# CVEs published 2019-10-23 95 CVEs were published on October 23, 2019: 0 critical, 1 high. Days are UTC. - [CVE-2019-18387](https://cve.now/CVE-2019-18387.md): Sourcecodester Hotel and Lodge Management System 1.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execut (no CVSS) - [CVE-2019-18213](https://cve.now/CVE-2019-18213.md): XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0.9.1 for Visual Studio and (no CVSS) - [CVE-2019-18212](https://cve.now/CVE-2019-18212.md): XMLLanguageService.java in XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka vscode-xml) before 0 (no CVSS) - [CVE-2019-18382](https://cve.now/CVE-2019-18382.md): An issue was discovered on AVStar PE204 3.10.70 IP camera devices. (no CVSS) - [CVE-2019-18383](https://cve.now/CVE-2019-18383.md): An issue was discovered on TerraMaster FS-210 4.0.19 devices. (no CVSS) - [CVE-2019-18384](https://cve.now/CVE-2019-18384.md): An issue was discovered on TerraMaster FS-210 4.0.19 devices. (no CVSS) - [CVE-2019-18385](https://cve.now/CVE-2019-18385.md): An issue was discovered on TerraMaster FS-210 4.0.19 devices. (no CVSS) - [CVE-2019-8236](https://cve.now/CVE-2019-8236.md): Creative Cloud Desktop Application version 4.6.1 and earlier versions have Security Bypass vulnerability. (no CVSS, Adobe Creative Cloud Desktop application) - [CVE-2019-8238](https://cve.now/CVE-2019-8238.md): Adobe Acrobat and Reader versions 2019.010.20100 and earlier; 2019.010.20099 and earlier versions; 2017.011.30140 and earlier version; 2017. (no CVSS, Adobe Acrobat and Reader) - [CVE-2019-8237](https://cve.now/CVE-2019-8237.md): Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear (no CVSS, Adobe Acrobat and Reader) - [CVE-2019-18371](https://cve.now/CVE-2019-18371.md): An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. (no CVSS) - [CVE-2019-18370](https://cve.now/CVE-2019-18370.md): An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. (no CVSS) - [CVE-2019-12415](https://cve.now/CVE-2019-12415.md): In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted docum (no CVSS, Apache POI · org.apache.poi:poi) - [CVE-2019-18359](https://cve.now/CVE-2019-18359.md): A buffer over-read was discovered in ReadMP3APETag in apetag.c in MP3Gain 1.6.2. (no CVSS) - [CVE-2019-6144](https://cve.now/CVE-2019-6144.md): This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint (versions 19.04 through 19.08) and bypass DLP and (no CVSS, Forcepoint One Endpoint) - [CVE-2019-3982](https://cve.now/CVE-2019-3982.md): Nessus versions 8.6.0 and earlier were found to contain a Denial of Service vulnerability due to improper validation of specific imported sc (no CVSS, Tenable Nessus) - [CVE-2019-18357](https://cve.now/CVE-2019-18357.md): An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 2 of 2). (no CVSS) - [CVE-2019-18356](https://cve.now/CVE-2019-18356.md): An XSS issue was discovered in Thycotic Secret Server before 10.7 (issue 1 of 2). (no CVSS) - [CVE-2019-18355](https://cve.now/CVE-2019-18355.md): An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7. (no CVSS) - [CVE-2019-9597](https://cve.now/CVE-2019-9597.md): Darktrace Enterprise Immune System before 3.1 allows CSRF via the /config endpoint. (no CVSS) - [CVE-2019-9596](https://cve.now/CVE-2019-9596.md): Darktrace Enterprise Immune System before 3.1 allows CSRF via the /whitelisteddomains endpoint. (no CVSS) - [CVE-2002-2439](https://cve.now/CVE-2002-2439.md): Integer overflow in the new\[\] operator in gcc before 4.8.0 allows attackers to have unspecified impacts. (no CVSS, GNU gcc) - [CVE-2019-18350](https://cve.now/CVE-2019-18350.md): In Ant Design Pro 4.0.0, reflected XSS in the user/login redirect GET parameter affects the authorization component, leading to execution of (no CVSS) - [CVE-2014-2304](https://cve.now/CVE-2014-2304.md): A vulnerability in version 0.90 of the Open Floodlight SDN controller software could result in a denial of service attack and crashing of th (no CVSS) - [CVE-2019-17093](https://cve.now/CVE-2019-17093.md): An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. (no CVSS) - [CVE-2013-7333](https://cve.now/CVE-2013-7333.md): A vulnerability in version 0.90 of the Open Floodlight SDN controller software could allow an attacker with access to the OpenFlow control n (no CVSS) - [CVE-2019-18348](https://cve.now/CVE-2019-18348.md): An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. (CVSS 5.4) - [CVE-2019-16977](https://cve.now/CVE-2019-16977.md): In FusionPBX up to 4.5.7, the file app\\extensions\\extension\_imports.php uses an unsanitized "query\_string" variable coming from the URL, whi (no CVSS) - [CVE-2019-17606](https://cve.now/CVE-2019-17606.md): The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of (no CVSS, hexo-admin) - [CVE-2015-9505](https://cve.now/CVE-2015-9505.md): The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x befo (no CVSS) - [CVE-2015-9506](https://cve.now/CVE-2015-9506.md): The Easy Digital Downloads (EDD) Amazon S3 extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2 (no CVSS) - [CVE-2015-9504](https://cve.now/CVE-2015-9504.md): The weeklynews theme before 2.2.9 for WordPress has XSS via the s parameter. (no CVSS) - [CVE-2015-9507](https://cve.now/CVE-2015-9507.md): The Easy Digital Downloads (EDD) Attach Accounts to Orders extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10 (no CVSS) - [CVE-2015-9508](https://cve.now/CVE-2015-9508.md): The Easy Digital Downloads (EDD) Commissions extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before (no CVSS) - [CVE-2015-9509](https://cve.now/CVE-2015-9509.md): The Easy Digital Downloads (EDD) Content Restriction extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0. (no CVSS) - [CVE-2015-9510](https://cve.now/CVE-2015-9510.md): The Easy Digital Downloads (EDD) Cross-sell Upsell extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x (no CVSS) - [CVE-2015-9503](https://cve.now/CVE-2015-9503.md): The Modern theme before 1.4.2 for WordPress has XSS via the genericons/example.html anchor identifier. (no CVSS) - [CVE-2015-9511](https://cve.now/CVE-2015-9511.md): The Easy Digital Downloads (EDD) Conditional Success Redirects extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1. (no CVSS) - [CVE-2015-9512](https://cve.now/CVE-2015-9512.md): The Easy Digital Downloads (EDD) CSV Manager extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before (no CVSS) - [CVE-2015-9513](https://cve.now/CVE-2015-9513.md): The Easy Digital Downloads (EDD) Favorites extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2 (no CVSS) - [CVE-2015-9514](https://cve.now/CVE-2015-9514.md): The Easy Digital Downloads (EDD) Free Downloads extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x bef (no CVSS) - [CVE-2015-9515](https://cve.now/CVE-2015-9515.md): The Easy Digital Downloads (EDD) htaccess Editor extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x be (no CVSS) - [CVE-2015-9502](https://cve.now/CVE-2015-9502.md): The Auberge theme before 1.4.5 for WordPress has XSS via the genericons/example.html anchor identifier. (no CVSS) - [CVE-2015-9516](https://cve.now/CVE-2015-9516.md): The Easy Digital Downloads (EDD) Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2. (no CVSS) - [CVE-2015-9517](https://cve.now/CVE-2015-9517.md): The Easy Digital Downloads (EDD) Manual Purchases extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x b (no CVSS) - [CVE-2015-9518](https://cve.now/CVE-2015-9518.md): The Easy Digital Downloads (EDD) PDF Invoices extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x befor (no CVSS) - [CVE-2015-9519](https://cve.now/CVE-2015-9519.md): The Easy Digital Downloads (EDD) PDF Stamper extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before (no CVSS) - [CVE-2015-9520](https://cve.now/CVE-2015-9520.md): The Easy Digital Downloads (EDD) Per Product Emails extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x (no CVSS) - [CVE-2015-9521](https://cve.now/CVE-2015-9521.md): The Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2 (no CVSS) - [CVE-2015-9522](https://cve.now/CVE-2015-9522.md): The Easy Digital Downloads (EDD) QR Code extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0 (no CVSS) - [CVE-2015-9523](https://cve.now/CVE-2015-9523.md): The Easy Digital Downloads (EDD) Recommended Products extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0 (no CVSS) - [CVE-2015-9524](https://cve.now/CVE-2015-9524.md): The Easy Digital Downloads (EDD) Recount Earnings extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x b (no CVSS) - [CVE-2015-9525](https://cve.now/CVE-2015-9525.md): The Easy Digital Downloads (EDD) Recurring Payments extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x (no CVSS) - [CVE-2015-9526](https://cve.now/CVE-2015-9526.md): The Easy Digital Downloads (EDD) Reviews extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0 (no CVSS) - [CVE-2015-9527](https://cve.now/CVE-2015-9527.md): The Easy Digital Downloads (EDD) Simple Shipping extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x be (no CVSS) - [CVE-2015-9528](https://cve.now/CVE-2015-9528.md): The Easy Digital Downloads (EDD) Software Licensing extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x (no CVSS) - [CVE-2015-9529](https://cve.now/CVE-2015-9529.md): The Easy Digital Downloads (EDD) Stripe extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0. (no CVSS) - [CVE-2015-9530](https://cve.now/CVE-2015-9530.md): The Easy Digital Downloads (EDD) Upload File extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before (no CVSS) - [CVE-2015-9531](https://cve.now/CVE-2015-9531.md): The Easy Digital Downloads (EDD) Wish Lists extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before (no CVSS) - [CVE-2015-9532](https://cve.now/CVE-2015-9532.md): The Easy Digital Downloads (EDD) Digital Store theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2 (no CVSS) - [CVE-2015-9533](https://cve.now/CVE-2015-9533.md): The Easy Digital Downloads (EDD) Lattice theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, (no CVSS) - [CVE-2015-9534](https://cve.now/CVE-2015-9534.md): The Easy Digital Downloads (EDD) Quota theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2. (no CVSS) - [CVE-2015-9535](https://cve.now/CVE-2015-9535.md): The Easy Digital Downloads (EDD) Shoppette theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5 (no CVSS) - [CVE-2019-16975](https://cve.now/CVE-2019-16975.md): In FusionPBX up to 4.5.7, the file app\\contacts\\contact\_notes.php uses an unsanitized "id" variable coming from the URL, which is reflected (no CVSS) - [CVE-2015-9536](https://cve.now/CVE-2015-9536.md): The Easy Digital Downloads (EDD) Twenty-Twelve theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2 (no CVSS) - [CVE-2019-11933](https://cve.now/CVE-2019-11933.md): A heap buffer overflow bug in libpl\_droidsonroids\_gif before 1.2.19, as used in WhatsApp for Android before version 2.19.291 could allow rem (no CVSS, Facebook WhatsApp for Android) - [CVE-2019-11283](https://cve.now/CVE-2019-11283.md): Password leak in smbdriver logs (CVSS 8.8, Cloud Foundry SMB Volume · Cloud Foundry CF Deployment) - [CVE-2019-11282](https://cve.now/CVE-2019-11282.md): UAA is vulnerable to a Blind SCIM injection leading to information disclosure (CVSS 4.3, Cloud Foundry UAA Release · Cloud Foundry CF Deployment) - [CVE-2019-18344](https://cve.now/CVE-2019-18344.md): Sourcecodester Online Grading System 1.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary (no CVSS) - [CVE-2019-16976](https://cve.now/CVE-2019-16976.md): In FusionPBX up to 4.5.7, the file app\\destinations\\destination\_imports.php uses an unsanitized "query\_string" variable coming from the URL, (no CVSS) - [CVE-2019-18281](https://cve.now/CVE-2019-18281.md): An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 all (no CVSS) - [CVE-2019-18280](https://cve.now/CVE-2019-18280.md): Sourcecodester Online Grading System 1.0 is affected by a Cross Site Request Forgery vulnerability due to a lack of CSRF protection. (no CVSS) - [CVE-2019-18278](https://cve.now/CVE-2019-18278.md): When executing VideoLAN VLC media player 3.0.8 with libqt on Windows, Data from a Faulting Address controls Code Flow starting at libqt\_plug (no CVSS) - [CVE-2019-18220](https://cve.now/CVE-2019-18220.md): Sitemagic CMS 4.4.1 is affected by a Cross-Site-Request-Forgery (CSRF) issue as it doesn't implement any method to validate incoming request (no CVSS) - [CVE-2019-18219](https://cve.now/CVE-2019-18219.md): Sitemagic CMS 4.4.1 is affected by a Cross-Site-Scripting (XSS) vulnerability, as it fails to validate user input. (no CVSS) - [CVE-2019-18277](https://cve.now/CVE-2019-18277.md): A flaw was found in HAProxy before 2.0.6. (no CVSS) - [CVE-2019-10476](https://cve.now/CVE-2019-10476.md): Jenkins Zulip Plugin 1.1.0 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they coul (no CVSS, Jenkins project Jenkins Zulip Plugin · org.jenkins-ci.plugi…) - [CVE-2019-10474](https://cve.now/CVE-2019-10474.md): A missing permission check in Jenkins Global Post Script Plugin in allowed users with Overall/Read access to list the scripts available to t (no CVSS, Jenkins project Jenkins Global Post Script Plugin · org.jen…) - [CVE-2019-10475](https://cve.now/CVE-2019-10475.md): A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into (no CVSS, Jenkins project Jenkins build-metrics Plugin · org.jenkins-…) - [CVE-2019-10472](https://cve.now/CVE-2019-10472.md): A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specifie (no CVSS, Jenkins project Jenkins Libvirt Slaves Plugin · org.jenkins…) - [CVE-2019-10473](https://cve.now/CVE-2019-10473.md): A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate cred (no CVSS, Jenkins project Jenkins Libvirt Slaves Plugin · org.jenkins…) - [CVE-2019-10470](https://cve.now/CVE-2019-10470.md): A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read acc (no CVSS, Jenkins project Jenkins ElasticBox Jenkins Kubernetes CI/CD…) - [CVE-2019-10471](https://cve.now/CVE-2019-10471.md): A cross-site request forgery vulnerability in Jenkins Libvirt Slaves Plugin allows attackers to connect to an attacker-specified SSH server (no CVSS, Jenkins project Jenkins Libvirt Slaves Plugin · org.jenkins…) - [CVE-2019-10468](https://cve.now/CVE-2019-10468.md): A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker- (no CVSS, Jenkins project Jenkins ElasticBox Jenkins Kubernetes CI/CD…) - [CVE-2019-10469](https://cve.now/CVE-2019-10469.md): A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to (no CVSS, Jenkins project Jenkins ElasticBox Jenkins Kubernetes CI/CD…) - [CVE-2019-10466](https://cve.now/CVE-2019-10466.md): An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolv (no CVSS, Jenkins project Jenkins 360 FireLine Plugin · org.jenkins-c…) - [CVE-2019-10467](https://cve.now/CVE-2019-10467.md): Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users w (no CVSS, Jenkins project Jenkins Sonar Gerrit Plugin · org.jenkins-c…) - [CVE-2019-10464](https://cve.now/CVE-2019-10464.md): A cross-site request forgery vulnerability in Jenkins Deploy WebLogic Plugin allows attackers to connect to an attacker-specified URL using (no CVSS, Jenkins project Jenkins Deploy WebLogic Plugin · org.jenkin…) - [CVE-2019-10465](https://cve.now/CVE-2019-10465.md): A missing permission check in Jenkins Deploy WebLogic Plugin allows attackers with Overall/Read permission to connect to an attacker-specifi (no CVSS, Jenkins project Jenkins Deploy WebLogic Plugin · org.jenkin…) - [CVE-2019-10462](https://cve.now/CVE-2019-10462.md): A cross-site request forgery vulnerability in Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier allowed attackers to connect (no CVSS, Jenkins project Jenkins Dynatrace Application Monitoring Pl…) - [CVE-2019-10463](https://cve.now/CVE-2019-10463.md): A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to an (no CVSS, Jenkins project Jenkins Dynatrace Application Monitoring Pl…) - [CVE-2019-10460](https://cve.now/CVE-2019-10460.md): Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins mas (no CVSS, Jenkins project Jenkins Bitbucket OAuth Plugin · org.jenkin…) - [CVE-2019-10461](https://cve.now/CVE-2019-10461.md): Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier stored credentials unencrypted in its global configuration file on the Jen (no CVSS, Jenkins project Jenkins Dynatrace Application Monitoring Pl…) - [CVE-2019-10459](https://cve.now/CVE-2019-10459.md): Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configurati (no CVSS, Jenkins project Jenkins Mattermost Notification Plugin · or…) - [CVE-2019-14276](https://cve.now/CVE-2019-14276.md): WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-10-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.