CVEs published October 9, 2019
107 CVEs were published on October 9, 2019: 0 critical, 27 high.
- Published
- 107
- Critical
- 0
- High
- 27
- Medium
- 21
- Low
- 0
- Unrated
- 59
- Now in CISA KEV
- 0
- Fix available
- 26
Most affected products
- Juniper Networks Junos OS
- 24
- Palo Alto Networks Zingbox Inspector
- 11
- ISC BIND
- 6
- NitroPDF
- 6
- ISC BIND 9 Supported Preview Edition
- 2
- McAfee Endpoint Security
- 2
- NVIDIA SHIELD TV
- 2
- Clustered Data ONTAP
- 1
- Dell Avamar · Dell Integrated Data Protection Appliance
- 1
- IBM Maximo Asset Management
- 1
High 27
- CVE-2019-5046A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.52NitroPDF
- CVE-2019-5048A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522.NitroPDF
- CVE-2019-5050A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522.NitroPDF
- CVE-2019-5045A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.52NitroPDF
- CVE-2019-5047An exploitable Use After Free vulnerability exists in the CharProcs parsing functionality of NitroPDF.NitroPDF
- CVE-2019-5053An exploitable use-after-free vulnerability exists in the Length parsing function of NitroPDF.NitroPDF
- CVE-2019-0075Junos OS: SRX Series: Denial of Service vulnerability in srxpfe related to PIMJuniper Networks Junos OS
- CVE-2019-0071Junos OS: EX2300, EX3400 Series: Veriexec signature checking not enforced in specific versions of Junos OSJuniper Networks Junos OS
- CVE-2019-0070Junos OS: NFX Series: An Improper Input Validation weakness allows a malicious local attacker to elevate their permissions.Juniper Networks Junos OS
- CVE-2019-0066Junos OS: A malformed IPv4 packet received by Junos in an NG-mVPN scenario may cause the routing protocol daemon (rpd) process to coreJuniper Networks Junos OS
- CVE-2019-0064Junos OS: SRX5000 Series: flowd process crash due to receipt of specific TCP packetJuniper Networks Junos OS
- CVE-2019-0062Junos OS: Session fixation vulnerability in J-WebJuniper Networks Junos OS
- CVE-2019-0061Junos OS: Insecure management daemon (MGD) configuration may allow local privilege escalationJuniper Networks Junos OS
- CVE-2019-0060Junos OS: SRX Series: flowd process crash due to processing of specific transit IP packetsJuniper Networks Junos OS
- CVE-2019-0059Junos OS: The routing protocol process (rpd) may crash and generate core files upon receipt of specific valid BGP states from a peered host.Juniper Networks Junos OS
- CVE-2019-0058Junos OS: SRX Series: A weakness in the Veriexec subsystem may allow privilege escalation.Juniper Networks Junos OS
- CVE-2019-0057NFX Series: An attacker may be able to take control of the JDM application and subsequently the entire system.Juniper Networks Junos OS
- CVE-2019-0056Junos OS: MX Series: An MPC10 Denial of Service (DoS) due to OSPF states transitioning to Down, causes traffic to stop forwarding through the device.Juniper Networks Junos OS
- CVE-2019-0055Junos OS: SRX Series: An attacker may cause flowd to crash by sending certain valid SIP traffic to a device with SIP ALG enabled.Juniper Networks Junos OS
- CVE-2019-0050Junos OS: SRX1500: Denial of service due to crash of srxpfe process under heavy traffic conditions.Juniper Networks Junos OS
- CVE-2019-0047Junos OS: Persistent XSS vulnerability in J-WebJuniper Networks Junos OS
- CVE-2019-3765Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.Dell Avamar · Dell Integrated Data Protection Appliance
- CVE-2019-13529An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissioSMA Solar Technology AG Sunny WebBox
- CVE-2019-4558A security vulnerability has been identified in all levels of IBM Spectrum Scale V5.0.0.0 through V5.0.3.2 and IBM Spectrum Scale V4.2.0.0 tIBM Spectrum Scale
- CVE-2018-5744A specially crafted packet can cause named to leak memoryISC BIND
- CVE-2018-5743Limiting simultaneous TCP clients was ineffectiveISC BIND
- CVE-2018-5732A specially constructed response from a malicious server can cause a buffer overflow in dhclientISC DHCP
Medium, low and unrated 80
- CVE-2019-17420In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the http_header signature
- CVE-2019-17418An issue was discovered in MetInfo 7.0.
- CVE-2019-17419An issue was discovered in MetInfo 7.0.
- CVE-2019-17417PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs.
- CVE-2019-17415A Structured Exception Handler (SEH) based buffer overflow in File Sharing Wizard 1.5.0 26-8-2008 allows remote unauthenticated attackers to
- CVE-2019-17414tinylcy Vino through 2017-12-15 allows remote attackers to cause a denial of service ("vn_get_string error: Resource temporarily unavailable
- CVE-2019-17109Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation.koji
- CVE-2019-17365Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directorie
- CVE-2019-17366Citrix Application Delivery Management (ADM) 12.1 before build 54.13 has Incorrect Access Control.
- CVE-2019-5699NVIDIA Shield TV Experience prior to v8.0.1, NVIDIA Tegra bootloader contains a vulnerability where the software performs an incorrect boundNVIDIA SHIELD TV
- CVE-2019-5700NVIDIA Shield TV Experience prior to v8.0.1, NVIDIA Tegra software contains a vulnerability in the bootloader, where it does not validate thNVIDIA SHIELD TV
- CVE-2019-15014A command injection vulnerability exists in the Zingbox Inspector versions 1.286 and earlier, that allows for an authenticated user to execuPalo Alto Networks Zingbox Inspector
- CVE-2019-15015In the Zingbox Inspector, versions 1.294 and earlier, hardcoded credentials for root and inspector user accounts are present in the system sPalo Alto Networks Zingbox Inspector
- CVE-2019-15016An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that allows for unsanitizPalo Alto Networks Zingbox Inspector
- CVE-2019-15017The SSH service is enabled on the Zingbox Inspector versions 1.294 and earlier, exposing SSH to the local network.Palo Alto Networks Zingbox Inspector
- CVE-2019-15018A security vulnerability exists in the Zingbox Inspector versions 1.280 and earlier, where authentication is not required when binding the IPalo Alto Networks Zingbox Inspector
- CVE-2019-15019A security vulnerability exists in the Zingbox Inspector versions 1.294 and earlier, that could allow an attacker to supply an invalid softwPalo Alto Networks Zingbox Inspector
- CVE-2019-15020A security vulnerability exists in the Zingbox Inspector versions 1.293 and earlier, that could allow an attacker to supply an invalid softwPalo Alto Networks Zingbox Inspector
- CVE-2019-15021A security vulnerability exists in the Zingbox Inspector versions 1.294 and earlier, that can allow an attacker to easily identify instancesPalo Alto Networks Zingbox Inspector
- CVE-2019-15022A security vulnerability exists in Zingbox Inspector versions 1.294 and earlier, that allows for the Inspector to be susceptible to ARP spooPalo Alto Networks Zingbox Inspector
- CVE-2019-15023A security vulnerability exists in Zingbox Inspector versions 1.294 and earlier, that results in passwords for 3rd party integrations being Palo Alto Networks Zingbox Inspector
- CVE-2019-1584A security vulnerability exists in Zingbox Inspector version 1.293 and earlier, that allows for remote code execution if the Inspector were Palo Alto Networks Zingbox Inspector
- CVE-2019-17112An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012.
- CVE-2019-0074Junos OS: NFX150 Series, QFX10K Series, EX9200 Series, MX Series, PTX Series: Path traversal vulnerability in NFX150 and NG-RE leads to information disclosure.Juniper Networks Junos OS
- CVE-2019-0073Junos OS: PKI key pairs are exported with insecure file permissionsJuniper Networks Junos OS
- CVE-2019-0072SBR Carrier: A vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information.Juniper Networks SBR Carrier
- CVE-2019-0069Junos OS: vSRX, SRX1500, SRX4K, ACX5K, EX4600, QFX5100, QFX5110, QFX5200, QFX10K and NFX Series: console management port device authentication credentials are logged in clear textJuniper Networks Junos OS
- CVE-2019-0068Junos OS: SRX Series: Denial of Service vulnerability in flowd due to multicast packetsJuniper Networks Junos OS
- CVE-2019-0067Junos OS: Kernel crash (vmcore) upon receipt of a specific link-local IPv6 packet on devices configured with Multi-Chassis Link Aggregation Group (MC-LAG)Juniper Networks Junos OS
- CVE-2019-0065Junos OS: MX Series: Denial of Service vulnerability in MS-PIC component on MS-MIC or MS-MPCJuniper Networks Junos OS
- CVE-2019-0063Junos OS: MX Series: jdhcpd crash when receiving a specific crafted DHCP response messageJuniper Networks Junos OS
- CVE-2019-0054Junos OS: SRX Series: An attacker may be able to perform Man-in-the-Middle (MitM) attacks during app-id signature updates.Juniper Networks Junos OS
- CVE-2019-0051SRX5000 Series: Denial of Service vulnerability in SSL-Proxy feature.Juniper Networks Junos OS
- CVE-2019-15715MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.mantisbt/mantisbt
- CVE-2019-9535iTerm2, up to and including version 3.3.5, with tmux integration is vulnerable to remote command executioniTerm2
- CVE-2019-5507SnapManager for Oracle prior to version 3.4.2P1 are susceptible to a vulnerability which when successfully exploited could lead to disclosurSnapManager for Oracle
- CVE-2019-17092An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web scri
- CVE-2019-17401libyal liblnk 20191006 has a heap-based buffer over-read in the network_share_name_offset>20 code block of liblnk_location_information_read_
- CVE-2019-5506Clustered Data ONTAP versions 9.0 and higher do not enforce hostname verification under certain circumstances making them susceptible to impClustered Data ONTAP
- CVE-2019-17399The Shack Forms Pro extension before 4.0.32 for Joomla! allows path traversal via a file attachment.
- CVE-2019-17389In RIOT 2019.07, the MQTT-SN implementation (asymcute) mishandles errors occurring during a read operation on a UDP socket.
- CVE-2019-17124Kramer VIAware 2.5.0719.1034 has Incorrect Access Control.
- CVE-2019-17385The animate-it plugin before 2.3.5 for WordPress has XSS.
- CVE-2019-17384The animate-it plugin before 2.3.4 for WordPress has XSS.
- CVE-2019-15226Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the head
- CVE-2019-17380cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).
- CVE-2019-17379cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527).
- CVE-2019-17378cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526).
- CVE-2019-17377cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524).
- CVE-2019-17376cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521).
- CVE-2019-17375cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).
- CVE-2019-17128Netreo OmniCenter through 12.1.1 allows unauthenticated SQL Injection (Boolean Based Blind) in the redirect parameters and parameter name of
- CVE-2019-15859Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get full access to a devi
- CVE-2019-14808An issue was discovered in the RENPHO application 3.0.0 for iOS.
- CVE-2019-4512IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks agaIBM Maximo Asset Management
- CVE-2019-11341On certain Samsung P(9.0) phones, an attacker with physical access can start a TCP Dump capture without the user's knowledge.
- CVE-2019-17383The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the targnetaddr
- CVE-2019-3653ESConfig Tool access not controlledMcAfee Endpoint Security
- CVE-2019-3652ENS code injection in EPSetup.exeMcAfee Endpoint Security
- CVE-2019-6471A race condition when discarding malformed packets can cause BIND to exit with an assertion failureISC BIND
- CVE-2019-6469BIND Supported Preview Edition can exit with an assertion failure if ECS is in useISC BIND 9 Supported Preview Edition
- CVE-2019-6468BIND Supported Preview Edition can exit with an assertion failure if nxdomain-redirect is usedISC BIND 9 Supported Preview Edition
- CVE-2019-6467An error in the nxdomain redirect feature can cause BIND to exit with an INSIST assertion failure in query.cISC BIND
- CVE-2019-6465Zone transfer controls for writable DLZ zones were not effectiveISC BIND
- CVE-2018-5745An assertion failure can occur if a trust anchor rolls over to an unsupported key algorithm when using managed-keysISC BIND
- CVE-2019-11212TIBCO MDM Exposes Cross-Site Scripting VulnerabilitiesTIBCO Software TIBCO MDM
- CVE-2019-17371gif2png 2.5.13 has a memory leak in the writefile function.
- CVE-2019-17373Certain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg, such as by appending
- CVE-2019-17372Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi.
- CVE-2019-17354wan.htm page on Zyxel NBG-418N v2 with firmware version V1.00(AARP.9)C0 can be accessed directly without authentication, which can lead to d
- CVE-2019-17353An issue discovered on D-Link DIR-615 devices with firmware version 20.05 and 20.07.
- CVE-2019-15719Altair PBS Professional through 19.1.2 allows Privilege Escalation because an attacker can send a message directly to pbs_mom, which fails t
- CVE-2019-13051Pi-Hole 4.3 allows Command Injection.
- CVE-2019-17370OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFile_deal.php blocks "into outfile" in a SELECT statement, but does no
- CVE-2019-17369OTCMS v3.85 has CSRF in the admin/member_deal.php Admin Panel page, leading to creation of a new management group account, as demonstrated b
- CVE-2019-17368S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.
- CVE-2019-16905OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a clie
- CVE-2019-17362In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UT
- CVE-2019-17382An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4.
- CVE-2019-17402Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirect