CVEs published October 28, 2019
56 CVEs were published on October 28, 2019: 0 critical, 3 high. 2 are now in CISA KEV.
- Published
- 56
- Critical
- 0
- High
- 3
- Medium
- 9
- Low
- 1
- Unrated
- 43
- Now in CISA KEV
- 2
- Fix available
- 9
Most affected products
- IBM Security Guardium Big Data Intelligence
- 8
- MikroTik RouterOS
- 4
- Tiki Wiki CMS Groupware
- 3
- VMware vCenter Server Appliance
- 2
- Apache Thrift · github.com/apache/thrift
- 1
- Apache Thrift · org.apache.thrift:libthrift
- 1
- archiver · github.com/mholt/archiver
- 1
- Cisco Video Communications Server
- 1
- github.com/containers/libpod · github.com/containers/pod… +3
- 1
- IBM API Connect
- 1
High 3
- CVE-2019-18187Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extracTrend Micro OfficeScan
- CVE-2019-3636File masquerade attack vulnerability in McAfee Total ProtectionMcAfee, LCC McAfee Total Protection
- CVE-2019-11043Underflow in PHP-FPM can lead to RCEPHP
Medium, low and unrated 53
- CVE-2019-4600IBM API Connect version V5.0.0.0 through 5.0.8.7 could reveal sensitive information to an attacker using a specially crafted HTTP request.IBM API Connect
- CVE-2019-4546After installing the IBM Maximo Health- Safety and Environment Manager 7.6.1, a user is granted additional privileges that they are not normIBM Maximo Health- Safety and Environment Manager
- CVE-2019-4339IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to IBM Security Guardium Big Data Intelligence
- CVE-2019-4330IBM Security Guardium Big Data Intelligence (SonarG) 4.0 does not set the secure attribute for cookies in HTTPS sessions, which could cause IBM Security Guardium Big Data Intelligence
- CVE-2019-4329IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass IBM Security Guardium Big Data Intelligence
- CVE-2019-4314IBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores sensitive information in cleartext within a resource that might be accessiblIBM Security Guardium Big Data Intelligence
- CVE-2019-4311IBM Security Guardium Big Data Intelligence (SonarG) 4.0 discloses sensitive information to unauthorized users.IBM Security Guardium Big Data Intelligence
- CVE-2019-4309IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses hard coded credentials which could allow a local user to obtain highly sensitiIBM Security Guardium Big Data Intelligence
- CVE-2019-4307IBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores user credentials in plain in clear text which can be read by a local user.IBM Security Guardium Big Data Intelligence
- CVE-2019-4306IBM Security Guardium Big Data Intelligence (SonarG) 4.0 specifies permissions for a security-critical resource which could lead to the expoIBM Security Guardium Big Data Intelligence
- CVE-2019-0205In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input dataApache Thrift · org.apache.thrift:libthrift
- CVE-2019-0210In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid inpApache Thrift · github.com/apache/thrift
- CVE-2019-5533In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterpVMware SD-WAN by VeloCloud
- CVE-2019-10743All versions of archiver allow attacker to perform a Zip Slip attack via the "unarchive" functions.archiver · github.com/mholt/archiver
- CVE-2019-10748Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped Sequelize
- CVE-2019-3977RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using theMikroTik RouterOS
- CVE-2019-3979RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated data attack.MikroTik RouterOS
- CVE-2019-3978RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291.MikroTik RouterOS
- CVE-2019-3976RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgradeMikroTik RouterOS
- CVE-2012-2945Hadoop 1.0.3 contains a symlink vulnerability.org.apache.hadoop:hadoop-main
- CVE-2011-2538Cisco Video Communications Server (VCS) before X7.0.3 contains a command injection vulnerability which allows remote, authenticated attackerCisco Video Communications Server
- CVE-2019-18188Trend Micro Apex One could be exploited by an attacker utilizing a command injection vulnerability to extract files from an arbitrary zip fiTrend Micro Apex One
- CVE-2019-18189A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (11.0, XG) and Worry-Free Business Security (9.5, 10.0) may allow anTrend Micro Apex One, Trend Micro OfficeScan (OSCE), Trend…
- CVE-2017-15725An XML External Entity Injection vulnerability exists in Dzone AnswerHub.
- CVE-2019-14450A directory traversal vulnerability was discovered in RepetierServer.exe in Repetier-Server 0.8 through 0.91 that allows for the creation of
- CVE-2019-17181A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03).
- CVE-2012-5577Python keyring lib before 0.10 created keyring files with world-readable permissions.Python keyring lib · keyring
- CVE-2019-5536VMware ESXi (6.7 before ESXi670-201908101-SG and 6.5 before ESXi650-201910401-SG), Workstation (15.x before 15.5.0) and Fusion (11.x before VMware ESXi, Workstation and Fusion
- CVE-2019-5538Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operVMware vCenter Server Appliance
- CVE-2019-5537Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operVMware vCenter Server Appliance
- CVE-2019-16897In K7 Antivirus Premium 16.0.xxx through 16.0.0120; K7 Total Security 16.0.xxx through 16.0.0120; and K7 Ultimate Security 16.0.xxx through
- CVE-2010-4239Tiki Wiki CMS Groupware 5.2 has Local File InclusionTiki Wiki CMS Groupware
- CVE-2017-5731Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege viTianocore
- CVE-2010-4240Tiki Wiki CMS Groupware 5.2 has XSSTiki Wiki CMS Groupware
- CVE-2010-4241Tiki Wiki CMS Groupware 5.2 has CSRFTiki Wiki CMS Groupware
- CVE-2010-4245pootle 2.0.5 has XSS via 'match_names' parameter
- CVE-2019-17224The web interface of the Compal Broadband CH7465LG modem (version CH7465LG-NCIP-6.12.18.25-2p6-NOSH) is vulnerable to a /%2f/ path traversal
- CVE-2009-4900pixelpost 1.7.1 has XSS
- CVE-2009-4899pixelpost 1.7.1 has SQL injection
- CVE-2010-3293mailscanner can allow local users to prevent virus signatures from being updated
- CVE-2019-18195An issue was discovered on TerraMaster FS-210 4.0.19 devices.
- CVE-2005-2349Zoo 2.10 has Directory traversal
- CVE-2002-2444Snoopy before 2.0.0 has a security hole in exec cURL
- CVE-2019-18466An issue was discovered in Podman in libpod before 1.6.0.github.com/containers/libpod · github.com/containers/pod… +3
- CVE-2019-14925An issue was discovered on Mitsubishi Electric Europe B.V.
- CVE-2019-14929An issue was discovered on Mitsubishi Electric Europe B.V.
- CVE-2019-14930An issue was discovered on Mitsubishi Electric Europe B.V.
- CVE-2019-14926An issue was discovered on Mitsubishi Electric Europe B.V.
- CVE-2019-14928An issue was discovered on Mitsubishi Electric Europe B.V.
- CVE-2019-14927An issue was discovered on Mitsubishi Electric Europe B.V.
- CVE-2019-14931An issue was discovered on Mitsubishi Electric Europe B.V.
- CVE-2019-16663An issue was discovered in rConfig 3.9.2.
- CVE-2019-16662An issue was discovered in rConfig 3.9.2.