# CVEs published 2019-10-15 20 CVEs were published on October 15, 2019: 0 critical, 0 high. Days are UTC. - [CVE-2019-13392](https://cve.now/CVE-2019-13392.md): A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a vic (no CVSS) - [CVE-2019-17612](https://cve.now/CVE-2019-17612.md): An issue was discovered in 74CMS v5.2.8. (no CVSS) - [CVE-2019-17613](https://cve.now/CVE-2019-17613.md): qibosoft 7 allows remote code execution because do/jf.php makes eval calls. (no CVSS) - [CVE-2019-17395](https://cve.now/CVE-2019-17395.md): In the Rapid Gator application 0.7.1 for Android, the username and password are stored in the log during authentication, and may be availabl (no CVSS) - [CVE-2019-17602](https://cve.now/CVE-2019-17602.md): An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. (no CVSS) - [CVE-2019-17394](https://cve.now/CVE-2019-17394.md): In the Seesaw Parent and Family application 6.2.5 for Android, the username and password are stored in the log during authentication, and ma (no CVSS) - [CVE-2019-17396](https://cve.now/CVE-2019-17396.md): In the PowerSchool Mobile application 1.1.8 for Android, the username and password are stored in the log during authentication, and may be a (no CVSS) - [CVE-2019-17601](https://cve.now/CVE-2019-17601.md): In MiniShare 1.4.1, there is a stack-based buffer overflow via an HTTP CONNECT request, which allows an attacker to achieve arbitrary code e (no CVSS) - [CVE-2019-17355](https://cve.now/CVE-2019-17355.md): In the Orbitz application 19.31.1 for Android, the username and password are stored in the log during authentication, and may be available t (no CVSS) - [CVE-2019-17398](https://cve.now/CVE-2019-17398.md): In the Dark Horse Comics application 1.3.21 for Android, token information (equivalent to the username and password) is stored in the log du (no CVSS) - [CVE-2019-17356](https://cve.now/CVE-2019-17356.md): The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during login, as demonstrate (no CVSS) - [CVE-2019-14832](https://cve.now/CVE-2019-14832.md): A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. (CVSS 5.0, keycloak REST API · org.keycloak:keycloak-model-infinisp… +1) - [CVE-2017-1002201](https://cve.now/CVE-2017-1002201.md): In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like \< \> " ' must be escape (no CVSS, http://haml.info/ haml · haml) - [CVE-2019-10760](https://cve.now/CVE-2019-10760.md): safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. (no CVSS, Snyk safer-eval · safer-eval) - [CVE-2019-10759](https://cve.now/CVE-2019-10759.md): safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. (no CVSS, Snyk safer-eval · safer-eval) - [CVE-2019-17397](https://cve.now/CVE-2019-17397.md): In the DoorDash application through 11.5.2 for Android, the username and password are stored in the log during authentication, and may be av (no CVSS) - [CVE-2019-12944](https://cve.now/CVE-2019-12944.md): Glue Smart Lock 2.7.8 devices do not properly block guest access in certain situations where the network connection is unavailable. (no CVSS) - [CVE-2019-17600](https://cve.now/CVE-2019-17600.md): Intelbras IWR 1000N 1.6.4 devices allow disclosure of the administrator login name and password because v1/system/user is mishandled. (no CVSS) - [CVE-2019-17195](https://cve.now/CVE-2019-17195.md): Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (no CVSS, com.nimbusds:nimbus-jose-jwt) - [CVE-2019-17223](https://cve.now/CVE-2019-17223.md): There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php. (no CVSS, dolibarr/dolibarr) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-10-15 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.