# CVEs published 2019-10-14

42 CVEs were published on October 14, 2019: 1 critical, 2 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-17594](https://cve.now/CVE-2019-17594.md): There is a heap-based buffer over-read in the \_nc\_find\_entry function in tinfo/comp\_hash.c in the terminfo library in ncurses before 6.1-201 (no CVSS)
- [CVE-2019-17595](https://cve.now/CVE-2019-17595.md): There is a heap-based buffer over-read in the fmt\_entry function in tinfo/comp\_hash.c in the terminfo library in ncurses before 6.1-20191012 (no CVSS)
- [CVE-2019-17593](https://cve.now/CVE-2019-17593.md): JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator. (no CVSS)
- [CVE-2019-17592](https://cve.now/CVE-2019-17592.md): The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. (no CVSS, csv-parse)
- [CVE-2019-14823](https://cve.now/CVE-2019-14823.md): A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it impli (CVSS 6.8, Dogtag JSS)
- [CVE-2019-14737](https://cve.now/CVE-2019-14737.md): Ubisoft Uplay 92.0.0.6280 has Insecure Permissions. (no CVSS)
- [CVE-2019-3767](https://cve.now/CVE-2019-3767.md): Dell ImageAssist versions prior to 8.7.15 contain an information disclosure vulnerability. (CVSS 7.5, Dell ImageAssist)
- [CVE-2017-14948](https://cve.now/CVE-2017-14948.md): Certain D-Link products are affected by: Buffer Overflow. (no CVSS)
- [CVE-2019-16282](https://cve.now/CVE-2019-16282.md): In NCH Express Invoice v7.12, persistent cross site scripting (XSS) exists via the Invoices/Items/Customers/Quotes input field. (no CVSS)
- [CVE-2019-12941](https://cve.now/CVE-2019-12941.md): AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary attack to gain access (no CVSS)
- [CVE-2019-17043](https://cve.now/CVE-2019-17043.md): An issue was discovered in BMC Patrol Agent 9.0.10i. (no CVSS)
- [CVE-2019-17044](https://cve.now/CVE-2019-17044.md): An issue was discovered in BMC Patrol Agent 9.0.10i. (no CVSS)
- [CVE-2019-14225](https://cve.now/CVE-2019-14225.md): OX App Suite 7.10.1 and 7.10.2 allows SSRF. (no CVSS)
- [CVE-2019-14226](https://cve.now/CVE-2019-14226.md): OX App Suite through 7.10.2 has Insecure Permissions. (no CVSS)
- [CVE-2019-14227](https://cve.now/CVE-2019-14227.md): OX App Suite 7.10.1 and 7.10.2 allows XSS. (no CVSS)
- [CVE-2019-16278](https://cve.now/CVE-2019-16278.md): Directory Traversal in the function http\_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a c (CVSS 9.8, KEV)
- [CVE-2019-16279](https://cve.now/CVE-2019-16279.md): A memory error in the function SSL\_accept in nostromo nhttpd through 1.9.6 allows an attacker to trigger a denial of service via a crafted H (no CVSS)
- [CVE-2019-17583](https://cve.now/CVE-2019-17583.md): idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonst (no CVSS)
- [CVE-2019-16519](https://cve.now/CVE-2019-16519.md): ESET Cyber Security 6.7.900.0 for macOS allows a local attacker to execute unauthorized commands as root by abusing an undocumented feature (no CVSS)
- [CVE-2019-17580](https://cve.now/CVE-2019-17580.md): tonyy dormsystem through 1.3 allows SQL Injection in admin.php. (no CVSS)
- [CVE-2019-17511](https://cve.now/CVE-2019-17511.md): There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. (no CVSS)
- [CVE-2019-17579](https://cve.now/CVE-2019-17579.md): SonarSource SonarQube before 7.8 has XSS in project links on account/projects. (no CVSS)
- [CVE-2019-14858](https://cve.now/CVE-2019-14858.md): A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. (CVSS 7.3, Red Hat Ansible · ansible)
- [CVE-2019-14838](https://cve.now/CVE-2019-14838.md): A flaw was found in wildfly-core before 7.2.5.GA. (CVSS 5.2, Red Hat wildfly-core · org.wildfly.core:wildfly-host-contro…)
- [CVE-2019-9745](https://cve.now/CVE-2019-9745.md): CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration. (no CVSS)
- [CVE-2019-17575](https://cve.now/CVE-2019-17575.md): A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. (no CVSS)
- [CVE-2019-16344](https://cve.now/CVE-2019-16344.md): A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attacker to inject arbitr (no CVSS)
- [CVE-2019-17574](https://cve.now/CVE-2019-17574.md): An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. (no CVSS)
- [CVE-2019-4572](https://cve.now/CVE-2019-4572.md): IBM FileNet Content Manager 5.5.2 and 5.5.3 in specific configurations, could log the web service user credentials into a log file that coul (CVSS 4.1, IBM FileNet Content Manager)
- [CVE-2019-17552](https://cve.now/CVE-2019-17552.md): An issue was discovered in idreamsoft iCMS v7.0.14. (no CVSS)
- [CVE-2019-17553](https://cve.now/CVE-2019-17553.md): An issue was discovered in MetInfo v7.0.0 beta. (no CVSS)
- [CVE-2019-17408](https://cve.now/CVE-2019-17408.md): parserIfLabel in inc/zzz\_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the danger\_key functi (no CVSS)
- [CVE-2019-17501](https://cve.now/CVE-2019-17501.md): Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuratio (no CVSS)
- [CVE-2019-17539](https://cve.now/CVE-2019-17539.md): In FFmpeg before 4.2, avcodec\_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there (no CVSS)
- [CVE-2019-17540](https://cve.now/CVE-2019-17540.md): ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c. (no CVSS)
- [CVE-2019-17542](https://cve.now/CVE-2019-17542.md): FFmpeg before 4.2 has a heap-based buffer overflow in vqa\_decode\_chunk because of an out-of-array access in vqa\_decode\_init in libavcodec/vq (no CVSS)
- [CVE-2019-17543](https://cve.now/CVE-2019-17543.md): LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4\_write32 (related to LZ4\_compress\_destSize), affecting applications that call LZ4\_co (no CVSS)
- [CVE-2019-17544](https://cve.now/CVE-2019-17544.md): libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \\ char (no CVSS)
- [CVE-2019-17545](https://cve.now/CVE-2019-17545.md): GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr\_expat.cpp when the 10MB threshold is exceeded. (no CVSS, gdal)
- [CVE-2019-17547](https://cve.now/CVE-2019-17547.md): In ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free. (no CVSS)
- [CVE-2019-17546](https://cve.now/CVE-2019-17546.md): tif\_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes (no CVSS)
- [CVE-2019-17541](https://cve.now/CVE-2019-17541.md): ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in code (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.