# CVEs published 2019-10-21

35 CVEs were published on October 21, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-16404](https://cve.now/CVE-2019-16404.md): Authenticated SQL Injection in interface/forms/eye\_mag/js/eye\_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from (no CVSS)
- [CVE-2019-17400](https://cve.now/CVE-2019-17400.md): The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion. (no CVSS, unoconv)
- [CVE-2019-16974](https://cve.now/CVE-2019-16974.md): In FusionPBX up to 4.5.7, the file app\\contacts\\contact\_times.php uses an unsanitized "id" variable coming from the URL, which is reflected (no CVSS)
- [CVE-2019-16969](https://cve.now/CVE-2019-16969.md): In FusionPBX up to 4.5.7, the file app\\fifo\_list\\fifo\_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflect (no CVSS)
- [CVE-2019-17220](https://cve.now/CVE-2019-17220.md): Rocket.Chat before 2.1.0 allows XSS via a URL on a !\[title\] line. (no CVSS)
- [CVE-2019-16970](https://cve.now/CVE-2019-16970.md): In FusionPBX up to 4.5.7, the file app\\sip\_status\\sip\_status.php uses an unsanitized "savemsg" variable coming from the URL, which is reflec (no CVSS)
- [CVE-2019-16968](https://cve.now/CVE-2019-16968.md): An issue was discovered in FusionPBX up to 4.5.7. (no CVSS)
- [CVE-2019-16967](https://cve.now/CVE-2019-16967.md): An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. (no CVSS)
- [CVE-2019-16966](https://cve.now/CVE-2019-16966.md): An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. (no CVSS)
- [CVE-2019-16965](https://cve.now/CVE-2019-16965.md): resources/cmd.php in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows au (no CVSS)
- [CVE-2019-9491](https://cve.now/CVE-2019-9491.md): Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious fil (no CVSS, Trend Micro Anti-Threat Toolkit)
- [CVE-2019-16964](https://cve.now/CVE-2019-16964.md): app/call\_centers/cmd.php in the Call Center Queue Module in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a la (no CVSS)
- [CVE-2019-18203](https://cve.now/CVE-2019-18203.md): On the RICOH MP 501 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entr (no CVSS)
- [CVE-2019-18225](https://cve.now/CVE-2019-18225.md): An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway before 10.5 build 70.8, 11.x before 11.1 build 63.9, 12. (no CVSS)
- [CVE-2019-18224](https://cve.now/CVE-2019-18224.md): idn2\_to\_ascii\_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string. (no CVSS)
- [CVE-2019-16988](https://cve.now/CVE-2019-16988.md): In FusionPBX up to v4.5.7, the file app\\basic\_operator\_panel\\resources\\content.php uses an unsanitized "eavesdrop\_dest" variable coming from (no CVSS)
- [CVE-2019-16991](https://cve.now/CVE-2019-16991.md): In FusionPBX up to v4.5.7, the file app\\edit\\filedelete.php uses an unsanitized "file" variable coming from the URL, which is reflected in H (no CVSS)
- [CVE-2019-16989](https://cve.now/CVE-2019-16989.md): In FusionPBX up to v4.5.7, the file app\\conferences\_active\\conference\_interactive.php uses an unsanitized "c" variable coming from the URL, (no CVSS)
- [CVE-2019-16986](https://cve.now/CVE-2019-16986.md): In FusionPBX up to v4.5.7, the file resources\\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname an (no CVSS)
- [CVE-2019-16987](https://cve.now/CVE-2019-16987.md): In FusionPBX up to v4.5.7, the file app\\contacts\\contact\_import.php uses an unsanitized "query\_string" variable coming from the URL, which i (no CVSS)
- [CVE-2019-16985](https://cve.now/CVE-2019-16985.md): In FusionPBX up to v4.5.7, the file app\\xml\_cdr\\xml\_cdr\_delete.php uses an unsanitized "rec" variable coming from the URL, which is base64 d (no CVSS)
- [CVE-2019-16984](https://cve.now/CVE-2019-16984.md): In FusionPBX up to v4.5.7, the file app\\recordings\\recording\_play.php uses an unsanitized "filename" variable coming from the URL, which is (no CVSS)
- [CVE-2019-16983](https://cve.now/CVE-2019-16983.md): In FusionPBX up to v4.5.7, the file resources\\paging.php has a paging function (called by several pages of the interface), which uses an uns (no CVSS)
- [CVE-2019-16981](https://cve.now/CVE-2019-16981.md): In FusionPBX up to v4.5.7, the file app\\conference\_profiles\\conference\_profile\_params.php uses an unsanitized "id" variable coming from the (no CVSS)
- [CVE-2019-16982](https://cve.now/CVE-2019-16982.md): In FusionPBX up to v4.5.7, the file app\\access\_controls\\access\_control\_nodes.php uses an unsanitized "id" variable coming from the URL, whic (no CVSS)
- [CVE-2019-16990](https://cve.now/CVE-2019-16990.md): In FusionPBX up to v4.5.7, the file app/music\_on\_hold/music\_on\_hold.php uses an unsanitized "file" variable coming from the URL, which takes (no CVSS)
- [CVE-2019-16979](https://cve.now/CVE-2019-16979.md): In FusionPBX up to v4.5.7, the file app\\contacts\\contact\_urls.php uses an unsanitized "id" variable coming from the URL, which is reflected (no CVSS)
- [CVE-2019-16980](https://cve.now/CVE-2019-16980.md): In FusionPBX up to v4.5.7, the file app\\call\_broadcast\\call\_broadcast\_edit.php uses an unsanitized "id" variable coming from the URL in an u (no CVSS)
- [CVE-2019-16978](https://cve.now/CVE-2019-16978.md): In FusionPBX up to v4.5.7, the file app\\devices\\device\_settings.php uses an unsanitized "id" variable coming from the URL, which is reflecte (no CVSS)
- [CVE-2019-16530](https://cve.now/CVE-2019-16530.md): Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution. (no CVSS, org.sonatype.nexus:nexus-repository)
- [CVE-2019-18218](https://cve.now/CVE-2019-18218.md): cdf\_read\_property\_info in cdf.c in file through 5.37 does not restrict the number of CDF\_VECTOR elements, which allows a heap-based buffer o (no CVSS)
- [CVE-2019-18217](https://cve.now/CVE-2019-18217.md): ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long c (no CVSS)
- [CVE-2019-16862](https://cve.now/CVE-2019-16862.md): Reflected XSS in interface/forms/eye\_mag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the co (no CVSS)
- [CVE-2019-17409](https://cve.now/CVE-2019-17409.md): Reflected XSS exists in interface/forms/eye\_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter. (no CVSS)
- [CVE-2019-17498](https://cve.now/CVE-2019-17498.md): In libssh2 v1.9.0 and earlier versions, the SSH\_MSG\_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an atta (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.