# CVEs published 2019-10-22

24 CVEs were published on October 22, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2019-16973](https://cve.now/CVE-2019-16973.md): In FusionPBX up to 4.5.7, the file app\\contacts\\contact\_edit.php uses an unsanitized "query\_string" variable coming from the URL, which is r (no CVSS)
- [CVE-2019-16972](https://cve.now/CVE-2019-16972.md): In FusionPBX up to 4.5.7, the file app\\contacts\\contact\_addresses.php uses an unsanitized "id" variable coming from the URL, which is reflec (no CVSS)
- [CVE-2019-16971](https://cve.now/CVE-2019-16971.md): In FusionPBX up to 4.5.7, the file app\\messages\\messages\_thread.php uses an unsanitized "contact\_uuid" variable coming from the URL, which i (no CVSS)
- [CVE-2015-9501](https://cve.now/CVE-2015-9501.md): The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web ro (no CVSS)
- [CVE-2015-9500](https://cve.now/CVE-2015-9500.md): The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js. (no CVSS)
- [CVE-2019-8089](https://cve.now/CVE-2019-8089.md): Adobe Experience Manager Forms versions 6.3-6.5 have a reflected cross-site scripting vulnerability. (no CVSS, Adobe Experience Manager Forms)
- [CVE-2015-9499](https://cve.now/CVE-2015-9499.md): The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive. (no CVSS)
- [CVE-2015-9498](https://cve.now/CVE-2015-9498.md): The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value. (no CVSS)
- [CVE-2015-9497](https://cve.now/CVE-2015-9497.md): The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php. (no CVSS)
- [CVE-2015-9496](https://cve.now/CVE-2015-9496.md): The freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the 'FM\_form id=' substring. (no CVSS)
- [CVE-2019-15587](https://cve.now/CVE-2019-15587.md): In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. (no CVSS, Loofah)
- [CVE-2015-9495](https://cve.now/CVE-2015-9495.md): The syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html anchor identifier. (no CVSS)
- [CVE-2015-9494](https://cve.now/CVE-2015-9494.md): The indieweb-post-kinds plugin before 1.3.1.1 for WordPress has XSS via the genericons/example.html anchor identifier. (no CVSS)
- [CVE-2015-9493](https://cve.now/CVE-2015-9493.md): The my-wish-list plugin before 1.4.2 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2017-8087](https://cve.now/CVE-2017-8087.md): Information Leakage in PPPoE Packet Padding in AVM Fritz!Box 7490 with Firmware versions Fritz!OS 6.80 and 6.83 allows physically proximate (no CVSS)
- [CVE-2019-12147](https://cve.now/CVE-2019-12147.md): The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to Argument Injection via special characters in the us (no CVSS)
- [CVE-2019-10079](https://cve.now/CVE-2019-10079.md): Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. (no CVSS, Apache Traffic Server)
- [CVE-2019-12148](https://cve.now/CVE-2019-12148.md): The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an authentication bypass via an argument injection (no CVSS)
- [CVE-2019-12290](https://cve.now/CVE-2019-12290.md): GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. (no CVSS)
- [CVE-2019-12967](https://cve.now/CVE-2019-12967.md): Stephan Mooltipass Moolticute through 0.42.1 (and possibly earlier versions) has Incorrect Access Control. (no CVSS)
- [CVE-2019-11674](https://cve.now/CVE-2019-11674.md): Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4. (no CVSS, Self Service Password Reset (SSPR) versions prior to)
- [CVE-2019-17189](https://cve.now/CVE-2019-17189.md): totemodata 3.0.0\_b936 has XSS via a folder name. (no CVSS)
- [CVE-2019-4523](https://cve.now/CVE-2019-4523.md): IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 is vulnerable to a buffer overflow, caused by improper bounds checking which could (CVSS 8.4, IBM Db2 High Performance Unload load for LUW)
- [CVE-2019-17424](https://cve.now/CVE-2019-17424.md): A stack-based buffer overflow in the processPrivilage() function in IOS/process-general.c in nipper-ng 0.11.10 allows remote attackers (serv (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.