CVEs published October 22, 2019
24 CVEs were published on October 22, 2019: 0 critical, 1 high.
- Published
- 24
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 23
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Adobe Experience Manager Forms
- 1
- Apache Traffic Server
- 1
- IBM Db2 High Performance Unload load for LUW
- 1
- Loofah
- 1
- Self Service Password Reset (SSPR) versions prior to
- 1
High 1
Medium, low and unrated 23
- CVE-2019-16973In FusionPBX up to 4.5.7, the file app\contacts\contact_edit.php uses an unsanitized "query_string" variable coming from the URL, which is r
- CVE-2019-16972In FusionPBX up to 4.5.7, the file app\contacts\contact_addresses.php uses an unsanitized "id" variable coming from the URL, which is reflec
- CVE-2019-16971In FusionPBX up to 4.5.7, the file app\messages\messages_thread.php uses an unsanitized "contact_uuid" variable coming from the URL, which i
- CVE-2015-9501The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web ro
- CVE-2015-9500The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js.
- CVE-2019-8089Adobe Experience Manager Forms versions 6.3-6.5 have a reflected cross-site scripting vulnerability.Adobe Experience Manager Forms
- CVE-2015-9499The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive.
- CVE-2015-9498The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value.
- CVE-2015-9497The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php.
- CVE-2015-9496The freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the 'FM_form id=' substring.
- CVE-2019-15587In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.Loofah
- CVE-2015-9495The syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html anchor identifier.
- CVE-2015-9494The indieweb-post-kinds plugin before 1.3.1.1 for WordPress has XSS via the genericons/example.html anchor identifier.
- CVE-2015-9493The my-wish-list plugin before 1.4.2 for WordPress has multiple XSS issues.
- CVE-2017-8087Information Leakage in PPPoE Packet Padding in AVM Fritz!Box 7490 with Firmware versions Fritz!OS 6.80 and 6.83 allows physically proximate
- CVE-2019-12147The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to Argument Injection via special characters in the us
- CVE-2019-10079Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks.Apache Traffic Server
- CVE-2019-12148The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an authentication bypass via an argument injection
- CVE-2019-12290GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels.
- CVE-2019-12967Stephan Mooltipass Moolticute through 0.42.1 (and possibly earlier versions) has Incorrect Access Control.
- CVE-2019-11674Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4.Self Service Password Reset (SSPR) versions prior to
- CVE-2019-17189totemodata 3.0.0_b936 has XSS via a folder name.
- CVE-2019-17424A stack-based buffer overflow in the processPrivilage() function in IOS/process-general.c in nipper-ng 0.11.10 allows remote attackers (serv