CVEs published October 25, 2019
56 CVEs were published on October 25, 2019: 3 critical, 15 high.
- Published
- 56
- Critical
- 3
- High
- 15
- Medium
- 5
- Low
- 3
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- YouPHPTube
- 10
- Adobe Experience Manager
- 9
- Foxit PhantomPDF
- 7
- IBM Cloud Orchestrator
- 6
- Milesight IP security cameras
- 5
- Rittal Chiller SK 3232-Series
- 2
- chromium-browser
- 1
- Clustered Data ONTAP
- 1
- Foxit Studio Photo
- 1
- Honeywell IP-AK2
- 1
Critical 3
High 15
- CVE-2019-17139This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723.Foxit PhantomPDF
- CVE-2019-17140This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114.Foxit PhantomPDF
- CVE-2019-17141This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114.Foxit PhantomPDF
- CVE-2019-17142This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114.Foxit PhantomPDF
- CVE-2019-17144This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114.Foxit PhantomPDF
- CVE-2019-17145This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114.Foxit PhantomPDF
- CVE-2019-5119An exploitable SQL injection vulnerability exist in the authenticated part of YouPHPTube 7.6.YouPHPTube
- CVE-2019-5120An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6.YouPHPTube
- CVE-2019-5114An exploitable SQL injection vulnerability exists in the authenticated portion of YouPHPTube 7.6.YouPHPTube
- CVE-2019-5123Specially crafted web requests can cause SQL injections in YouPHPTube 7.6.YouPHPTube
- CVE-2019-5122SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6.YouPHPTube
- CVE-2019-5121SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6.YouPHPTube
- CVE-2019-5117Exploitable SQL injection vulnerabilities exists in the authenticated portion of YouPHPTube 7.6.YouPHPTube
- CVE-2019-5116An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6.YouPHPTube
- CVE-2019-4036IBM Security Access Manager Appliance could allow unauthenticated attacker to cause a denial of service in the reverse proxy component.IBM Security Access Manager
Medium, low and unrated 38
- CVE-2019-18221CoreHR Core Portal before 27.0.7 allows stored XSS.
- CVE-2017-14742Buffer overflow in LabF nfsAxe FTP client 3.7 allows an attacker to execute code remotely.
- CVE-2019-17138This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.909.Foxit Studio Photo
- CVE-2019-17143This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.6.0.25114.Foxit PhantomPDF
- CVE-2019-5508Clustered Data ONTAP versions 9.2 through 9.4 are susceptible to a vulnerability which allows an attacker to use l2ping to cause a Denial ofClustered Data ONTAP
- CVE-2019-13525In IP-AK2 Access Control Panel Version 1.04.07 and prior, the integrated web server of the affected devices could allow remote attackers to Honeywell IP-AK2
- CVE-2019-13546In IntelliSpace Perinatal, Versions K and prior, a vulnerability within the IntelliSpace Perinatal application environment could enable an uIntelliSpace Perinatal
- CVE-2019-13553Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4.Rittal Chiller SK 3232-Series
- CVE-2019-13549Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4.Rittal Chiller SK 3232-Series
- CVE-2019-16265CODESYS V2.3 ENI server up to V3.2.2.24 has a Buffer Overflow.
- CVE-2019-4461IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP Response Splitting caused by improper caching of coIBM Cloud Orchestrator
- CVE-2019-4400IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a remote attacker to traverse directories on the system.IBM Cloud Orchestrator
- CVE-2019-4399IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 uses weaker than expected cryptographic algorithms that could allow an atIBM Cloud Orchestrator
- CVE-2019-4396IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP response splitting attacks, caused by improper valiIBM Cloud Orchestrator
- CVE-2019-4395IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a local user to obtain sensitive information from temporary sIBM Cloud Orchestrator
- CVE-2019-4394IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 contain APIs that could be used by a local user to send email.IBM Cloud Orchestrator
- CVE-2019-14451RepetierServer.exe in Repetier-Server 0.8 through 0.91 does not properly validate the XML data structure provided when uploading a new print
- CVE-2013-4658Linksys EA6500 has SMB Symlink Traversal allowing symbolic links to be created to locations outside of the Samba share.
- CVE-2013-4848TP-Link TL-WDR4300 version 3.13.31 has multiple CSRF vulnerabilities.
- CVE-2013-4855D-Link DIR-865L has SMB Symlink Traversal due to misconfiguration in the SMB service allowing symbolic links to be created to locations outs
- CVE-2013-4856D-Link DIR-865L has Information Disclosure.
- CVE-2013-4857D-Link DIR-865L has PHP File Inclusion in the router xml file.
- CVE-2019-8234Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a cross-site request forgery vulnerability.Adobe Experience Manager
- CVE-2019-8088Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a command injection vulnerability.Adobe Experience Manager
- CVE-2019-8087Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability.Adobe Experience Manager
- CVE-2019-8086Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability.Adobe Experience Manager
- CVE-2019-8085Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability.Adobe Experience Manager
- CVE-2019-8084Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability.Adobe Experience Manager
- CVE-2019-8083Adobe Experience Manager versions 6.5, 6.4 and 6.3 have a cross site scripting vulnerability.Adobe Experience Manager
- CVE-2019-8082Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability.Adobe Experience Manager
- CVE-2019-8081Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have an authentication bypass vulnerability.Adobe Experience Manager
- CVE-2015-0270Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.Zend Framework · zendframework/zendframework +1
- CVE-2016-5202browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.chromium-browser
- CVE-2016-2357Milesight IP security cameras through 2016-11-14 have a hardcoded SSL private key under the /etc/config directory.Milesight IP security cameras
- CVE-2016-2356Milesight IP security cameras through 2016-11-14 have a buffer overflow in a web application via a long username or password.Milesight IP security cameras
- CVE-2016-2359Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultanMilesight IP security cameras
- CVE-2016-2358Milesight IP security cameras through 2016-11-14 have a default set of 10 privileged accounts with hardcoded credentials.Milesight IP security cameras
- CVE-2016-2360Milesight IP security cameras through 2016-11-14 have a default root password in /etc/shadow that is the same across different customers' inMilesight IP security cameras