# CVEs published 2019-10-24

39 CVEs were published on October 24, 2019: 0 critical, 2 high. Days are UTC.

- [CVE-2019-17596](https://cve.now/CVE-2019-17596.md): Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. (no CVSS, stdlib)
- [CVE-2019-18418](https://cve.now/CVE-2019-18418.md): clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no se (no CVSS)
- [CVE-2019-18419](https://cve.now/CVE-2019-18419.md): A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2019-18415](https://cve.now/CVE-2019-18415.md): Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen. (no CVSS)
- [CVE-2019-18417](https://cve.now/CVE-2019-18417.md): Sourcecodester Restaurant Management System 1.0 allows an authenticated attacker to upload arbitrary files that can result in code execution (no CVSS)
- [CVE-2019-18416](https://cve.now/CVE-2019-18416.md): Sourcecodester Restaurant Management System 1.0 allows XSS via the Last Name field of a member. (no CVSS)
- [CVE-2019-8080](https://cve.now/CVE-2019-8080.md): Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2019-8079](https://cve.now/CVE-2019-8079.md): Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross site scripting vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2019-18414](https://cve.now/CVE-2019-18414.md): Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lac (no CVSS)
- [CVE-2019-12095](https://cve.now/CVE-2019-12095.md): Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmark (no CVSS)
- [CVE-2019-8078](https://cve.now/CVE-2019-8078.md): Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2019-12094](https://cve.now/CVE-2019-12094.md): Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update\_f&user\_name= or admin/user.php?form=remove\_f&use (no CVSS)
- [CVE-2019-15929](https://cve.now/CVE-2019-15929.md): In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibil (no CVSS, craftcms/cms)
- [CVE-2019-18196](https://cve.now/CVE-2019-18196.md): A DLL side loading vulnerability in the Windows Service in TeamViewer versions up to 11.0.133222 (fixed in 11.0.214397), 12.0.181268 (fixed (no CVSS)
- [CVE-2019-9699](https://cve.now/CVE-2019-9699.md): Symantec Messaging Gateway (prior to 10.7.0), may be susceptible to an information disclosure issue, which is a type of vulnerability that c (no CVSS, Symantec Messaging Gateway)
- [CVE-2019-11021](https://cve.now/CVE-2019-11021.md): admin/app/mediamanager in Schlix CMS 2.1.8-7 allows Authenticated Unrestricted File Upload, leading to remote code execution. (no CVSS)
- [CVE-2019-5012](https://cve.now/CVE-2019-5012.md): An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the startProcess co (CVSS 7.8, Wacom)
- [CVE-2019-5013](https://cve.now/CVE-2019-5013.md): An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the start/stopLaunc (CVSS 7.1, Wacom)
- [CVE-2019-13653](https://cve.now/CVE-2019-13653.md): TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow triggerPort OS Command Injection (issue 5 of 5). (no CVSS)
- [CVE-2019-13652](https://cve.now/CVE-2019-13652.md): TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow serviceName OS Command Injection (issue 4 of 5). (no CVSS)
- [CVE-2019-13651](https://cve.now/CVE-2019-13651.md): TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow portMappingProtocol OS Command Injection (issue 3 of 5). (no CVSS)
- [CVE-2019-13650](https://cve.now/CVE-2019-13650.md): TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow internalPort OS Command Injection (issue 2 of 5). (no CVSS)
- [CVE-2019-13649](https://cve.now/CVE-2019-13649.md): TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow externalPort OS Command Injection (issue 1 of 5). (no CVSS)
- [CVE-2019-12017](https://cve.now/CVE-2019-12017.md): A remote code execution vulnerability exists in MapR CLDB code, specifically in the JSON framework that is used in the CLDB code that handle (no CVSS, MapR-MFS/CLDB)
- [CVE-2019-18201](https://cve.now/CVE-2019-18201.md): An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. (no CVSS)
- [CVE-2019-18200](https://cve.now/CVE-2019-18200.md): An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. (no CVSS)
- [CVE-2019-18409](https://cve.now/CVE-2019-18409.md): The ruby\_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. (no CVSS, ruby\_parser-legacy)
- [CVE-2019-15703](https://cve.now/CVE-2019-15703.md): An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0, 6.0.8 and below for device not enable hardware TRNG token an (no CVSS, Fortinet FortiOS)
- [CVE-2019-18199](https://cve.now/CVE-2019-18199.md): An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. (no CVSS)
- [CVE-2019-6692](https://cve.now/CVE-2019-6692.md): A malicious DLL preload vulnerability in Fortinet FortiClient for Windows 6.2.0 and below allows a privileged attacker to perform arbitrary (no CVSS, Fortinet FortiClient for Windows)
- [CVE-2019-18408](https://cve.now/CVE-2019-18408.md): archive\_read\_format\_rar\_read\_data in archive\_read\_support\_format\_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE\_ (no CVSS)
- [CVE-2019-17581](https://cve.now/CVE-2019-17581.md): tonyy dormsystem through 1.3 allows DOM XSS. (no CVSS)
- [CVE-2019-4486](https://cve.now/CVE-2019-4486.md): IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Maximo Asset Management)
- [CVE-2019-4459](https://cve.now/CVE-2019-4459.md): IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 is vulnerable to cross-site scripti (CVSS 5.4, IBM Cloud Orchestrator)
- [CVE-2019-4398](https://cve.now/CVE-2019-4398.md): IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 could allow a local user to obtain (CVSS 4.0, IBM Cloud Orchestrator)
- [CVE-2019-4397](https://cve.now/CVE-2019-4397.md): IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 stores sensitive information in URL (CVSS 5.3, IBM Cloud Orchestrator)
- [CVE-2019-18394](https://cve.now/CVE-2019-18394.md): A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send (no CVSS, org.igniterealtime.openfire:parent)
- [CVE-2019-18393](https://cve.now/CVE-2019-18393.md): PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home direct (no CVSS, org.igniterealtime.openfire:parent)
- [CVE-2019-18413](https://cve.now/CVE-2019-18413.md): In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via (CVSS 3.7, class-validator)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.