CVEs published October 23, 2019
95 CVEs were published on October 23, 2019: 0 critical, 1 high.
- Published
- 95
- Critical
- 0
- High
- 1
- Medium
- 2
- Low
- 0
- Unrated
- 92
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- Jenkins project Jenkins Dynatrace Application Monitoring Pl…
- 3
- Jenkins project Jenkins ElasticBox Jenkins Kubernetes CI/CD…
- 3
- Jenkins project Jenkins Libvirt Slaves Plugin · org.jenkins…
- 3
- Adobe Acrobat and Reader
- 2
- Jenkins project Jenkins Deploy WebLogic Plugin · org.jenkin…
- 2
- Adobe Creative Cloud Desktop application
- 1
- Apache POI · org.apache.poi:poi
- 1
- Cloud Foundry SMB Volume · Cloud Foundry CF Deployment
- 1
- Cloud Foundry UAA Release · Cloud Foundry CF Deployment
- 1
- Facebook WhatsApp for Android
- 1
High 1
Medium, low and unrated 94
- CVE-2019-18387Sourcecodester Hotel and Lodge Management System 1.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execut
- CVE-2019-18213XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and
- CVE-2019-18212XMLLanguageService.java in XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0
- CVE-2019-18382An issue was discovered on AVStar PE204 3.10.70 IP camera devices.
- CVE-2019-18383An issue was discovered on TerraMaster FS-210 4.0.19 devices.
- CVE-2019-18384An issue was discovered on TerraMaster FS-210 4.0.19 devices.
- CVE-2019-18385An issue was discovered on TerraMaster FS-210 4.0.19 devices.
- CVE-2019-8236Creative Cloud Desktop Application version 4.6.1 and earlier versions have Security Bypass vulnerability.Adobe Creative Cloud Desktop application
- CVE-2019-8238Adobe Acrobat and Reader versions 2019.010.20100 and earlier; 2019.010.20099 and earlier versions; 2017.011.30140 and earlier version; 2017.Adobe Acrobat and Reader
- CVE-2019-8237Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earAdobe Acrobat and Reader
- CVE-2019-18371An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable.
- CVE-2019-18370An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable.
- CVE-2019-12415In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted documApache POI · org.apache.poi:poi
- CVE-2019-18359A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2.
- CVE-2019-6144This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint (versions 19.04 through 19.08) and bypass DLP andForcepoint One Endpoint
- CVE-2019-3982Nessus versions 8.6.0 and earlier were found to contain a Denial of Service vulnerability due to improper validation of specific imported scTenable Nessus
- CVE-2019-18357An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 2 of 2).
- CVE-2019-18356An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 1 of 2).
- CVE-2019-18355An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7.
- CVE-2019-9597Darktrace Enterprise Immune System before 3.1 allows CSRF via the /config endpoint.
- CVE-2019-9596Darktrace Enterprise Immune System before 3.1 allows CSRF via the /whitelisteddomains endpoint.
- CVE-2002-2439Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts.GNU gcc
- CVE-2019-18350In Ant Design Pro 4.0.0, reflected XSS in the user/login redirect GET parameter affects the authorization component, leading to execution of
- CVE-2014-2304A vulnerability in version 0.90 of the Open Floodlight SDN controller software could result in a denial of service attack and crashing of th
- CVE-2019-17093An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8.
- CVE-2013-7333A vulnerability in version 0.90 of the Open Floodlight SDN controller software could allow an attacker with access to the OpenFlow control n
- CVE-2019-18348An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0.
- CVE-2019-16977In FusionPBX up to 4.5.7, the file app\extensions\extension_imports.php uses an unsanitized "query_string" variable coming from the URL, whi
- CVE-2019-17606The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content ofhexo-admin
- CVE-2015-9505The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x befo
- CVE-2015-9506The Easy Digital Downloads (EDD) Amazon S3 extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2
- CVE-2015-9504The weeklynews theme before 2.2.9 for WordPress has XSS via the s parameter.
- CVE-2015-9507The Easy Digital Downloads (EDD) Attach Accounts to Orders extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10
- CVE-2015-9508The Easy Digital Downloads (EDD) Commissions extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before
- CVE-2015-9509The Easy Digital Downloads (EDD) Content Restriction extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.
- CVE-2015-9510The Easy Digital Downloads (EDD) Cross-sell Upsell extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x
- CVE-2015-9503The Modern theme before 1.4.2 for WordPress has XSS via the genericons/example.html anchor identifier.
- CVE-2015-9511The Easy Digital Downloads (EDD) Conditional Success Redirects extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.
- CVE-2015-9512The Easy Digital Downloads (EDD) CSV Manager extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before
- CVE-2015-9513The Easy Digital Downloads (EDD) Favorites extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2
- CVE-2015-9514The Easy Digital Downloads (EDD) Free Downloads extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x bef
- CVE-2015-9515The Easy Digital Downloads (EDD) htaccess Editor extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x be
- CVE-2015-9502The Auberge theme before 1.4.5 for WordPress has XSS via the genericons/example.html anchor identifier.
- CVE-2015-9516The Easy Digital Downloads (EDD) Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.
- CVE-2015-9517The Easy Digital Downloads (EDD) Manual Purchases extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x b
- CVE-2015-9518The Easy Digital Downloads (EDD) PDF Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x befor
- CVE-2015-9519The Easy Digital Downloads (EDD) PDF Stamper extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before
- CVE-2015-9520The Easy Digital Downloads (EDD) Per Product Emails extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x
- CVE-2015-9521The Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2
- CVE-2015-9522The Easy Digital Downloads (EDD) QR Code extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0
- CVE-2015-9523The Easy Digital Downloads (EDD) Recommended Products extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0
- CVE-2015-9524The Easy Digital Downloads (EDD) Recount Earnings extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x b
- CVE-2015-9525The Easy Digital Downloads (EDD) Recurring Payments extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x
- CVE-2015-9526The Easy Digital Downloads (EDD) Reviews extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0
- CVE-2015-9527The Easy Digital Downloads (EDD) Simple Shipping extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x be
- CVE-2015-9528The Easy Digital Downloads (EDD) Software Licensing extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x
- CVE-2015-9529The Easy Digital Downloads (EDD) Stripe extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.
- CVE-2015-9530The Easy Digital Downloads (EDD) Upload File extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before
- CVE-2015-9531The Easy Digital Downloads (EDD) Wish Lists extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before
- CVE-2015-9532The Easy Digital Downloads (EDD) Digital Store theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2
- CVE-2015-9533The Easy Digital Downloads (EDD) Lattice theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5,
- CVE-2015-9534The Easy Digital Downloads (EDD) Quota theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.
- CVE-2015-9535The Easy Digital Downloads (EDD) Shoppette theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5
- CVE-2019-16975In FusionPBX up to 4.5.7, the file app\contacts\contact_notes.php uses an unsanitized "id" variable coming from the URL, which is reflected
- CVE-2015-9536The Easy Digital Downloads (EDD) Twenty-Twelve theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2
- CVE-2019-11933A heap buffer overflow bug in libpl_droidsonroids_gif before 1.2.19, as used in WhatsApp for Android before version 2.19.291 could allow remFacebook WhatsApp for Android
- CVE-2019-11282UAA is vulnerable to a Blind SCIM injection leading to information disclosureCloud Foundry UAA Release · Cloud Foundry CF Deployment
- CVE-2019-18344Sourcecodester Online Grading System 1.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary
- CVE-2019-16976In FusionPBX up to 4.5.7, the file app\destinations\destination_imports.php uses an unsanitized "query_string" variable coming from the URL,
- CVE-2019-18281An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 all
- CVE-2019-18280Sourcecodester Online Grading System 1.0 is affected by a Cross Site Request Forgery vulnerability due to a lack of CSRF protection.
- CVE-2019-18278When executing VideoLAN VLC media player 3.0.8 with libqt on Windows, Data from a Faulting Address controls Code Flow starting at libqt_plug
- CVE-2019-18220Sitemagic CMS 4.4.1 is affected by a Cross-Site-Request-Forgery (CSRF) issue as it doesn't implement any method to validate incoming request
- CVE-2019-18219Sitemagic CMS 4.4.1 is affected by a Cross-Site-Scripting (XSS) vulnerability, as it fails to validate user input.
- CVE-2019-18277A flaw was found in HAProxy before 2.0.6.
- CVE-2019-10476Jenkins Zulip Plugin 1.1.0 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they coulJenkins project Jenkins Zulip Plugin · org.jenkins-ci.plugi…
- CVE-2019-10474A missing permission check in Jenkins Global Post Script Plugin in allowed users with Overall/Read access to list the scripts available to tJenkins project Jenkins Global Post Script Plugin · org.jen…
- CVE-2019-10475A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript intoJenkins project Jenkins build-metrics Plugin · org.jenkins-…
- CVE-2019-10472A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specifieJenkins project Jenkins Libvirt Slaves Plugin · org.jenkins…
- CVE-2019-10473A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credJenkins project Jenkins Libvirt Slaves Plugin · org.jenkins…
- CVE-2019-10470A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read accJenkins project Jenkins ElasticBox Jenkins Kubernetes CI/CD…
- CVE-2019-10471A cross-site request forgery vulnerability in Jenkins Libvirt Slaves Plugin allows attackers to connect to an attacker-specified SSH server Jenkins project Jenkins Libvirt Slaves Plugin · org.jenkins…
- CVE-2019-10468A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker-Jenkins project Jenkins ElasticBox Jenkins Kubernetes CI/CD…
- CVE-2019-10469A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect toJenkins project Jenkins ElasticBox Jenkins Kubernetes CI/CD…
- CVE-2019-10466An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolvJenkins project Jenkins 360 FireLine Plugin · org.jenkins-c…
- CVE-2019-10467Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users wJenkins project Jenkins Sonar Gerrit Plugin · org.jenkins-c…
- CVE-2019-10464A cross-site request forgery vulnerability in Jenkins Deploy WebLogic Plugin allows attackers to connect to an attacker-specified URL using Jenkins project Jenkins Deploy WebLogic Plugin · org.jenkin…
- CVE-2019-10465A missing permission check in Jenkins Deploy WebLogic Plugin allows attackers with Overall/Read permission to connect to an attacker-specifiJenkins project Jenkins Deploy WebLogic Plugin · org.jenkin…
- CVE-2019-10462A cross-site request forgery vulnerability in Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier allowed attackers to connectJenkins project Jenkins Dynatrace Application Monitoring Pl…
- CVE-2019-10463A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to anJenkins project Jenkins Dynatrace Application Monitoring Pl…
- CVE-2019-10460Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins masJenkins project Jenkins Bitbucket OAuth Plugin · org.jenkin…
- CVE-2019-10461Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier stored credentials unencrypted in its global configuration file on the JenJenkins project Jenkins Dynatrace Application Monitoring Pl…
- CVE-2019-10459Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuratiJenkins project Jenkins Mattermost Notification Plugin · or…
- CVE-2019-14276WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body.