# CVEs published 2019-10-13

6 CVEs were published on October 13, 2019: 2 critical, 0 high. Days are UTC.

- [CVE-2019-17537](https://cve.now/CVE-2019-17537.md): Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file deletion via the web/polygon/problem/deletefile?id=1&name=../ substr (no CVSS)
- [CVE-2019-17538](https://cve.now/CVE-2019-17538.md): Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file reading via the web/polygon/problem/viewfile?id=1&name=../ substring (no CVSS)
- [CVE-2019-17536](https://cve.now/CVE-2019-17536.md): Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. (CVSS 9.9)
- [CVE-2019-17535](https://cve.now/CVE-2019-17535.md): Gila CMS through 1.11.4 allows blog-list.php XSS, in both the gila-blog and gila-mag themes, via the search parameter, a related issue to CV (CVSS 9.3)
- [CVE-2019-17533](https://cve.now/CVE-2019-17533.md): Mat\_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\\0' character, leading to a heap-based buffer over-read in strdup\_vprintf wh (no CVSS)
- [CVE-2019-17534](https://cve.now/CVE-2019-17534.md): vips\_foreign\_load\_gif\_scan\_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifGetImageDesc call, le (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.