# CVEs published 2019-10-25

56 CVEs were published on October 25, 2019: 3 critical, 15 high. Days are UTC.

- [CVE-2019-18221](https://cve.now/CVE-2019-18221.md): CoreHR Core Portal before 27.0.7 allows stored XSS. (no CVSS)
- [CVE-2017-14742](https://cve.now/CVE-2017-14742.md): Buffer overflow in LabF nfsAxe FTP client 3.7 allows an attacker to execute code remotely. (no CVSS)
- [CVE-2019-17138](https://cve.now/CVE-2019-17138.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.909. (CVSS 3.3, Foxit Studio Photo)
- [CVE-2019-17139](https://cve.now/CVE-2019-17139.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2019-17140](https://cve.now/CVE-2019-17140.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2019-17141](https://cve.now/CVE-2019-17141.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2019-17142](https://cve.now/CVE-2019-17142.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2019-17143](https://cve.now/CVE-2019-17143.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.6.0.25114. (CVSS 3.3, Foxit PhantomPDF)
- [CVE-2019-17144](https://cve.now/CVE-2019-17144.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2019-17145](https://cve.now/CVE-2019-17145.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2019-5508](https://cve.now/CVE-2019-5508.md): Clustered Data ONTAP versions 9.2 through 9.4 are susceptible to a vulnerability which allows an attacker to use l2ping to cause a Denial of (no CVSS, Clustered Data ONTAP)
- [CVE-2019-13525](https://cve.now/CVE-2019-13525.md): In IP-AK2 Access Control Panel Version 1.04.07 and prior, the integrated web server of the affected devices could allow remote attackers to (no CVSS, Honeywell IP-AK2)
- [CVE-2019-13546](https://cve.now/CVE-2019-13546.md): In IntelliSpace Perinatal, Versions K and prior, a vulnerability within the IntelliSpace Perinatal application environment could enable an u (no CVSS, IntelliSpace Perinatal)
- [CVE-2019-13553](https://cve.now/CVE-2019-13553.md): Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. (no CVSS, Rittal Chiller SK 3232-Series)
- [CVE-2019-13549](https://cve.now/CVE-2019-13549.md): Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. (no CVSS, Rittal Chiller SK 3232-Series)
- [CVE-2019-5119](https://cve.now/CVE-2019-5119.md): An exploitable SQL injection vulnerability exist in the authenticated part of YouPHPTube 7.6. (CVSS 7.4, YouPHPTube)
- [CVE-2019-5120](https://cve.now/CVE-2019-5120.md): An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. (CVSS 7.4, YouPHPTube)
- [CVE-2019-5114](https://cve.now/CVE-2019-5114.md): An exploitable SQL injection vulnerability exists in the authenticated portion of YouPHPTube 7.6. (CVSS 7.4, YouPHPTube)
- [CVE-2019-5123](https://cve.now/CVE-2019-5123.md): Specially crafted web requests can cause SQL injections in YouPHPTube 7.6. (CVSS 7.4, YouPHPTube)
- [CVE-2019-5122](https://cve.now/CVE-2019-5122.md): SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. (CVSS 7.4, YouPHPTube)
- [CVE-2019-5121](https://cve.now/CVE-2019-5121.md): SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. (CVSS 7.4, YouPHPTube)
- [CVE-2019-5117](https://cve.now/CVE-2019-5117.md): Exploitable SQL injection vulnerabilities exists in the authenticated portion of YouPHPTube 7.6. (CVSS 7.4, YouPHPTube)
- [CVE-2019-5116](https://cve.now/CVE-2019-5116.md): An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. (CVSS 7.4, YouPHPTube)
- [CVE-2019-5129](https://cve.now/CVE-2019-5129.md): A command injection have been found in YouPHPTube Encoder. (CVSS 10.0, YouPHPTube)
- [CVE-2019-5128](https://cve.now/CVE-2019-5128.md): A command injection have been found in YouPHPTube Encoder. (CVSS 10.0, YouPHPTube)
- [CVE-2019-5127](https://cve.now/CVE-2019-5127.md): A command injection have been found in YouPHPTube Encoder. (CVSS 10.0, YouPHPTube")
- [CVE-2019-16265](https://cve.now/CVE-2019-16265.md): CODESYS V2.3 ENI server up to V3.2.2.24 has a Buffer Overflow. (no CVSS)
- [CVE-2019-4461](https://cve.now/CVE-2019-4461.md): IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP Response Splitting caused by improper caching of co (CVSS 5.4, IBM Cloud Orchestrator)
- [CVE-2019-4400](https://cve.now/CVE-2019-4400.md): IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a remote attacker to traverse directories on the system. (CVSS 4.3, IBM Cloud Orchestrator)
- [CVE-2019-4399](https://cve.now/CVE-2019-4399.md): IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 uses weaker than expected cryptographic algorithms that could allow an at (CVSS 5.9, IBM Cloud Orchestrator)
- [CVE-2019-4396](https://cve.now/CVE-2019-4396.md): IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP response splitting attacks, caused by improper vali (CVSS 5.4, IBM Cloud Orchestrator)
- [CVE-2019-4395](https://cve.now/CVE-2019-4395.md): IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a local user to obtain sensitive information from temporary s (CVSS 4.0, IBM Cloud Orchestrator)
- [CVE-2019-4394](https://cve.now/CVE-2019-4394.md): IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 contain APIs that could be used by a local user to send email. (CVSS 2.3, IBM Cloud Orchestrator)
- [CVE-2019-4036](https://cve.now/CVE-2019-4036.md): IBM Security Access Manager Appliance could allow unauthenticated attacker to cause a denial of service in the reverse proxy component. (CVSS 7.5, IBM Security Access Manager)
- [CVE-2019-14451](https://cve.now/CVE-2019-14451.md): RepetierServer.exe in Repetier-Server 0.8 through 0.91 does not properly validate the XML data structure provided when uploading a new print (no CVSS)
- [CVE-2013-4658](https://cve.now/CVE-2013-4658.md): Linksys EA6500 has SMB Symlink Traversal allowing symbolic links to be created to locations outside of the Samba share. (no CVSS)
- [CVE-2013-4848](https://cve.now/CVE-2013-4848.md): TP-Link TL-WDR4300 version 3.13.31 has multiple CSRF vulnerabilities. (no CVSS)
- [CVE-2013-4855](https://cve.now/CVE-2013-4855.md): D-Link DIR-865L has SMB Symlink Traversal due to misconfiguration in the SMB service allowing symbolic links to be created to locations outs (no CVSS)
- [CVE-2013-4856](https://cve.now/CVE-2013-4856.md): D-Link DIR-865L has Information Disclosure. (no CVSS)
- [CVE-2013-4857](https://cve.now/CVE-2013-4857.md): D-Link DIR-865L has PHP File Inclusion in the router xml file. (no CVSS)
- [CVE-2019-8234](https://cve.now/CVE-2019-8234.md): Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a cross-site request forgery vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2019-8088](https://cve.now/CVE-2019-8088.md): Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a command injection vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2019-8087](https://cve.now/CVE-2019-8087.md): Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2019-8086](https://cve.now/CVE-2019-8086.md): Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2019-8085](https://cve.now/CVE-2019-8085.md): Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2019-8084](https://cve.now/CVE-2019-8084.md): Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2019-8083](https://cve.now/CVE-2019-8083.md): Adobe Experience Manager versions 6.5, 6.4 and 6.3 have a cross site scripting vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2019-8082](https://cve.now/CVE-2019-8082.md): Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2019-8081](https://cve.now/CVE-2019-8081.md): Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have an authentication bypass vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2015-0270](https://cve.now/CVE-2015-0270.md): Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\\Db adapter. (no CVSS, Zend Framework · zendframework/zendframework +1)
- [CVE-2016-5202](https://cve.now/CVE-2016-5202.md): browser/extensions/api/dial/dial\_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0. (no CVSS, chromium-browser)
- [CVE-2016-2357](https://cve.now/CVE-2016-2357.md): Milesight IP security cameras through 2016-11-14 have a hardcoded SSL private key under the /etc/config directory. (no CVSS, Milesight IP security cameras)
- [CVE-2016-2356](https://cve.now/CVE-2016-2356.md): Milesight IP security cameras through 2016-11-14 have a buffer overflow in a web application via a long username or password. (no CVSS, Milesight IP security cameras)
- [CVE-2016-2359](https://cve.now/CVE-2016-2359.md): Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultan (no CVSS, Milesight IP security cameras)
- [CVE-2016-2358](https://cve.now/CVE-2016-2358.md): Milesight IP security cameras through 2016-11-14 have a default set of 10 privileged accounts with hardcoded credentials. (no CVSS, Milesight IP security cameras)
- [CVE-2016-2360](https://cve.now/CVE-2016-2360.md): Milesight IP security cameras through 2016-11-14 have a default root password in /etc/shadow that is the same across different customers' in (no CVSS, Milesight IP security cameras)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.