CVEs published October 24, 2019
39 CVEs were published on October 24, 2019: 0 critical, 2 high.
- Published
- 39
- Critical
- 0
- High
- 2
- Medium
- 4
- Low
- 1
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Adobe Experience Manager
- 3
- IBM Cloud Orchestrator
- 3
- org.igniterealtime.openfire:parent
- 2
- Wacom
- 2
- class-validator
- 1
- craftcms/cms
- 1
- Fortinet FortiClient for Windows
- 1
- Fortinet FortiOS
- 1
- IBM Maximo Asset Management
- 1
- MapR-MFS/CLDB
- 1
High 2
- CVE-2019-5012An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the startProcess coWacom
- CVE-2019-5013An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the start/stopLauncWacom
Medium, low and unrated 37
- CVE-2019-17596Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key.stdlib
- CVE-2019-18418clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no se
- CVE-2019-18419A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web sc
- CVE-2019-18415Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen.
- CVE-2019-18417Sourcecodester Restaurant Management System 1.0 allows an authenticated attacker to upload arbitrary files that can result in code execution
- CVE-2019-18416Sourcecodester Restaurant Management System 1.0 allows XSS via the Last Name field of a member.
- CVE-2019-8080Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability.Adobe Experience Manager
- CVE-2019-8079Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross site scripting vulnerability.Adobe Experience Manager
- CVE-2019-18414Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lac
- CVE-2019-12095Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmark
- CVE-2019-8078Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability.Adobe Experience Manager
- CVE-2019-12094Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update_f&user_name= or admin/user.php?form=remove_f&use
- CVE-2019-15929In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibilcraftcms/cms
- CVE-2019-18196A DLL side loading vulnerability in the Windows Service in TeamViewer versions up to 11.0.133222 (fixed in 11.0.214397), 12.0.181268 (fixed
- CVE-2019-9699Symantec Messaging Gateway (prior to 10.7.0), may be susceptible to an information disclosure issue, which is a type of vulnerability that cSymantec Messaging Gateway
- CVE-2019-11021admin/app/mediamanager in Schlix CMS 2.1.8-7 allows Authenticated Unrestricted File Upload, leading to remote code execution.
- CVE-2019-13653TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow triggerPort OS Command Injection (issue 5 of 5).
- CVE-2019-13652TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow serviceName OS Command Injection (issue 4 of 5).
- CVE-2019-13651TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow portMappingProtocol OS Command Injection (issue 3 of 5).
- CVE-2019-13650TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow internalPort OS Command Injection (issue 2 of 5).
- CVE-2019-13649TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow externalPort OS Command Injection (issue 1 of 5).
- CVE-2019-12017A remote code execution vulnerability exists in MapR CLDB code, specifically in the JSON framework that is used in the CLDB code that handleMapR-MFS/CLDB
- CVE-2019-18201An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices.
- CVE-2019-18200An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices.
- CVE-2019-18409The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files.ruby_parser-legacy
- CVE-2019-15703An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0, 6.0.8 and below for device not enable hardware TRNG token anFortinet FortiOS
- CVE-2019-18199An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices.
- CVE-2019-6692A malicious DLL preload vulnerability in Fortinet FortiClient for Windows 6.2.0 and below allows a privileged attacker to perform arbitrary Fortinet FortiClient for Windows
- CVE-2019-18408archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_
- CVE-2019-17581tonyy dormsystem through 1.3 allows DOM XSS.
- CVE-2019-4486IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting.IBM Maximo Asset Management
- CVE-2019-4459IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 is vulnerable to cross-site scriptiIBM Cloud Orchestrator
- CVE-2019-4398IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 could allow a local user to obtain IBM Cloud Orchestrator
- CVE-2019-4397IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensitive information in URLIBM Cloud Orchestrator
- CVE-2019-18394A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to sendorg.igniterealtime.openfire:parent
- CVE-2019-18393PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directorg.igniterealtime.openfire:parent
- CVE-2019-18413In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via class-validator