# CVEs published 2019-10-09

107 CVEs were published on October 9, 2019: 0 critical, 27 high. Days are UTC.

- [CVE-2019-17420](https://cve.now/CVE-2019-17420.md): In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the http\_header signature (no CVSS)
- [CVE-2019-17418](https://cve.now/CVE-2019-17418.md): An issue was discovered in MetInfo 7.0. (no CVSS)
- [CVE-2019-17419](https://cve.now/CVE-2019-17419.md): An issue was discovered in MetInfo 7.0. (no CVSS)
- [CVE-2019-17417](https://cve.now/CVE-2019-17417.md): PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs. (no CVSS)
- [CVE-2019-17415](https://cve.now/CVE-2019-17415.md): A Structured Exception Handler (SEH) based buffer overflow in File Sharing Wizard 1.5.0 26-8-2008 allows remote unauthenticated attackers to (no CVSS)
- [CVE-2019-17414](https://cve.now/CVE-2019-17414.md): tinylcy Vino through 2017-12-15 allows remote attackers to cause a denial of service ("vn\_get\_string error: Resource temporarily unavailable (no CVSS)
- [CVE-2019-17109](https://cve.now/CVE-2019-17109.md): Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation. (no CVSS, koji)
- [CVE-2019-17365](https://cve.now/CVE-2019-17365.md): Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directorie (no CVSS)
- [CVE-2019-17366](https://cve.now/CVE-2019-17366.md): Citrix Application Delivery Management (ADM) 12.1 before build 54.13 has Incorrect Access Control. (no CVSS)
- [CVE-2019-5699](https://cve.now/CVE-2019-5699.md): NVIDIA Shield TV Experience prior to v8.0.1, NVIDIA Tegra bootloader contains a vulnerability where the software performs an incorrect bound (no CVSS, NVIDIA SHIELD TV)
- [CVE-2019-5700](https://cve.now/CVE-2019-5700.md): NVIDIA Shield TV Experience prior to v8.0.1, NVIDIA Tegra software contains a vulnerability in the bootloader, where it does not validate th (no CVSS, NVIDIA SHIELD TV)
- [CVE-2019-5046](https://cve.now/CVE-2019-5046.md): A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.52 (CVSS 8.8, NitroPDF)
- [CVE-2019-5048](https://cve.now/CVE-2019-5048.md): A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. (CVSS 8.8, NitroPDF)
- [CVE-2019-5050](https://cve.now/CVE-2019-5050.md): A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. (CVSS 8.8, NitroPDF)
- [CVE-2019-5045](https://cve.now/CVE-2019-5045.md): A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.52 (CVSS 8.8, NitroPDF)
- [CVE-2019-5047](https://cve.now/CVE-2019-5047.md): An exploitable Use After Free vulnerability exists in the CharProcs parsing functionality of NitroPDF. (CVSS 7.5, NitroPDF)
- [CVE-2019-5053](https://cve.now/CVE-2019-5053.md): An exploitable use-after-free vulnerability exists in the Length parsing function of NitroPDF. (CVSS 7.5, NitroPDF)
- [CVE-2019-15014](https://cve.now/CVE-2019-15014.md): A command injection vulnerability exists in the Zingbox Inspector versions 1.286 and earlier, that allows for an authenticated user to execu (no CVSS, Palo Alto Networks Zingbox Inspector)
- [CVE-2019-15015](https://cve.now/CVE-2019-15015.md): In the Zingbox Inspector, versions 1.294 and earlier, hardcoded credentials for root and inspector user accounts are present in the system s (no CVSS, Palo Alto Networks Zingbox Inspector)
- [CVE-2019-15016](https://cve.now/CVE-2019-15016.md): An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that allows for unsanitiz (no CVSS, Palo Alto Networks Zingbox Inspector)
- [CVE-2019-15017](https://cve.now/CVE-2019-15017.md): The SSH service is enabled on the Zingbox Inspector versions 1.294 and earlier, exposing SSH to the local network. (no CVSS, Palo Alto Networks Zingbox Inspector)
- [CVE-2019-15018](https://cve.now/CVE-2019-15018.md): A security vulnerability exists in the Zingbox Inspector versions 1.280 and earlier, where authentication is not required when binding the I (no CVSS, Palo Alto Networks Zingbox Inspector)
- [CVE-2019-15019](https://cve.now/CVE-2019-15019.md): A security vulnerability exists in the Zingbox Inspector versions 1.294 and earlier, that could allow an attacker to supply an invalid softw (no CVSS, Palo Alto Networks Zingbox Inspector)
- [CVE-2019-15020](https://cve.now/CVE-2019-15020.md): A security vulnerability exists in the Zingbox Inspector versions 1.293 and earlier, that could allow an attacker to supply an invalid softw (no CVSS, Palo Alto Networks Zingbox Inspector)
- [CVE-2019-15021](https://cve.now/CVE-2019-15021.md): A security vulnerability exists in the Zingbox Inspector versions 1.294 and earlier, that can allow an attacker to easily identify instances (no CVSS, Palo Alto Networks Zingbox Inspector)
- [CVE-2019-15022](https://cve.now/CVE-2019-15022.md): A security vulnerability exists in Zingbox Inspector versions 1.294 and earlier, that allows for the Inspector to be susceptible to ARP spoo (no CVSS, Palo Alto Networks Zingbox Inspector)
- [CVE-2019-15023](https://cve.now/CVE-2019-15023.md): A security vulnerability exists in Zingbox Inspector versions 1.294 and earlier, that results in passwords for 3rd party integrations being (no CVSS, Palo Alto Networks Zingbox Inspector)
- [CVE-2019-1584](https://cve.now/CVE-2019-1584.md): A security vulnerability exists in Zingbox Inspector version 1.293 and earlier, that allows for remote code execution if the Inspector were (no CVSS, Palo Alto Networks Zingbox Inspector)
- [CVE-2019-17112](https://cve.now/CVE-2019-17112.md): An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. (CVSS 4.3)
- [CVE-2019-0075](https://cve.now/CVE-2019-0075.md): Junos OS: SRX Series: Denial of Service vulnerability in srxpfe related to PIM (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0074](https://cve.now/CVE-2019-0074.md): Junos OS: NFX150 Series, QFX10K Series, EX9200 Series, MX Series, PTX Series: Path traversal vulnerability in NFX150 and NG-RE leads to information disclosure. (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2019-0073](https://cve.now/CVE-2019-0073.md): Junos OS: PKI key pairs are exported with insecure file permissions (CVSS 6.6, Juniper Networks Junos OS)
- [CVE-2019-0072](https://cve.now/CVE-2019-0072.md): SBR Carrier: A vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain access to confidential information. (CVSS 5.6, Juniper Networks SBR Carrier)
- [CVE-2019-0071](https://cve.now/CVE-2019-0071.md): Junos OS: EX2300, EX3400 Series: Veriexec signature checking not enforced in specific versions of Junos OS (CVSS 7.8, Juniper Networks Junos OS)
- [CVE-2019-0070](https://cve.now/CVE-2019-0070.md): Junos OS: NFX Series: An Improper Input Validation weakness allows a malicious local attacker to elevate their permissions. (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2019-0069](https://cve.now/CVE-2019-0069.md): Junos OS: vSRX, SRX1500, SRX4K, ACX5K, EX4600, QFX5100, QFX5110, QFX5200, QFX10K and NFX Series: console management port device authentication credentials are logged in clear text (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2019-0068](https://cve.now/CVE-2019-0068.md): Junos OS: SRX Series: Denial of Service vulnerability in flowd due to multicast packets (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2019-0067](https://cve.now/CVE-2019-0067.md): Junos OS: Kernel crash (vmcore) upon receipt of a specific link-local IPv6 packet on devices configured with Multi-Chassis Link Aggregation Group (MC-LAG) (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2019-0066](https://cve.now/CVE-2019-0066.md): Junos OS: A malformed IPv4 packet received by Junos in an NG-mVPN scenario may cause the routing protocol daemon (rpd) process to core (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0065](https://cve.now/CVE-2019-0065.md): Junos OS: MX Series: Denial of Service vulnerability in MS-PIC component on MS-MIC or MS-MPC (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2019-0064](https://cve.now/CVE-2019-0064.md): Junos OS: SRX5000 Series: flowd process crash due to receipt of specific TCP packet (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0063](https://cve.now/CVE-2019-0063.md): Junos OS: MX Series: jdhcpd crash when receiving a specific crafted DHCP response message (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2019-0062](https://cve.now/CVE-2019-0062.md): Junos OS: Session fixation vulnerability in J-Web (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0061](https://cve.now/CVE-2019-0061.md): Junos OS: Insecure management daemon (MGD) configuration may allow local privilege escalation (CVSS 7.8, Juniper Networks Junos OS)
- [CVE-2019-0060](https://cve.now/CVE-2019-0060.md): Junos OS: SRX Series: flowd process crash due to processing of specific transit IP packets (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0059](https://cve.now/CVE-2019-0059.md): Junos OS: The routing protocol process (rpd) may crash and generate core files upon receipt of specific valid BGP states from a peered host. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0058](https://cve.now/CVE-2019-0058.md): Junos OS: SRX Series: A weakness in the Veriexec subsystem may allow privilege escalation. (CVSS 7.8, Juniper Networks Junos OS)
- [CVE-2019-0057](https://cve.now/CVE-2019-0057.md): NFX Series: An attacker may be able to take control of the JDM application and subsequently the entire system. (CVSS 7.8, Juniper Networks Junos OS)
- [CVE-2019-0056](https://cve.now/CVE-2019-0056.md): Junos OS: MX Series: An MPC10 Denial of Service (DoS) due to OSPF states transitioning to Down, causes traffic to stop forwarding through the device. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0055](https://cve.now/CVE-2019-0055.md): Junos OS: SRX Series: An attacker may cause flowd to crash by sending certain valid SIP traffic to a device with SIP ALG enabled. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0054](https://cve.now/CVE-2019-0054.md): Junos OS: SRX Series: An attacker may be able to perform Man-in-the-Middle (MitM) attacks during app-id signature updates. (CVSS 6.8, Juniper Networks Junos OS)
- [CVE-2019-0051](https://cve.now/CVE-2019-0051.md): SRX5000 Series: Denial of Service vulnerability in SSL-Proxy feature. (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2019-0050](https://cve.now/CVE-2019-0050.md): Junos OS: SRX1500: Denial of service due to crash of srxpfe process under heavy traffic conditions. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2019-0047](https://cve.now/CVE-2019-0047.md): Junos OS: Persistent XSS vulnerability in J-Web (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2019-3765](https://cve.now/CVE-2019-3765.md): Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2. (CVSS 8.1, Dell Avamar · Dell Integrated Data Protection Appliance)
- [CVE-2019-15715](https://cve.now/CVE-2019-15715.md): MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution. (no CVSS, mantisbt/mantisbt)
- [CVE-2019-9535](https://cve.now/CVE-2019-9535.md): iTerm2, up to and including version 3.3.5, with tmux integration is vulnerable to remote command execution (no CVSS, iTerm2)
- [CVE-2019-5507](https://cve.now/CVE-2019-5507.md): SnapManager for Oracle prior to version 3.4.2P1 are susceptible to a vulnerability which when successfully exploited could lead to disclosur (no CVSS, SnapManager for Oracle)
- [CVE-2019-17092](https://cve.now/CVE-2019-17092.md): An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2019-17401](https://cve.now/CVE-2019-17401.md): libyal liblnk 20191006 has a heap-based buffer over-read in the network\_share\_name\_offset\>20 code block of liblnk\_location\_information\_read\_ (no CVSS)
- [CVE-2019-5506](https://cve.now/CVE-2019-5506.md): Clustered Data ONTAP versions 9.0 and higher do not enforce hostname verification under certain circumstances making them susceptible to imp (no CVSS, Clustered Data ONTAP)
- [CVE-2019-17399](https://cve.now/CVE-2019-17399.md): The Shack Forms Pro extension before 4.0.32 for Joomla! allows path traversal via a file attachment. (no CVSS)
- [CVE-2019-17389](https://cve.now/CVE-2019-17389.md): In RIOT 2019.07, the MQTT-SN implementation (asymcute) mishandles errors occurring during a read operation on a UDP socket. (no CVSS)
- [CVE-2019-17124](https://cve.now/CVE-2019-17124.md): Kramer VIAware 2.5.0719.1034 has Incorrect Access Control. (no CVSS)
- [CVE-2019-17385](https://cve.now/CVE-2019-17385.md): The animate-it plugin before 2.3.5 for WordPress has XSS. (no CVSS)
- [CVE-2019-17384](https://cve.now/CVE-2019-17384.md): The animate-it plugin before 2.3.4 for WordPress has XSS. (no CVSS)
- [CVE-2019-13529](https://cve.now/CVE-2019-13529.md): An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissio (CVSS 8.8, SMA Solar Technology AG Sunny WebBox)
- [CVE-2019-15226](https://cve.now/CVE-2019-15226.md): Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the head (no CVSS)
- [CVE-2019-17380](https://cve.now/CVE-2019-17380.md): cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528). (no CVSS)
- [CVE-2019-17379](https://cve.now/CVE-2019-17379.md): cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527). (no CVSS)
- [CVE-2019-17378](https://cve.now/CVE-2019-17378.md): cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526). (no CVSS)
- [CVE-2019-17377](https://cve.now/CVE-2019-17377.md): cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524). (no CVSS)
- [CVE-2019-17376](https://cve.now/CVE-2019-17376.md): cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521). (no CVSS)
- [CVE-2019-17375](https://cve.now/CVE-2019-17375.md): cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517). (no CVSS)
- [CVE-2019-17128](https://cve.now/CVE-2019-17128.md): Netreo OmniCenter through 12.1.1 allows unauthenticated SQL Injection (Boolean Based Blind) in the redirect parameters and parameter name of (no CVSS)
- [CVE-2019-15859](https://cve.now/CVE-2019-15859.md): Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get full access to a devi (no CVSS)
- [CVE-2019-14808](https://cve.now/CVE-2019-14808.md): An issue was discovered in the RENPHO application 3.0.0 for iOS. (no CVSS)
- [CVE-2019-4558](https://cve.now/CVE-2019-4558.md): A security vulnerability has been identified in all levels of IBM Spectrum Scale V5.0.0.0 through V5.0.3.2 and IBM Spectrum Scale V4.2.0.0 t (CVSS 8.1, IBM Spectrum Scale)
- [CVE-2019-4512](https://cve.now/CVE-2019-4512.md): IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks aga (CVSS 4.3, IBM Maximo Asset Management)
- [CVE-2019-11341](https://cve.now/CVE-2019-11341.md): On certain Samsung P(9.0) phones, an attacker with physical access can start a TCP Dump capture without the user's knowledge. (no CVSS)
- [CVE-2019-17383](https://cve.now/CVE-2019-17383.md): The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the targ (no CVSS, netaddr)
- [CVE-2019-3653](https://cve.now/CVE-2019-3653.md): ESConfig Tool access not controlled (CVSS 4.6, McAfee Endpoint Security)
- [CVE-2019-3652](https://cve.now/CVE-2019-3652.md): ENS code injection in EPSetup.exe (CVSS 5.0, McAfee Endpoint Security)
- [CVE-2019-6471](https://cve.now/CVE-2019-6471.md): A race condition when discarding malformed packets can cause BIND to exit with an assertion failure (CVSS 5.9, ISC BIND)
- [CVE-2019-6469](https://cve.now/CVE-2019-6469.md): BIND Supported Preview Edition can exit with an assertion failure if ECS is in use (CVSS 5.9, ISC BIND 9 Supported Preview Edition)
- [CVE-2019-6468](https://cve.now/CVE-2019-6468.md): BIND Supported Preview Edition can exit with an assertion failure if nxdomain-redirect is used (CVSS 5.3, ISC BIND 9 Supported Preview Edition)
- [CVE-2019-6467](https://cve.now/CVE-2019-6467.md): An error in the nxdomain redirect feature can cause BIND to exit with an INSIST assertion failure in query.c (CVSS 5.9, ISC BIND)
- [CVE-2019-6465](https://cve.now/CVE-2019-6465.md): Zone transfer controls for writable DLZ zones were not effective (CVSS 5.3, ISC BIND)
- [CVE-2018-5745](https://cve.now/CVE-2018-5745.md): An assertion failure can occur if a trust anchor rolls over to an unsupported key algorithm when using managed-keys (CVSS 4.9, ISC BIND)
- [CVE-2018-5744](https://cve.now/CVE-2018-5744.md): A specially crafted packet can cause named to leak memory (CVSS 7.5, ISC BIND)
- [CVE-2018-5743](https://cve.now/CVE-2018-5743.md): Limiting simultaneous TCP clients was ineffective (CVSS 7.5, ISC BIND)
- [CVE-2018-5732](https://cve.now/CVE-2018-5732.md): A specially constructed response from a malicious server can cause a buffer overflow in dhclient (CVSS 7.5, ISC DHCP)
- [CVE-2019-11212](https://cve.now/CVE-2019-11212.md): TIBCO MDM Exposes Cross-Site Scripting Vulnerabilities (CVSS 6.3, TIBCO Software TIBCO MDM)
- [CVE-2019-17371](https://cve.now/CVE-2019-17371.md): gif2png 2.5.13 has a memory leak in the writefile function. (no CVSS)
- [CVE-2019-17373](https://cve.now/CVE-2019-17373.md): Certain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg, such as by appending (no CVSS)
- [CVE-2019-17372](https://cve.now/CVE-2019-17372.md): Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. (no CVSS)
- [CVE-2019-17354](https://cve.now/CVE-2019-17354.md): wan.htm page on Zyxel NBG-418N v2 with firmware version V1.00(AARP.9)C0 can be accessed directly without authentication, which can lead to d (no CVSS)
- [CVE-2019-17353](https://cve.now/CVE-2019-17353.md): An issue discovered on D-Link DIR-615 devices with firmware version 20.05 and 20.07. (no CVSS)
- [CVE-2019-15719](https://cve.now/CVE-2019-15719.md): Altair PBS Professional through 19.1.2 allows Privilege Escalation because an attacker can send a message directly to pbs\_mom, which fails t (no CVSS)
- [CVE-2019-13051](https://cve.now/CVE-2019-13051.md): Pi-Hole 4.3 allows Command Injection. (no CVSS)
- [CVE-2019-17370](https://cve.now/CVE-2019-17370.md): OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFile\_deal.php blocks "into outfile" in a SELECT statement, but does no (no CVSS)
- [CVE-2019-17369](https://cve.now/CVE-2019-17369.md): OTCMS v3.85 has CSRF in the admin/member\_deal.php Admin Panel page, leading to creation of a new management group account, as demonstrated b (no CVSS)
- [CVE-2019-17368](https://cve.now/CVE-2019-17368.md): S-CMS v1.5 has XSS in tpl.php via the member/member\_login.php from parameter. (no CVSS)
- [CVE-2019-16905](https://cve.now/CVE-2019-16905.md): OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a clie (no CVSS)
- [CVE-2019-17362](https://cve.now/CVE-2019-17362.md): In LibTomCrypt through 1.18.2, the der\_decode\_utf8\_string function (in der\_decode\_utf8\_string.c) does not properly detect certain invalid UT (no CVSS)
- [CVE-2019-17382](https://cve.now/CVE-2019-17382.md): An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. (no CVSS)
- [CVE-2019-17402](https://cve.now/CVE-2019-17402.md): Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirect (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.