CVEs published October 15, 2019
20 CVEs were published on October 15, 2019: 0 critical, 0 high.
- Published
- 20
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 19
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Snyk safer-eval · safer-eval
- 2
- com.nimbusds:nimbus-jose-jwt
- 1
- dolibarr/dolibarr
- 1
- http://haml.info/ haml · haml
- 1
- keycloak REST API · org.keycloak:keycloak-model-infinisp… +1
- 1
Medium, low and unrated 20
- CVE-2019-13392A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a vic
- CVE-2019-17612An issue was discovered in 74CMS v5.2.8.
- CVE-2019-17613qibosoft 7 allows remote code execution because do/jf.php makes eval calls.
- CVE-2019-17395In the Rapid Gator application 0.7.1 for Android, the username and password are stored in the log during authentication, and may be availabl
- CVE-2019-17602An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089.
- CVE-2019-17394In the Seesaw Parent and Family application 6.2.5 for Android, the username and password are stored in the log during authentication, and ma
- CVE-2019-17396In the PowerSchool Mobile application 1.1.8 for Android, the username and password are stored in the log during authentication, and may be a
- CVE-2019-17601In MiniShare 1.4.1, there is a stack-based buffer overflow via an HTTP CONNECT request, which allows an attacker to achieve arbitrary code e
- CVE-2019-17355In the Orbitz application 19.31.1 for Android, the username and password are stored in the log during authentication, and may be available t
- CVE-2019-17398In the Dark Horse Comics application 1.3.21 for Android, token information (equivalent to the username and password) is stored in the log du
- CVE-2019-17356The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrate
- CVE-2019-14832A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured.keycloak REST API · org.keycloak:keycloak-model-infinisp… +1
- CVE-2017-1002201In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escapehttp://haml.info/ haml · haml
- CVE-2019-10760safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution.Snyk safer-eval · safer-eval
- CVE-2019-10759safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution.Snyk safer-eval · safer-eval
- CVE-2019-17397In the DoorDash application through 11.5.2 for Android, the username and password are stored in the log during authentication, and may be av
- CVE-2019-12944Glue Smart Lock 2.7.8 devices do not properly block guest access in certain situations where the network connection is unavailable.
- CVE-2019-17600Intelbras IWR 1000N 1.6.4 devices allow disclosure of the administrator login name and password because v1/system/user is mishandled.
- CVE-2019-17195Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crashcom.nimbusds:nimbus-jose-jwt
- CVE-2019-17223There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php.dolibarr/dolibarr