# CVEs published 2019-10-11

50 CVEs were published on October 11, 2019: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-18638](https://cve.now/CVE-2017-18638.md): send\_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. (no CVSS, graphite-web)
- [CVE-2019-17176](https://cve.now/CVE-2019-17176.md): Genesys PureEngage Digital (eServices) 8.1.x allows XSS via HtmlChatPanel.jsp or HtmlChatFrameSet.jsp (ActionColor, ClientNickNameColor, Ema (no CVSS)
- [CVE-2019-17506](https://cve.now/CVE-2019-17506.md): There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. (no CVSS)
- [CVE-2018-21028](https://cve.now/CVE-2018-21028.md): Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function. (no CVSS)
- [CVE-2019-17507](https://cve.now/CVE-2019-17507.md): An issue was discovered on D-Link DIR-816 A1 1.06 devices. (no CVSS)
- [CVE-2019-17508](https://cve.now/CVE-2019-17508.md): On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command injection via the $SERVER variable. (no CVSS)
- [CVE-2019-17509](https://cve.now/CVE-2019-17509.md): D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and s (no CVSS)
- [CVE-2019-17510](https://cve.now/CVE-2019-17510.md): D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and s (no CVSS)
- [CVE-2018-21027](https://cve.now/CVE-2018-21027.md): Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled. (no CVSS)
- [CVE-2019-17505](https://cve.now/CVE-2019-17505.md): D-Link DAP-1320 A2-V1.21 routers have some web interfaces without authentication requirements, as demonstrated by uplink\_info.xml. (no CVSS)
- [CVE-2018-20582](https://cve.now/CVE-2018-20582.md): The GREE+ (aka com.gree.greeplus) application 1.4.0.8 for Android suffers from Cross Site Request Forgery. (no CVSS)
- [CVE-2019-2183](https://cve.now/CVE-2019-2183.md): In generateServicesMap of RegisteredServicesCache.java, there is a possible account protection bypass due to a caching optimization. (no CVSS, Android)
- [CVE-2019-2215](https://cve.now/CVE-2019-2215.md): A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. (CVSS 7.8, KEV, Android)
- [CVE-2019-2187](https://cve.now/CVE-2019-2187.md): In nfc\_ncif\_decode\_rf\_params of nfc\_ncif.cc, there is a possible out of bounds read due to an integer underflow. (no CVSS, Android)
- [CVE-2019-2114](https://cve.now/CVE-2019-2114.md): In the default privileges of NFC, there is a possible local bypass of user interaction requirements on package installation due to a default (no CVSS, Android)
- [CVE-2019-2110](https://cve.now/CVE-2019-2110.md): In ScreenRotationAnimation of ScreenRotationAnimation.java, there is a possible capture of a secure screen due to a missing permission check (no CVSS, Android)
- [CVE-2019-2186](https://cve.now/CVE-2019-2186.md): In GetMBheader of combined\_decode.cpp, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-2185](https://cve.now/CVE-2019-2185.md): In VlcDequantH263IntraBlock\_SH of vlc\_dequant.cpp, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-2184](https://cve.now/CVE-2019-2184.md): In PV\_DecodePredictedIntraDC of dec\_pred\_intra\_dc.cpp, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-2173](https://cve.now/CVE-2019-2173.md): In startActivityMayWait of ActivityStarter.java, there is a possible incorrect Activity launch due to an incorrect permission check. (no CVSS, Android)
- [CVE-2015-9492](https://cve.now/CVE-2015-9492.md): The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (s (no CVSS)
- [CVE-2015-9491](https://cve.now/CVE-2015-9491.md): The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information ( (no CVSS)
- [CVE-2015-9490](https://cve.now/CVE-2015-9490.md): The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as u (no CVSS)
- [CVE-2015-9489](https://cve.now/CVE-2015-9489.md): The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (s (no CVSS)
- [CVE-2015-9488](https://cve.now/CVE-2015-9488.md): The ThemeMakers Almera Responsive Portfolio Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensi (no CVSS)
- [CVE-2015-9487](https://cve.now/CVE-2015-9487.md): The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information ( (no CVSS)
- [CVE-2015-9486](https://cve.now/CVE-2015-9486.md): The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (su (no CVSS)
- [CVE-2015-9485](https://cve.now/CVE-2015-9485.md): The ThemeMakers Accio Responsive Parallax One Page Site Template component through 2015-05-15 for WordPress allows remote attackers to obtai (no CVSS)
- [CVE-2015-9484](https://cve.now/CVE-2015-9484.md): The ThemeMakers Accio One Page Parallax Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive inform (no CVSS)
- [CVE-2015-9483](https://cve.now/CVE-2015-9483.md): The ThemeMakers Invento Responsive Gallery/Architecture Template component through 2015-05-15 for WordPress allows remote attackers to obtai (no CVSS)
- [CVE-2015-9482](https://cve.now/CVE-2015-9482.md): The ThemeMakers Car Dealer / Auto Dealer Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive infor (no CVSS)
- [CVE-2019-14570](https://cve.now/CVE-2019-14570.md): Memory corruption in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of s (no CVSS, Intel® NUC Advisory)
- [CVE-2015-9481](https://cve.now/CVE-2015-9481.md): The ThemeMakers Diplomat | Political theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as (no CVSS)
- [CVE-2019-14569](https://cve.now/CVE-2019-14569.md): Pointer corruption in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of (no CVSS, Intel® NUC Advisory)
- [CVE-2019-11167](https://cve.now/CVE-2019-11167.md): Improper file permission in software installer for Intel(R) Smart Connect Technology for Intel(R) NUC may allow an authenticated user to pot (no CVSS, Smart Connect Technology for Intel® NUC Advisory)
- [CVE-2019-11120](https://cve.now/CVE-2019-11120.md): Insufficient path checking in the installer for Intel(R) Active System Console before version 8.0 Build 24 may allow an authenticated user t (no CVSS, Intel® Active System Console Advisory)
- [CVE-2019-6335](https://cve.now/CVE-2019-6335.md): A potential security vulnerability has been identified with Samsung Laser Printers. (no CVSS, Samsung Laser Printers)
- [CVE-2019-17059](https://cve.now/CVE-2019-17059.md): A shell injection vulnerability on the Sophos Cyberoam firewall appliance with CyberoamOS before 10.6.6 MR-6 allows remote attackers to exec (no CVSS)
- [CVE-2019-17503](https://cve.now/CVE-2019-17503.md): An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. (no CVSS)
- [CVE-2019-17504](https://cve.now/CVE-2019-17504.md): An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. (no CVSS)
- [CVE-2019-6333](https://cve.now/CVE-2019-6333.md): A potential security vulnerability has been identified with certain versions of HP Touchpoint Analytics prior to version 4.1.4.2827. (no CVSS, Touchpoint Analytics)
- [CVE-2019-14510](https://cve.now/CVE-2019-14510.md): An issue was discovered in Kaseya VSA RMM through 9.5.0.22. (no CVSS)
- [CVE-2010-5334](https://cve.now/CVE-2010-5334.md): IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. (no CVSS)
- [CVE-2010-5335](https://cve.now/CVE-2010-5335.md): IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. (no CVSS)
- [CVE-2010-5336](https://cve.now/CVE-2010-5336.md): IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: admin/login.html with the parameter username is persistent in 10.2.0. (no CVSS)
- [CVE-2010-5337](https://cve.now/CVE-2010-5337.md): IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter \_dlg\[captcha\]\[controller\] is non-persist (no CVSS)
- [CVE-2010-5338](https://cve.now/CVE-2010-5338.md): IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter \_dlg\[captcha\]\[action\] is non-persistent (no CVSS)
- [CVE-2010-5339](https://cve.now/CVE-2010-5339.md): IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter \_dlg\[captcha\]\[uid\] is non-persistent in (no CVSS)
- [CVE-2010-5340](https://cve.now/CVE-2010-5340.md): IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/ with the parameter password is non-persistent in 10.2.0. (no CVSS)
- [CVE-2019-17499](https://cve.now/CVE-2019-17499.md): The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly validate ping command a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.