# CVEs published 2019-10-08

77 CVEs were published on October 8, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2019-3980](https://cve.now/CVE-2019-3980.md): The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executabl (no CVSS, SolarWinds Dameware Remote Mini Remote Client Agent Service)
- [CVE-2019-0380](https://cve.now/CVE-2019-0380.md): Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values t (no CVSS, SAP SE SAP Landscape Management enterprise edition)
- [CVE-2019-0381](https://cve.now/CVE-2019-0381.md): A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, (no CVSS, SAP SE SAP IQ · SAP SE SAP SQL Anywhere +1)
- [CVE-2019-0379](https://cve.now/CVE-2019-0379.md): SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly when the default sec (no CVSS, SAP SE SAP Process Integration, business-to-business add-on)
- [CVE-2019-0378](https://cve.now/CVE-2019-0378.md): SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before version 4.2, does not sufficiently encode user- (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2019-0377](https://cve.now/CVE-2019-0377.md): SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2, does not sufficiently encode user (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2019-0376](https://cve.now/CVE-2019-0376.md): SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently enc (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2019-0375](https://cve.now/CVE-2019-0375.md): SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently enc (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2019-0374](https://cve.now/CVE-2019-0374.md): SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), before versions 4.2 and 4.3, does not sufficiently enc (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2019-0370](https://cve.now/CVE-2019-0370.md): Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to int (no CVSS, SAP SE SAP Financial Consolidation)
- [CVE-2019-0369](https://cve.now/CVE-2019-0369.md): SAP Financial Consolidation, before versions 10.0 and 10.1, does not sufficiently encode user-controlled inputs, which allows an attacker to (no CVSS, SAP SE SAP Financial Consolidation)
- [CVE-2019-0368](https://cve.now/CVE-2019-0368.md): SAP Customer Relationship Management (Email Management), versions: S4CRM before 1.0 and 2.0, BBPCRM before 7.0, 7.01, 7.02, 7.12, 7.13 and 7 (no CVSS, SAP SE SAP Customer Relationship Management)
- [CVE-2019-0367](https://cve.now/CVE-2019-0367.md): SAP NetWeaver Process Integration (B2B Toolkit), before versions 1.0 and 2.0, does not perform necessary authorization checks for an authent (no CVSS, SAP SE SAP NetWeaver Process Integration)
- [CVE-2019-10757](https://cve.now/CVE-2019-10757.md): knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. (no CVSS, knex.js · knex)
- [CVE-2019-10756](https://cve.now/CVE-2019-10756.md): It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui\_notification node accepting raw (no CVSS, node-red-dashboard)
- [CVE-2019-10215](https://cve.now/CVE-2019-10215.md): Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. (CVSS 6.1, Red Hat bootstrap3-typeahead.js)
- [CVE-2019-14846](https://cve.now/CVE-2019-14846.md): In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG (CVSS 7.3, Red Hat Ansible · ansible)
- [CVE-2019-14845](https://cve.now/CVE-2019-14845.md): A vulnerability was found in OpenShift builds, versions 4.1 up to 4.3. (CVSS 5.7, Red Hat openshift)
- [CVE-2019-10963](https://cve.now/CVE-2019-10963.md): Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which ma (no CVSS, Moxa EDR)
- [CVE-2019-10969](https://cve.now/CVE-2019-10969.md): Moxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping feature to execute unauthorized commands on the (no CVSS, Moxa EDR)
- [CVE-2019-17186](https://cve.now/CVE-2019-17186.md): /var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007\_JS\_201804 devices allows pre-authentication remote code execution. (no CVSS)
- [CVE-2019-17134](https://cve.now/CVE-2019-17134.md): Amphora Images in OpenStack Octavia \>=0.10.0 \<2.1.2, \>=3.0.0 \<3.2.0, \>=4.0.0 \<4.1.0 allows anyone with access to the management network to b (no CVSS, octavia)
- [CVE-2019-17105](https://cve.now/CVE-2019-17105.md): The token generator in index.php in Centreon Web before 2.8.27 is predictable. (no CVSS)
- [CVE-2019-17187](https://cve.now/CVE-2019-17187.md): /var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007\_JS\_201804 devices allows pre-authentication Directory Traversal for re (no CVSS)
- [CVE-2018-21024](https://cve.now/CVE-2018-21024.md): licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request. (no CVSS)
- [CVE-2019-17359](https://cve.now/CVE-2019-17359.md): The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError (no CVSS, org.bouncycastle:bcprov-jdk14)
- [CVE-2019-13336](https://cve.now/CVE-2019-13336.md): The dbell Wi-Fi Smart Video Doorbell DB01-S Gen 1 allows remote attackers to launch commands with no authentication verification via TCP por (no CVSS)
- [CVE-2019-17271](https://cve.now/CVE-2019-17271.md): vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter. (no CVSS)
- [CVE-2019-17108](https://cve.now/CVE-2019-17108.md): Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS (no CVSS)
- [CVE-2019-17107](https://cve.now/CVE-2019-17107.md): minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command\_hostaddress parame (no CVSS)
- [CVE-2019-17106](https://cve.now/CVE-2019-17106.md): In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external co (no CVSS, centreon/centreon)
- [CVE-2019-17104](https://cve.now/CVE-2019-17104.md): In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly f (no CVSS, centreon/centreon)
- [CVE-2018-21025](https://cve.now/CVE-2018-21025.md): In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced (no CVSS, centreon/centreon)
- [CVE-2018-21023](https://cve.now/CVE-2018-21023.md): getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns\_id parameter. (no CVSS)
- [CVE-2018-21022](https://cve.now/CVE-2018-21022.md): makeXML\_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host\_id parameter. (no CVSS)
- [CVE-2019-17352](https://cve.now/CVE-2019-17352.md): In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload a (no CVSS, com.jfinal:jfinal)
- [CVE-2018-21021](https://cve.now/CVE-2018-21021.md): img\_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host\_id parameter. (no CVSS)
- [CVE-2018-21020](https://cve.now/CVE-2018-21020.md): In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass aut (no CVSS)
- [CVE-2019-16929](https://cve.now/CVE-2019-16929.md): Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID t (no CVSS, Auth0.AuthenticationApi)
- [CVE-2019-16417](https://cve.now/CVE-2019-16417.md): HRworks FLOW 3.36.9 allows XSS via the purpose of a travel-expense report. (no CVSS)
- [CVE-2019-16416](https://cve.now/CVE-2019-16416.md): HRworks 3.36.9 allows XSS via the purpose of a travel-expense report. (no CVSS)
- [CVE-2019-14657](https://cve.now/CVE-2019-14657.md): Yealink phones through 2019-08-04 have an issue with OpenVPN file upload. (no CVSS)
- [CVE-2019-14656](https://cve.now/CVE-2019-14656.md): Yealink phones through 2019-08-04 do not properly check user roles in POST requests. (no CVSS)
- [CVE-2019-17258](https://cve.now/CVE-2019-17258.md): IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at JPEG\_LS+0x000000000000839c. (no CVSS)
- [CVE-2019-17257](https://cve.now/CVE-2019-17257.md): IrfanView 4.53 allows a Exception Handler Chain to be Corrupted starting at EXR!ReadEXR+0x000000000002af80. (no CVSS)
- [CVE-2019-17256](https://cve.now/CVE-2019-17256.md): IrfanView 4.53 allows a User Mode Write AV starting at DPX!ReadDPX\_W+0x0000000000001203. (no CVSS)
- [CVE-2019-17255](https://cve.now/CVE-2019-17255.md): IrfanView 4.53 allows a User Mode Write AV starting at EXR!ReadEXR+0x0000000000010836. (no CVSS)
- [CVE-2019-17254](https://cve.now/CVE-2019-17254.md): IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at FORMATS!Read\_BadPNG+0x0000000000000101. (no CVSS)
- [CVE-2019-17253](https://cve.now/CVE-2019-17253.md): IrfanView 4.53 allows a User Mode Write AV starting at JPEG\_LS+0x000000000000a6b8. (no CVSS)
- [CVE-2019-17252](https://cve.now/CVE-2019-17252.md): IrfanView 4.53 allows a User Mode Write AV starting at FORMATS!Read\_BadPNG+0x0000000000000115. (no CVSS)
- [CVE-2019-17251](https://cve.now/CVE-2019-17251.md): IrfanView 4.53 allows a User Mode Write AV starting at FORMATS!GetPlugInInfo+0x0000000000007d43. (no CVSS)
- [CVE-2019-17250](https://cve.now/CVE-2019-17250.md): IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x00000000000042f5. (no CVSS)
- [CVE-2019-17249](https://cve.now/CVE-2019-17249.md): IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000d57b. (no CVSS)
- [CVE-2019-17248](https://cve.now/CVE-2019-17248.md): IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x00000000000025b6. (no CVSS)
- [CVE-2019-17247](https://cve.now/CVE-2019-17247.md): IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at JPEG\_LS+0x0000000000007da8. (no CVSS)
- [CVE-2019-17246](https://cve.now/CVE-2019-17246.md): IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000258c. (no CVSS)
- [CVE-2019-17245](https://cve.now/CVE-2019-17245.md): IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x0000000000004359. (no CVSS)
- [CVE-2019-17244](https://cve.now/CVE-2019-17244.md): IrfanView 4.53 allows Data from a Faulting Address to control Code Flow starting at JPEG\_LS+0x0000000000001d8a. (no CVSS)
- [CVE-2019-17243](https://cve.now/CVE-2019-17243.md): IrfanView 4.53 allows Data from a Faulting Address to control Code Flow starting at JPEG\_LS+0x0000000000003155. (no CVSS)
- [CVE-2019-17242](https://cve.now/CVE-2019-17242.md): IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000966f. (no CVSS)
- [CVE-2019-17241](https://cve.now/CVE-2019-17241.md): IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000d563. (no CVSS)
- [CVE-2019-17262](https://cve.now/CVE-2019-17262.md): XnView Classic 2.49.1 allows a User Mode Write AV starting at Xwsq+0x0000000000001fc0. (no CVSS)
- [CVE-2019-17261](https://cve.now/CVE-2019-17261.md): XnView Classic 2.49.1 allows a User Mode Write AV starting at Xwsq+0x0000000000001e51. (no CVSS)
- [CVE-2019-17260](https://cve.now/CVE-2019-17260.md): MPC-HC through 1.7.13 allows a Read Access Violation on a Block Data Move starting at mpc\_hc!memcpy+0x000000000000004e. (no CVSS)
- [CVE-2019-17259](https://cve.now/CVE-2019-17259.md): KMPlayer 4.2.2.31 allows a User Mode Write AV starting at utils!src\_new+0x000000000014d6ee. (no CVSS)
- [CVE-2019-17340](https://cve.now/CVE-2019-17340.md): An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or gain privileges because grant-tabl (no CVSS)
- [CVE-2019-17341](https://cve.now/CVE-2019-17341.md): An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a (no CVSS)
- [CVE-2019-17342](https://cve.now/CVE-2019-17342.md): An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a (no CVSS)
- [CVE-2019-17343](https://cve.now/CVE-2019-17343.md): An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging i (no CVSS)
- [CVE-2019-17344](https://cve.now/CVE-2019-17344.md): An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service by leveraging a long-running opera (no CVSS)
- [CVE-2019-17345](https://cve.now/CVE-2019-17345.md): An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of faile (no CVSS)
- [CVE-2019-17346](https://cve.now/CVE-2019-17346.md): An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because of an i (no CVSS)
- [CVE-2019-17347](https://cve.now/CVE-2019-17347.md): An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because a guest (no CVSS)
- [CVE-2019-17348](https://cve.now/CVE-2019-17348.md): An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service because of an incompatibility betw (no CVSS)
- [CVE-2019-17349](https://cve.now/CVE-2019-17349.md): An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a LoadExcl (no CVSS)
- [CVE-2019-17350](https://cve.now/CVE-2019-17350.md): An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a compare-a (no CVSS)
- [CVE-2019-17351](https://cve.now/CVE-2019-17351.md): An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.