CVEs published October 11, 2019
50 CVEs were published on October 11, 2019: 0 critical, 1 high. 1 is now in CISA KEV.
- Published
- 50
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 49
- Now in CISA KEV
- 1
- Fix available
- 1
Most affected products
- Android
- 9
- Intel® NUC Advisory
- 2
- graphite-web
- 1
- Intel® Active System Console Advisory
- 1
- Samsung Laser Printers
- 1
- Smart Connect Technology for Intel® NUC Advisory
- 1
- Touchpoint Analytics
- 1
High 1
Medium, low and unrated 49
- CVE-2017-18638send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF.graphite-web
- CVE-2019-17176Genesys PureEngage Digital (eServices) 8.1.x allows XSS via HtmlChatPanel.jsp or HtmlChatFrameSet.jsp (ActionColor, ClientNickNameColor, Ema
- CVE-2019-17506There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers.
- CVE-2018-21028Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.
- CVE-2019-17507An issue was discovered on D-Link DIR-816 A1 1.06 devices.
- CVE-2019-17508On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command injection via the $SERVER variable.
- CVE-2019-17509D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and s
- CVE-2019-17510D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and s
- CVE-2018-21027Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.
- CVE-2019-17505D-Link DAP-1320 A2-V1.21 routers have some web interfaces without authentication requirements, as demonstrated by uplink_info.xml.
- CVE-2018-20582The GREE+ (aka com.gree.greeplus) application 1.4.0.8 for Android suffers from Cross Site Request Forgery.
- CVE-2019-2183In generateServicesMap of RegisteredServicesCache.java, there is a possible account protection bypass due to a caching optimization.Android
- CVE-2019-2187In nfc_ncif_decode_rf_params of nfc_ncif.cc, there is a possible out of bounds read due to an integer underflow.Android
- CVE-2019-2114In the default privileges of NFC, there is a possible local bypass of user interaction requirements on package installation due to a defaultAndroid
- CVE-2019-2110In ScreenRotationAnimation of ScreenRotationAnimation.java, there is a possible capture of a secure screen due to a missing permission checkAndroid
- CVE-2019-2186In GetMBheader of combined_decode.cpp, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2019-2185In VlcDequantH263IntraBlock_SH of vlc_dequant.cpp, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2019-2184In PV_DecodePredictedIntraDC of dec_pred_intra_dc.cpp, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2019-2173In startActivityMayWait of ActivityStarter.java, there is a possible incorrect Activity launch due to an incorrect permission check.Android
- CVE-2015-9492The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (s
- CVE-2015-9491The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (
- CVE-2015-9490The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as u
- CVE-2015-9489The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (s
- CVE-2015-9488The ThemeMakers Almera Responsive Portfolio Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensi
- CVE-2015-9487The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (
- CVE-2015-9486The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (su
- CVE-2015-9485The ThemeMakers Accio Responsive Parallax One Page Site Template component through 2015-05-15 for WordPress allows remote attackers to obtai
- CVE-2015-9484The ThemeMakers Accio One Page Parallax Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive inform
- CVE-2015-9483The ThemeMakers Invento Responsive Gallery/Architecture Template component through 2015-05-15 for WordPress allows remote attackers to obtai
- CVE-2015-9482The ThemeMakers Car Dealer / Auto Dealer Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive infor
- CVE-2019-14570Memory corruption in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of sIntel® NUC Advisory
- CVE-2015-9481The ThemeMakers Diplomat | Political theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as
- CVE-2019-14569Pointer corruption in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of Intel® NUC Advisory
- CVE-2019-11167Improper file permission in software installer for Intel(R) Smart Connect Technology for Intel(R) NUC may allow an authenticated user to potSmart Connect Technology for Intel® NUC Advisory
- CVE-2019-11120Insufficient path checking in the installer for Intel(R) Active System Console before version 8.0 Build 24 may allow an authenticated user tIntel® Active System Console Advisory
- CVE-2019-6335A potential security vulnerability has been identified with Samsung Laser Printers.Samsung Laser Printers
- CVE-2019-17059A shell injection vulnerability on the Sophos Cyberoam firewall appliance with CyberoamOS before 10.6.6 MR-6 allows remote attackers to exec
- CVE-2019-17503An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5.
- CVE-2019-17504An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5.
- CVE-2019-6333A potential security vulnerability has been identified with certain versions of HP Touchpoint Analytics prior to version 4.1.4.2827.Touchpoint Analytics
- CVE-2019-14510An issue was discovered in Kaseya VSA RMM through 9.5.0.22.
- CVE-2010-5334IceWarp Webclient before 10.2.1 has a directory traversal vulnerability.
- CVE-2010-5335IceWarp Webclient before 10.2.1 has a directory traversal vulnerability.
- CVE-2010-5336IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: admin/login.html with the parameter username is persistent in 10.2.0.
- CVE-2010-5337IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][controller] is non-persist
- CVE-2010-5338IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][action] is non-persistent
- CVE-2010-5339IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][uid] is non-persistent in
- CVE-2010-5340IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/ with the parameter password is non-persistent in 10.2.0.
- CVE-2019-17499The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly validate ping command a