CVEs published October 8, 2019
77 CVEs were published on October 8, 2019: 0 critical, 1 high.
- Published
- 77
- Critical
- 0
- High
- 1
- Medium
- 2
- Low
- 0
- Unrated
- 74
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- SAP SE SAP BusinessObjects Business Intelligence Platform
- 5
- centreon/centreon
- 3
- Moxa EDR
- 2
- SAP SE SAP Financial Consolidation
- 2
- Auth0.AuthenticationApi
- 1
- com.jfinal:jfinal
- 1
- knex.js · knex
- 1
- node-red-dashboard
- 1
- octavia
- 1
- org.bouncycastle:bcprov-jdk14
- 1
High 1
Medium, low and unrated 76
- CVE-2019-3980The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executablSolarWinds Dameware Remote Mini Remote Client Agent Service
- CVE-2019-0380Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values tSAP SE SAP Landscape Management enterprise edition
- CVE-2019-0381A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, SAP SE SAP IQ · SAP SE SAP SQL Anywhere +1
- CVE-2019-0379SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default secSAP SE SAP Process Integration, business-to-business add-on
- CVE-2019-0378SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user-SAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2019-0377SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode userSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2019-0376SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2019-0375SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2019-0374SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently encSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2019-0370Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to intSAP SE SAP Financial Consolidation
- CVE-2019-0369SAP Financial Consolidation, before versions 10.0 and 10.1, does not sufficiently encode user-controlled inputs, which allows an attacker toSAP SE SAP Financial Consolidation
- CVE-2019-0368SAP Customer Relationship Management (Email Management), versions: S4CRM before 1.0 and 2.0, BBPCRM before 7.0, 7.01, 7.02, 7.12, 7.13 and 7SAP SE SAP Customer Relationship Management
- CVE-2019-0367SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authentSAP SE SAP NetWeaver Process Integration
- CVE-2019-10757knex.js versions before 0.19.5 are vulnerable to SQL Injection attack.knex.js · knex
- CVE-2019-10756It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting rawnode-red-dashboard
- CVE-2019-10215Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function.Red Hat bootstrap3-typeahead.js
- CVE-2019-14845A vulnerability was found in OpenShift builds, versions 4.1 up to 4.3.Red Hat openshift
- CVE-2019-10963Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which maMoxa EDR
- CVE-2019-10969Moxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping feature to execute unauthorized commands on theMoxa EDR
- CVE-2019-17186/var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication remote code execution.
- CVE-2019-17134Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to boctavia
- CVE-2019-17105The token generator in index.php in Centreon Web before 2.8.27 is predictable.
- CVE-2019-17187/var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication Directory Traversal for re
- CVE-2018-21024licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request.
- CVE-2019-17359The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError org.bouncycastle:bcprov-jdk14
- CVE-2019-13336The dbell Wi-Fi Smart Video Doorbell DB01-S Gen 1 allows remote attackers to launch commands with no authentication verification via TCP por
- CVE-2019-17271vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.
- CVE-2019-17108Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS
- CVE-2019-17107minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parame
- CVE-2019-17106In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external cocentreon/centreon
- CVE-2019-17104In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly fcentreon/centreon
- CVE-2018-21025In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced centreon/centreon
- CVE-2018-21023getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns_id parameter.
- CVE-2018-21022makeXML_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host_id parameter.
- CVE-2019-17352In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload acom.jfinal:jfinal
- CVE-2018-21021img_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host_id parameter.
- CVE-2018-21020In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass aut
- CVE-2019-16929Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tAuth0.AuthenticationApi
- CVE-2019-16417HRworks FLOW 3.36.9 allows XSS via the purpose of a travel-expense report.
- CVE-2019-16416HRworks 3.36.9 allows XSS via the purpose of a travel-expense report.
- CVE-2019-14657Yealink phones through 2019-08-04 have an issue with OpenVPN file upload.
- CVE-2019-14656Yealink phones through 2019-08-04 do not properly check user roles in POST requests.
- CVE-2019-17258IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at JPEG_LS+0x000000000000839c.
- CVE-2019-17257IrfanView 4.53 allows a Exception Handler Chain to be Corrupted starting at EXR!ReadEXR+0x000000000002af80.
- CVE-2019-17256IrfanView 4.53 allows a User Mode Write AV starting at DPX!ReadDPX_W+0x0000000000001203.
- CVE-2019-17255IrfanView 4.53 allows a User Mode Write AV starting at EXR!ReadEXR+0x0000000000010836.
- CVE-2019-17254IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at FORMATS!Read_BadPNG+0x0000000000000101.
- CVE-2019-17253IrfanView 4.53 allows a User Mode Write AV starting at JPEG_LS+0x000000000000a6b8.
- CVE-2019-17252IrfanView 4.53 allows a User Mode Write AV starting at FORMATS!Read_BadPNG+0x0000000000000115.
- CVE-2019-17251IrfanView 4.53 allows a User Mode Write AV starting at FORMATS!GetPlugInInfo+0x0000000000007d43.
- CVE-2019-17250IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x00000000000042f5.
- CVE-2019-17249IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000d57b.
- CVE-2019-17248IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x00000000000025b6.
- CVE-2019-17247IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at JPEG_LS+0x0000000000007da8.
- CVE-2019-17246IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000258c.
- CVE-2019-17245IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x0000000000004359.
- CVE-2019-17244IrfanView 4.53 allows Data from a Faulting Address to control Code Flow starting at JPEG_LS+0x0000000000001d8a.
- CVE-2019-17243IrfanView 4.53 allows Data from a Faulting Address to control Code Flow starting at JPEG_LS+0x0000000000003155.
- CVE-2019-17242IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000966f.
- CVE-2019-17241IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000d563.
- CVE-2019-17262XnView Classic 2.49.1 allows a User Mode Write AV starting at Xwsq+0x0000000000001fc0.
- CVE-2019-17261XnView Classic 2.49.1 allows a User Mode Write AV starting at Xwsq+0x0000000000001e51.
- CVE-2019-17260MPC-HC through 1.7.13 allows a Read Access Violation on a Block Data Move starting at mpc_hc!memcpy+0x000000000000004e.
- CVE-2019-17259KMPlayer 4.2.2.31 allows a User Mode Write AV starting at utils!src_new+0x000000000014d6ee.
- CVE-2019-17340An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or gain privileges because grant-tabl
- CVE-2019-17341An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a
- CVE-2019-17342An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a
- CVE-2019-17343An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging i
- CVE-2019-17344An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service by leveraging a long-running opera
- CVE-2019-17345An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of faile
- CVE-2019-17346An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because of an i
- CVE-2019-17347An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because a guest
- CVE-2019-17348An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service because of an incompatibility betw
- CVE-2019-17349An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a LoadExcl
- CVE-2019-17350An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a compare-a
- CVE-2019-17351An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to