# CVEs published 2019-10-10

131 CVEs were published on October 10, 2019: 0 critical, 4 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2019-17497](https://cve.now/CVE-2019-17497.md): Tracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a related issue to CVE (no CVSS)
- [CVE-2019-17496](https://cve.now/CVE-2019-17496.md): Craft CMS before 3.3.8 has stored XSS via a name field. (no CVSS, craftcms/cms)
- [CVE-2019-17495](https://cve.now/CVE-2019-17495.md): A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO (no CVSS, swagger-ui · org.webjars:swagger-ui +2)
- [CVE-2019-17488](https://cve.now/CVE-2019-17488.md): b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header. (no CVSS)
- [CVE-2019-17489](https://cve.now/CVE-2019-17489.md): Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem\[title\] parameter to web/polygon/problem/create or web/polygon/problem/update (no CVSS)
- [CVE-2019-17490](https://cve.now/CVE-2019-17490.md): app\\modules\\polygon\\controllers\\ProblemController in Jiangnan Online Judge (aka jnoj) 0.8.0 allows arbitrary file upload, as demonstrated by (no CVSS)
- [CVE-2019-17491](https://cve.now/CVE-2019-17491.md): Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem\[description\] parameter to web/admin/problem/create or web/polygon/problem/upd (no CVSS)
- [CVE-2019-17493](https://cve.now/CVE-2019-17493.md): Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem\[sample\_input\] parameter to web/admin/problem/create or web/polygon/problem/up (no CVSS)
- [CVE-2019-17494](https://cve.now/CVE-2019-17494.md): laravel-bjyblog 6.1.1 has XSS via a crafted URL. (no CVSS)
- [CVE-2019-9534](https://cve.now/CVE-2019-9534.md): The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image (no CVSS, Cobham plc Explorer)
- [CVE-2019-9533](https://cve.now/CVE-2019-9533.md): The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08 (no CVSS, Cobham plc Explorer)
- [CVE-2019-9532](https://cve.now/CVE-2019-9532.md): The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext (no CVSS, Cobham plc Explorer)
- [CVE-2019-9531](https://cve.now/CVE-2019-9531.md): The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to a port that can run AT commands (no CVSS, Cobham plc Explorer)
- [CVE-2019-9530](https://cve.now/CVE-2019-9530.md): The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files (no CVSS, Cobham plc Explorer)
- [CVE-2019-9529](https://cve.now/CVE-2019-9529.md): The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default (no CVSS, Cobham plc Explorer)
- [CVE-2019-17386](https://cve.now/CVE-2019-17386.md): The animate-it plugin before 2.3.6 for WordPress has CSRF in edsanimate.php. (no CVSS)
- [CVE-2019-11527](https://cve.now/CVE-2019-11527.md): An issue was discovered in Softing uaGate SI 1.60.01. (no CVSS)
- [CVE-2019-11528](https://cve.now/CVE-2019-11528.md): An issue was discovered in Softing uaGate SI 1.60.01. (no CVSS)
- [CVE-2019-15051](https://cve.now/CVE-2019-15051.md): An issue was discovered in Softing uaGate (SI, MB, 840D) firmware through 1.71.00.1225. (no CVSS)
- [CVE-2019-11526](https://cve.now/CVE-2019-11526.md): An issue was discovered in Softing uaGate SI 1.60.01. (no CVSS)
- [CVE-2019-14810](https://cve.now/CVE-2019-14810.md): A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. (no CVSS)
- [CVE-2019-17455](https://cve.now/CVE-2019-17455.md): Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write op (no CVSS)
- [CVE-2019-17452](https://cve.now/CVE-2019-17452.md): Bento4 1.5.1.0 has a NULL pointer dereference in AP4\_DescriptorListInspector::Action in Core/Ap4Descriptor.h, related to AP4\_IodsAtom::Inspe (no CVSS)
- [CVE-2019-17453](https://cve.now/CVE-2019-17453.md): Bento4 1.5.1.0 has a NULL pointer dereference in AP4\_DescriptorListWriter::Action in Core/Ap4Descriptor.h, related to AP4\_IodsAtom::WriteFie (no CVSS)
- [CVE-2019-17454](https://cve.now/CVE-2019-17454.md): Bento4 1.5.1.0 has a NULL pointer dereference in AP4\_Descriptor::GetTag in Core/Ap4Descriptor.h, related to AP4\_StsdAtom::GetSampleDescripti (no CVSS)
- [CVE-2019-5535](https://cve.now/CVE-2019-5535.md): VMware Workstation and Fusion contain a network denial-of-service vulnerability due to improper handling of certain IPv6 packets. (no CVSS, VMware Workstation and Fusion)
- [CVE-2019-5527](https://cve.now/CVE-2019-5527.md): ESXi, Workstation, Fusion, VMRC and Horizon Client contain a use-after-free vulnerability in the virtual sound device. (no CVSS, ESXi, Workstation, Fusion, VMRC and Horizon Client)
- [CVE-2015-9480](https://cve.now/CVE-2015-9480.md): The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter. (no CVSS)
- [CVE-2019-17450](https://cve.now/CVE-2019-17450.md): find\_abstract\_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows rem (no CVSS)
- [CVE-2015-9479](https://cve.now/CVE-2015-9479.md): The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery (no CVSS)
- [CVE-2019-17451](https://cve.now/CVE-2019-17451.md): An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. (no CVSS)
- [CVE-2015-9478](https://cve.now/CVE-2015-9478.md): prettyPhoto before 3.1.6 has js/jquery.prettyPhoto.js XSS. (no CVSS)
- [CVE-2015-9477](https://cve.now/CVE-2015-9477.md): The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates. (no CVSS)
- [CVE-2015-9476](https://cve.now/CVE-2015-9476.md): The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates. (no CVSS)
- [CVE-2015-9475](https://cve.now/CVE-2015-9475.md): The Pont theme 1.5 for WordPress has insufficient restrictions on option updates. (no CVSS)
- [CVE-2015-9474](https://cve.now/CVE-2015-9474.md): The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates. (no CVSS)
- [CVE-2015-9473](https://cve.now/CVE-2015-9473.md): The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter. (no CVSS)
- [CVE-2015-9472](https://cve.now/CVE-2015-9472.md): The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header. (no CVSS)
- [CVE-2015-9471](https://cve.now/CVE-2015-9471.md): The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload. (no CVSS)
- [CVE-2015-9463](https://cve.now/CVE-2015-9463.md): The s3bubble-amazon-s3-audio-streaming plugin 2.0 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/down (no CVSS)
- [CVE-2015-9470](https://cve.now/CVE-2015-9470.md): The history-collection plugin through 1.1.1 for WordPress has directory traversal via the download.php var parameter. (no CVSS)
- [CVE-2015-9469](https://cve.now/CVE-2015-9469.md): The content-grabber plugin 1.0 for WordPress has XSS via obj\_field\_name or obj\_field\_id. (no CVSS)
- [CVE-2015-9468](https://cve.now/CVE-2015-9468.md): The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action. (no CVSS)
- [CVE-2015-9467](https://cve.now/CVE-2015-9467.md): The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter. (no CVSS)
- [CVE-2015-9466](https://cve.now/CVE-2015-9466.md): The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP\_CLIENT\_IP, HTTP\_X\_FORWARDED\_FOR, H (no CVSS)
- [CVE-2015-9465](https://cve.now/CVE-2015-9465.md): The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr\_get\_multi\_set\_values\_and\_field SQL injection via the set\_id paramete (no CVSS)
- [CVE-2015-9464](https://cve.now/CVE-2015-9464.md): The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/co (no CVSS)
- [CVE-2019-17449](https://cve.now/CVE-2019-17449.md): Avira Software Updater before 2.0.6.21094 allows a DLL side-loading attack. (no CVSS)
- [CVE-2015-9462](https://cve.now/CVE-2015-9462.md): The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp\_get\_new\_category\_page SQL injection via the cat\_id parameter. (no CVSS)
- [CVE-2015-9461](https://cve.now/CVE-2015-9461.md): The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp\_get\_new\_portfolio\_item\_page SQL injection via the item\_id parameter (no CVSS)
- [CVE-2015-9460](https://cve.now/CVE-2015-9460.md): The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter. (no CVSS)
- [CVE-2015-9459](https://cve.now/CVE-2015-9459.md): The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter. (no CVSS)
- [CVE-2015-9458](https://cve.now/CVE-2015-9458.md): The searchterms-tagging-2 plugin through 1.535 for WordPress has SQL injection via the pk\_stt2\_db\_get\_popular\_terms count parameter exploita (no CVSS)
- [CVE-2015-9457](https://cve.now/CVE-2015-9457.md): The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::list\_links SQL injection via the group parameter. (no CVSS)
- [CVE-2019-17320](https://cve.now/CVE-2019-17320.md): NetSarang XFTP Client 6.0149 and earlier version contains a buffer overflow vulnerability caused by improper boundary checks when copying fi (no CVSS, NetSarang XFTP)
- [CVE-2019-4265](https://cve.now/CVE-2019-4265.md): IBM Maximo Anywhere 7.6.0, 7.6.1, 7.6.2, and 7.6.3 does not have device root detection which could result in an attacker gaining sensitive i (CVSS 2.4, IBM Maximo Anywhere)
- [CVE-2019-10923](https://cve.now/CVE-2019-10923.md): An attacker with network access to an affected product may cause a denial of service condition by breaking the real-time synchronization (IR (CVSS 7.5, Siemens Development/Evaluation Kits for PROFINET IO: DK… +64)
- [CVE-2019-13921](https://cve.now/CVE-2019-13921.md): A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions \< SP3 Update 1). (no CVSS, Siemens AG SIMATIC WinAC RTX (F))
- [CVE-2019-13929](https://cve.now/CVE-2019-13929.md): A vulnerability has been identified in SIMATIC IT UADM (All versions \< V1.3). (no CVSS, Siemens AG SIMATIC IT UADM)
- [CVE-2019-1345](https://cve.now/CVE-2019-1345.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-1346](https://cve.now/CVE-2019-1346.md): A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. (no CVSS, Microsoft Windows)
- [CVE-2019-1347](https://cve.now/CVE-2019-1347.md): A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. (no CVSS, Microsoft Windows)
- [CVE-2019-1356](https://cve.now/CVE-2019-1356.md): An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory, aka 'Microsoft E (no CVSS, Microsoft Edge (EdgeHTML-based) on Windows Server · Microso…)
- [CVE-2019-1357](https://cve.now/CVE-2019-1357.md): A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies, aka 'Microsoft Browser Spoofing Vulnerability'. (no CVSS, Microsoft Internet Explorer · Microsoft Edge (EdgeHTML-base…)
- [CVE-2019-1358](https://cve.now/CVE-2019-1358.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-1359](https://cve.now/CVE-2019-1359.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-1361](https://cve.now/CVE-2019-1361.md): An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphi (no CVSS, Microsoft Windows)
- [CVE-2019-1362](https://cve.now/CVE-2019-1362.md): An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, ak (no CVSS, Microsoft Windows)
- [CVE-2019-1363](https://cve.now/CVE-2019-1363.md): An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowi (no CVSS, Microsoft Windows)
- [CVE-2019-1364](https://cve.now/CVE-2019-1364.md): An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, ak (no CVSS, Microsoft Windows)
- [CVE-2019-1365](https://cve.now/CVE-2019-1365.md): An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it (no CVSS, Microsoft Windows)
- [CVE-2019-1366](https://cve.now/CVE-2019-1366.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit… +4)
- [CVE-2019-1368](https://cve.now/CVE-2019-1368.md): A security feature bypass exists when Windows Secure Boot improperly restricts access to debugging functionality, aka 'Windows Secure Boot S (no CVSS, Microsoft Windows)
- [CVE-2019-1369](https://cve.now/CVE-2019-1369.md): An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory, aka 'Open Enclav (no CVSS, Microsoft Open Enclave SDK)
- [CVE-2019-1371](https://cve.now/CVE-2019-1371.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Cor (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-1372](https://cve.now/CVE-2019-1372.md): An remote code execution vulnerability exists when Azure App Service/ Antares on Azure Stack fails to check the length of a buffer prior to (no CVSS, Microsoft Azure App Service on Azure Stack)
- [CVE-2019-1375](https://cve.now/CVE-2019-1375.md): A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web req (no CVSS, Microsoft Dynamics)
- [CVE-2019-1376](https://cve.now/CVE-2019-1376.md): An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when it improperly enforces permissions, aka (no CVSS, Microsoft SQL Server Management Studio)
- [CVE-2019-1378](https://cve.now/CVE-2019-1378.md): An elevation of privilege vulnerability exists in Windows 10 Update Assistant in the way it handles permissions.A locally authenticated atta (no CVSS, Microsoft Windows Update Assistant)
- [CVE-2019-1318](https://cve.now/CVE-2019-1318.md): A spoofing vulnerability exists when Transport Layer Security (TLS) accesses non- Extended Master Secret (EMS) sessions, aka 'Microsoft Wind (no CVSS, Microsoft Windows)
- [CVE-2019-1319](https://cve.now/CVE-2019-1319.md): An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Repo (no CVSS, Microsoft Windows)
- [CVE-2019-1320](https://cve.now/CVE-2019-1320.md): An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of (no CVSS, Microsoft Windows)
- [CVE-2019-1321](https://cve.now/CVE-2019-1321.md): An elevation of privilege vulnerability exists when Windows CloudStore improperly handles file Discretionary Access Control List (DACL), aka (no CVSS, Microsoft Windows)
- [CVE-2019-1322](https://cve.now/CVE-2019-1322.md): An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2019-1323](https://cve.now/CVE-2019-1323.md): An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'Micr (no CVSS, Microsoft Windows)
- [CVE-2019-1325](https://cve.now/CVE-2019-1325.md): An elevation of privilege vulnerability exists in the Windows redirected drive buffering system (rdbss.sys) when the operating system improp (no CVSS, Microsoft Windows)
- [CVE-2019-1326](https://cve.now/CVE-2019-1326.md): A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends (no CVSS, Microsoft Windows)
- [CVE-2019-1327](https://cve.now/CVE-2019-1327.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka ' (no CVSS, Microsoft Excel · Microsoft Office)
- [CVE-2019-1328](https://cve.now/CVE-2019-1328.md): A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected S (no CVSS, Microsoft SharePoint Foundation · Microsoft SharePoint Ente…)
- [CVE-2019-1329](https://cve.now/CVE-2019-1329.md): An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request t (no CVSS, Microsoft SharePoint Foundation · Microsoft SharePoint Ente…)
- [CVE-2019-1330](https://cve.now/CVE-2019-1330.md): An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'. (no CVSS, Microsoft SharePoint Foundation · Microsoft SharePoint E… +1)
- [CVE-2019-1331](https://cve.now/CVE-2019-1331.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka ' (no CVSS, Microsoft Excel · Microsoft Office +2)
- [CVE-2019-1333](https://cve.now/CVE-2019-1333.md): A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote De (no CVSS, Microsoft Windows)
- [CVE-2019-1334](https://cve.now/CVE-2019-1334.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2019-1335](https://cve.now/CVE-2019-1335.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit… +4)
- [CVE-2019-1336](https://cve.now/CVE-2019-1336.md): An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'Micr (no CVSS, Microsoft Windows)
- [CVE-2019-1337](https://cve.now/CVE-2019-1337.md): An information disclosure vulnerability exists when Windows Update Client fails to properly handle objects in memory, aka 'Windows Update Cl (no CVSS, Microsoft Windows)
- [CVE-2019-1338](https://cve.now/CVE-2019-1338.md): A security feature bypass vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTL (no CVSS, Microsoft Windows)
- [CVE-2019-1339](https://cve.now/CVE-2019-1339.md): An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Report (no CVSS, Microsoft Windows)
- [CVE-2019-1340](https://cve.now/CVE-2019-1340.md): An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations.To exploit (no CVSS, Microsoft Windows)
- [CVE-2019-1341](https://cve.now/CVE-2019-1341.md): An elevation of privilege vulnerability exists when umpo.dll of the Power Service, improperly handles a Registry Restore Key function, aka ' (no CVSS, Microsoft Windows)
- [CVE-2019-1342](https://cve.now/CVE-2019-1342.md): An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash, aka 'Windows Error R (no CVSS, Microsoft Windows)
- [CVE-2019-1343](https://cve.now/CVE-2019-1343.md): A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-1344](https://cve.now/CVE-2019-1344.md): An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memory, aka 'Windows Cod (no CVSS, Microsoft Windows)
- [CVE-2019-0608](https://cve.now/CVE-2019-0608.md): A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content, aka 'Microsoft Browser Spoofing Vulnerability' (no CVSS, Microsoft Internet Explorer · Microsoft Edge (EdgeHTML-b… +3)
- [CVE-2019-1060](https://cve.now/CVE-2019-1060.md): A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-1070](https://cve.now/CVE-2019-1070.md): A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques (no CVSS, Microsoft SharePoint Foundation · Microsoft SharePoint Ente…)
- [CVE-2019-1166](https://cve.now/CVE-2019-1166.md): A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message (no CVSS, Microsoft Windows)
- [CVE-2019-1230](https://cve.now/CVE-2019-1230.md): An information disclosure vulnerability exists when the Windows Hyper-V Network Switch on a host operating system fails to properly validate (no CVSS, Microsoft Windows)
- [CVE-2019-1238](https://cve.now/CVE-2019-1238.md): A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-1239](https://cve.now/CVE-2019-1239.md): A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-1307](https://cve.now/CVE-2019-1307.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit… +4)
- [CVE-2019-1308](https://cve.now/CVE-2019-1308.md): A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C (no CVSS, Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit… +4)
- [CVE-2019-1311](https://cve.now/CVE-2019-1311.md): A remote code execution vulnerability exists when the Windows Imaging API improperly handles objects in memory, aka 'Windows Imaging API Rem (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-1313](https://cve.now/CVE-2019-1313.md): An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when it improperly enforces permissions, aka (no CVSS, Microsoft SQL Server Management Studio)
- [CVE-2019-1314](https://cve.now/CVE-2019-1314.md): A security feature bypass vulnerability exists in Windows 10 Mobile when Cortana allows a user to access files and folders through the locke (no CVSS, Microsoft Windows 10 Mobile)
- [CVE-2019-1315](https://cve.now/CVE-2019-1315.md): An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Report (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2019-1316](https://cve.now/CVE-2019-1316.md): An elevation of privilege vulnerability exists in Microsoft Windows Setup when it does not properly handle privileges, aka 'Microsoft Window (no CVSS, Microsoft Windows)
- [CVE-2019-1317](https://cve.now/CVE-2019-1317.md): A denial of service vulnerability exists when Windows improperly handles hard links, aka 'Microsoft Windows Denial of Service Vulnerability' (no CVSS, Microsoft Windows)
- [CVE-2019-17434](https://cve.now/CVE-2019-17434.md): LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen. (no CVSS)
- [CVE-2019-17433](https://cve.now/CVE-2019-17433.md): z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation log" screen. (no CVSS, encore/laravel-admin)
- [CVE-2019-17431](https://cve.now/CVE-2019-17431.md): An issue was discovered in fastadmin 1.0.0.20190705\_beta. (no CVSS)
- [CVE-2019-17432](https://cve.now/CVE-2019-17432.md): An issue was discovered in fastadmin 1.0.0.20190705\_beta. (no CVSS)
- [CVE-2019-17072](https://cve.now/CVE-2019-17072.md): The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query (no CVSS)
- [CVE-2019-17071](https://cve.now/CVE-2019-17071.md): The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS. (no CVSS)
- [CVE-2019-17070](https://cve.now/CVE-2019-17070.md): The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer. (no CVSS)
- [CVE-2019-17429](https://cve.now/CVE-2019-17429.md): Adhouma CMS through 2019-10-09 has SQL Injection via the post.php p\_id parameter. (no CVSS)
- [CVE-2019-17430](https://cve.now/CVE-2019-17430.md): EyouCms through 2019-07-11 has XSS related to the login.php web\_recordnum parameter. (no CVSS)
- [CVE-2019-17427](https://cve.now/CVE-2019-17427.md): In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors. (no CVSS)
- [CVE-2019-17426](https://cve.now/CVE-2019-17426.md): Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a \_bsontype (no CVSS, mongoose)
- [CVE-2019-10936](https://cve.now/CVE-2019-10936.md): Affected devices improperly handle large amounts of specially crafted UDP packets. (CVSS 7.5, Siemens Development/Evaluation Kits for PROFINET IO: DK… +75)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.