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header. (no CVSS)
- [CVE-2019-17214](https://cve.now/CVE-2019-17214.md): The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending &cc=1 to a URI. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.