CVEs published October 14, 2019
42 CVEs were published on October 14, 2019: 1 critical, 2 high. 1 is now in CISA KEV.
- Published
- 42
- Critical
- 1
- High
- 2
- Medium
- 3
- Low
- 0
- Unrated
- 36
- Now in CISA KEV
- 1
- Fix available
- 4
Most affected products
- csv-parse
- 1
- Dell ImageAssist
- 1
- Dogtag JSS
- 1
- gdal
- 1
- IBM FileNet Content Manager
- 1
- Red Hat Ansible · ansible
- 1
- Red Hat wildfly-core · org.wildfly.core:wildfly-host-contro…
- 1
Critical 1
High 2
Medium, low and unrated 39
- CVE-2019-17594There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-201
- CVE-2019-17595There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012
- CVE-2019-17593JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.
- CVE-2019-17592The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service.csv-parse
- CVE-2019-14823A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it impliDogtag JSS
- CVE-2019-14737Ubisoft Uplay 92.0.0.6280 has Insecure Permissions.
- CVE-2017-14948Certain D-Link products are affected by: Buffer Overflow.
- CVE-2019-16282In NCH Express Invoice v7.12, persistent cross site scripting (XSS) exists via the Invoices/Items/Customers/Quotes input field.
- CVE-2019-12941AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary attack to gain access
- CVE-2019-17043An issue was discovered in BMC Patrol Agent 9.0.10i.
- CVE-2019-17044An issue was discovered in BMC Patrol Agent 9.0.10i.
- CVE-2019-14225OX App Suite 7.10.1 and 7.10.2 allows SSRF.
- CVE-2019-14226OX App Suite through 7.10.2 has Insecure Permissions.
- CVE-2019-14227OX App Suite 7.10.1 and 7.10.2 allows XSS.
- CVE-2019-16279A memory error in the function SSL_accept in nostromo nhttpd through 1.9.6 allows an attacker to trigger a denial of service via a crafted H
- CVE-2019-17583idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonst
- CVE-2019-16519ESET Cyber Security 6.7.900.0 for macOS allows a local attacker to execute unauthorized commands as root by abusing an undocumented feature
- CVE-2019-17580tonyy dormsystem through 1.3 allows SQL Injection in admin.php.
- CVE-2019-17511There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers.
- CVE-2019-17579SonarSource SonarQube before 7.8 has XSS in project links on account/projects.
- CVE-2019-14838A flaw was found in wildfly-core before 7.2.5.GA.Red Hat wildfly-core · org.wildfly.core:wildfly-host-contro…
- CVE-2019-9745CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration.
- CVE-2019-17575A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier.
- CVE-2019-16344A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attacker to inject arbitr
- CVE-2019-17574An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress.
- CVE-2019-4572IBM FileNet Content Manager 5.5.2 and 5.5.3 in specific configurations, could log the web service user credentials into a log file that coulIBM FileNet Content Manager
- CVE-2019-17552An issue was discovered in idreamsoft iCMS v7.0.14.
- CVE-2019-17553An issue was discovered in MetInfo v7.0.0 beta.
- CVE-2019-17408parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the danger_key functi
- CVE-2019-17501Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuratio
- CVE-2019-17539In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there
- CVE-2019-17540ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
- CVE-2019-17542FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vq
- CVE-2019-17543LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_co
- CVE-2019-17544libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ char
- CVE-2019-17545GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.gdal
- CVE-2019-17547In ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free.
- CVE-2019-17546tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes
- CVE-2019-17541ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in code