# CVEs published 2019-10-07

55 CVEs were published on October 7, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-17232](https://cve.now/CVE-2019-17232.md): Functions/EWD\_UFAQ\_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import. (no CVSS)
- [CVE-2019-17233](https://cve.now/CVE-2019-17233.md): Functions/EWD\_UFAQ\_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. (no CVSS)
- [CVE-2019-13120](https://cve.now/CVE-2019-13120.md): Amazon FreeRTOS up to and including v1.4.8 lacks length checking in prvProcessReceivedPublish, resulting in untargetable leakage of arbitrar (no CVSS)
- [CVE-2019-16913](https://cve.now/CVE-2019-16913.md): PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILES(X86)%\\PCProtect with very weak folder permissions, granting any user full (no CVSS)
- [CVE-2019-17239](https://cve.now/CVE-2019-17239.md): includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple (no CVSS)
- [CVE-2019-3745](https://cve.now/CVE-2019-3745.md): The vulnerability is limited to the installers of Dell Encryption Enterprise versions prior to 10.4.0 and Dell Endpoint Security Suite Enter (CVSS 6.7, Dell Encryption Enterprise · Dell Endpoint Security Suite E…)
- [CVE-2019-15894](https://cve.now/CVE-2019-15894.md): An issue was discovered in Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.3.x through 3.3.1. (no CVSS)
- [CVE-2019-17042](https://cve.now/CVE-2019-17042.md): An issue was discovered in Rsyslog v8.1908.0. (no CVSS)
- [CVE-2019-17041](https://cve.now/CVE-2019-17041.md): An issue was discovered in Rsyslog v8.1908.0. (no CVSS)
- [CVE-2019-17292](https://cve.now/CVE-2019-17292.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse\_Inbox module by an Admin user. (no CVSS)
- [CVE-2019-17293](https://cve.now/CVE-2019-17293.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse\_Project module by a Regular user. (no CVSS)
- [CVE-2019-17294](https://cve.now/CVE-2019-17294.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the export function by a Regular user. (no CVSS)
- [CVE-2019-17295](https://cve.now/CVE-2019-17295.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the history function by a Regular user. (no CVSS)
- [CVE-2019-17296](https://cve.now/CVE-2019-17296.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Contacts module by a Regular user. (no CVSS)
- [CVE-2019-17297](https://cve.now/CVE-2019-17297.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular user. (no CVSS)
- [CVE-2019-17298](https://cve.now/CVE-2019-17298.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Administration module by a Developer user. (no CVSS)
- [CVE-2019-17299](https://cve.now/CVE-2019-17299.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by an Admin user. (no CVSS)
- [CVE-2019-17300](https://cve.now/CVE-2019-17300.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by a Developer user. (no CVSS)
- [CVE-2019-17301](https://cve.now/CVE-2019-17301.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by an Admin user. (no CVSS)
- [CVE-2019-17302](https://cve.now/CVE-2019-17302.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by a Developer user. (no CVSS)
- [CVE-2019-17303](https://cve.now/CVE-2019-17303.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Developer user. (no CVSS)
- [CVE-2019-17304](https://cve.now/CVE-2019-17304.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by an Admin user. (no CVSS)
- [CVE-2019-17305](https://cve.now/CVE-2019-17305.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user. (no CVSS)
- [CVE-2019-17306](https://cve.now/CVE-2019-17306.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user. (no CVSS)
- [CVE-2019-17307](https://cve.now/CVE-2019-17307.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user. (no CVSS)
- [CVE-2019-17308](https://cve.now/CVE-2019-17308.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user. (no CVSS)
- [CVE-2019-17309](https://cve.now/CVE-2019-17309.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user. (no CVSS)
- [CVE-2019-17310](https://cve.now/CVE-2019-17310.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user. (no CVSS)
- [CVE-2019-17311](https://cve.now/CVE-2019-17311.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user. (no CVSS)
- [CVE-2019-17312](https://cve.now/CVE-2019-17312.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user. (no CVSS)
- [CVE-2019-17313](https://cve.now/CVE-2019-17313.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user. (no CVSS)
- [CVE-2019-17314](https://cve.now/CVE-2019-17314.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user. (no CVSS)
- [CVE-2019-17315](https://cve.now/CVE-2019-17315.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user. (no CVSS)
- [CVE-2019-17316](https://cve.now/CVE-2019-17316.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user. (no CVSS)
- [CVE-2019-17317](https://cve.now/CVE-2019-17317.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user. (no CVSS)
- [CVE-2019-17318](https://cve.now/CVE-2019-17318.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse\_Inbox module by a Regular user. (no CVSS)
- [CVE-2019-17319](https://cve.now/CVE-2019-17319.md): SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Emails module by a Regular user. (no CVSS)
- [CVE-2015-9456](https://cve.now/CVE-2015-9456.md): The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin (no CVSS)
- [CVE-2015-9455](https://cve.now/CVE-2015-9455.md): The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php b (no CVSS)
- [CVE-2015-9454](https://cve.now/CVE-2015-9454.md): The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current\_slider\_id pa (no CVSS)
- [CVE-2015-9453](https://cve.now/CVE-2015-9453.md): The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist. (no CVSS)
- [CVE-2015-9452](https://cve.now/CVE-2015-9452.md): The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex (no CVSS)
- [CVE-2015-9451](https://cve.now/CVE-2015-9451.md): The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb\_mailc (no CVSS)
- [CVE-2015-9450](https://cve.now/CVE-2015-9450.md): The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb\_cc pm (no CVSS)
- [CVE-2019-12812](https://cve.now/CVE-2019-12812.md): MyBuilder viewer before 6.2.2019.814 allow an attacker to execute arbitrary command via specifically crafted configuration file. (no CVSS, ACTIVESOFT MyBuilder)
- [CVE-2019-12811](https://cve.now/CVE-2019-12811.md): ActiveX Control in MyBuilder before 6.2.2019.814 allow an attacker to execute arbitrary command via the ShellOpen method. (no CVSS, ACTIVESOFT MyBuilder)
- [CVE-2019-3688](https://cve.now/CVE-2019-3688.md): squid: /usr/sbin/pinger packaged with wrong permission (CVSS 5.1, SUSE Linux Enterprise Server)
- [CVE-2019-15751](https://cve.now/CVE-2019-15751.md): An unrestricted file upload vulnerability in SITOS six Build v6.2.1 allows remote attackers to execute arbitrary code by uploading a SCORM f (no CVSS)
- [CVE-2019-15750](https://cve.now/CVE-2019-15750.md): A Cross-Site Scripting (XSS) vulnerability in the blog function in SITOS six Build v6.2.1 allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2019-15749](https://cve.now/CVE-2019-15749.md): SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confirm the change with t (no CVSS)
- [CVE-2019-15748](https://cve.now/CVE-2019-15748.md): SITOS six Build v6.2.1 permits unauthorised users to upload and import a SCORM 2004 package by browsing directly to affected pages. (no CVSS)
- [CVE-2019-15747](https://cve.now/CVE-2019-15747.md): SITOS six Build v6.2.1 allows a user with the user role of Seminar Coordinator to escalate their permission to the Systemadministrator role (no CVSS)
- [CVE-2019-15746](https://cve.now/CVE-2019-15746.md): SITOS six Build v6.2.1 allows an attacker to inject arbitrary PHP commands. (no CVSS)
- [CVE-2018-18379](https://cve.now/CVE-2018-18379.md): The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS. (no CVSS)
- [CVE-2019-16263](https://cve.now/CVE-2019-16263.md): The Twitter Kit framework through 3.4.2 for iOS does not properly validate the api.twitter.com SSL certificate. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.