# CVEs published 2019-10-28

56 CVEs were published on October 28, 2019: 0 critical, 3 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2019-4600](https://cve.now/CVE-2019-4600.md): IBM API Connect version V5.0.0.0 through 5.0.8.7 could reveal sensitive information to an attacker using a specially crafted HTTP request. (CVSS 5.3, IBM API Connect)
- [CVE-2019-4546](https://cve.now/CVE-2019-4546.md): After installing the IBM Maximo Health- Safety and Environment Manager 7.6.1, a user is granted additional privileges that they are not norm (CVSS 5.4, IBM Maximo Health- Safety and Environment Manager)
- [CVE-2019-4339](https://cve.now/CVE-2019-4339.md): IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to (CVSS 5.9, IBM Security Guardium Big Data Intelligence)
- [CVE-2019-4330](https://cve.now/CVE-2019-4330.md): IBM Security Guardium Big Data Intelligence (SonarG) 4.0 does not set the secure attribute for cookies in HTTPS sessions, which could cause (CVSS 3.1, IBM Security Guardium Big Data Intelligence)
- [CVE-2019-4329](https://cve.now/CVE-2019-4329.md): IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass (CVSS 4.3, IBM Security Guardium Big Data Intelligence)
- [CVE-2019-4314](https://cve.now/CVE-2019-4314.md): IBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores sensitive information in cleartext within a resource that might be accessibl (CVSS 5.9, IBM Security Guardium Big Data Intelligence)
- [CVE-2019-4311](https://cve.now/CVE-2019-4311.md): IBM Security Guardium Big Data Intelligence (SonarG) 4.0 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM Security Guardium Big Data Intelligence)
- [CVE-2019-4309](https://cve.now/CVE-2019-4309.md): IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses hard coded credentials which could allow a local user to obtain highly sensiti (CVSS 5.9, IBM Security Guardium Big Data Intelligence)
- [CVE-2019-4307](https://cve.now/CVE-2019-4307.md): IBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores user credentials in plain in clear text which can be read by a local user. (CVSS 5.1, IBM Security Guardium Big Data Intelligence)
- [CVE-2019-4306](https://cve.now/CVE-2019-4306.md): IBM Security Guardium Big Data Intelligence (SonarG) 4.0 specifies permissions for a security-critical resource which could lead to the expo (CVSS 6.5, IBM Security Guardium Big Data Intelligence)
- [CVE-2019-0205](https://cve.now/CVE-2019-0205.md): In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data (no CVSS, Apache Thrift · org.apache.thrift:libthrift)
- [CVE-2019-0210](https://cve.now/CVE-2019-0210.md): In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid inp (no CVSS, Apache Thrift · github.com/apache/thrift)
- [CVE-2019-5533](https://cve.now/CVE-2019-5533.md): In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterp (no CVSS, VMware SD-WAN by VeloCloud)
- [CVE-2019-10743](https://cve.now/CVE-2019-10743.md): All versions of archiver allow attacker to perform a Zip Slip attack via the "unarchive" functions. (no CVSS, archiver · github.com/mholt/archiver)
- [CVE-2019-10748](https://cve.now/CVE-2019-10748.md): Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped (no CVSS, Sequelize)
- [CVE-2019-3977](https://cve.now/CVE-2019-3977.md): RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the (no CVSS, MikroTik RouterOS)
- [CVE-2019-3979](https://cve.now/CVE-2019-3979.md): RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated data attack. (no CVSS, MikroTik RouterOS)
- [CVE-2019-3978](https://cve.now/CVE-2019-3978.md): RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. (no CVSS, MikroTik RouterOS)
- [CVE-2019-3976](https://cve.now/CVE-2019-3976.md): RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade (no CVSS, MikroTik RouterOS)
- [CVE-2012-2945](https://cve.now/CVE-2012-2945.md): Hadoop 1.0.3 contains a symlink vulnerability. (no CVSS, org.apache.hadoop:hadoop-main)
- [CVE-2011-2538](https://cve.now/CVE-2011-2538.md): Cisco Video Communications Server (VCS) before X7.0.3 contains a command injection vulnerability which allows remote, authenticated attacker (no CVSS, Cisco Video Communications Server)
- [CVE-2019-18187](https://cve.now/CVE-2019-18187.md): Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extrac (CVSS 8.8, KEV, Trend Micro OfficeScan)
- [CVE-2019-18188](https://cve.now/CVE-2019-18188.md): Trend Micro Apex One could be exploited by an attacker utilizing a command injection vulnerability to extract files from an arbitrary zip fi (no CVSS, Trend Micro Apex One)
- [CVE-2019-18189](https://cve.now/CVE-2019-18189.md): A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (11.0, XG) and Worry-Free Business Security (9.5, 10.0) may allow an (no CVSS, Trend Micro Apex One, Trend Micro OfficeScan (OSCE), Trend…)
- [CVE-2017-15725](https://cve.now/CVE-2017-15725.md): An XML External Entity Injection vulnerability exists in Dzone AnswerHub. (no CVSS)
- [CVE-2019-14450](https://cve.now/CVE-2019-14450.md): A directory traversal vulnerability was discovered in RepetierServer.exe in Repetier-Server 0.8 through 0.91 that allows for the creation of (no CVSS)
- [CVE-2019-17181](https://cve.now/CVE-2019-17181.md): A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03). (no CVSS)
- [CVE-2012-5577](https://cve.now/CVE-2012-5577.md): Python keyring lib before 0.10 created keyring files with world-readable permissions. (no CVSS, Python keyring lib · keyring)
- [CVE-2019-5536](https://cve.now/CVE-2019-5536.md): VMware ESXi (6.7 before ESXi670-201908101-SG and 6.5 before ESXi650-201910401-SG), Workstation (15.x before 15.5.0) and Fusion (11.x before (no CVSS, VMware ESXi, Workstation and Fusion)
- [CVE-2019-5538](https://cve.now/CVE-2019-5538.md): Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore oper (no CVSS, VMware vCenter Server Appliance)
- [CVE-2019-5537](https://cve.now/CVE-2019-5537.md): Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore oper (no CVSS, VMware vCenter Server Appliance)
- [CVE-2019-16897](https://cve.now/CVE-2019-16897.md): In K7 Antivirus Premium 16.0.xxx through 16.0.0120; K7 Total Security 16.0.xxx through 16.0.0120; and K7 Ultimate Security 16.0.xxx through (no CVSS)
- [CVE-2010-4239](https://cve.now/CVE-2010-4239.md): Tiki Wiki CMS Groupware 5.2 has Local File Inclusion (no CVSS, Tiki Wiki CMS Groupware)
- [CVE-2017-5731](https://cve.now/CVE-2017-5731.md): Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially enable an escalation of privilege vi (no CVSS, Tianocore)
- [CVE-2010-4240](https://cve.now/CVE-2010-4240.md): Tiki Wiki CMS Groupware 5.2 has XSS (no CVSS, Tiki Wiki CMS Groupware)
- [CVE-2010-4241](https://cve.now/CVE-2010-4241.md): Tiki Wiki CMS Groupware 5.2 has CSRF (no CVSS, Tiki Wiki CMS Groupware)
- [CVE-2010-4245](https://cve.now/CVE-2010-4245.md): pootle 2.0.5 has XSS via 'match\_names' parameter (no CVSS)
- [CVE-2019-17224](https://cve.now/CVE-2019-17224.md): The web interface of the Compal Broadband CH7465LG modem (version CH7465LG-NCIP-6.12.18.25-2p6-NOSH) is vulnerable to a /%2f/ path traversal (no CVSS)
- [CVE-2019-3636](https://cve.now/CVE-2019-3636.md): File masquerade attack vulnerability in McAfee Total Protection (CVSS 7.5, McAfee, LCC McAfee Total Protection)
- [CVE-2019-11043](https://cve.now/CVE-2019-11043.md): Underflow in PHP-FPM can lead to RCE (CVSS 8.7, KEV, PHP)
- [CVE-2009-4900](https://cve.now/CVE-2009-4900.md): pixelpost 1.7.1 has XSS (no CVSS)
- [CVE-2009-4899](https://cve.now/CVE-2009-4899.md): pixelpost 1.7.1 has SQL injection (no CVSS)
- [CVE-2010-3293](https://cve.now/CVE-2010-3293.md): mailscanner can allow local users to prevent virus signatures from being updated (no CVSS)
- [CVE-2019-18195](https://cve.now/CVE-2019-18195.md): An issue was discovered on TerraMaster FS-210 4.0.19 devices. (no CVSS)
- [CVE-2005-2349](https://cve.now/CVE-2005-2349.md): Zoo 2.10 has Directory traversal (no CVSS)
- [CVE-2002-2444](https://cve.now/CVE-2002-2444.md): Snoopy before 2.0.0 has a security hole in exec cURL (no CVSS)
- [CVE-2019-18466](https://cve.now/CVE-2019-18466.md): An issue was discovered in Podman in libpod before 1.6.0. (no CVSS, github.com/containers/libpod · github.com/containers/pod… +3)
- [CVE-2019-14925](https://cve.now/CVE-2019-14925.md): An issue was discovered on Mitsubishi Electric Europe B.V. (no CVSS)
- [CVE-2019-14929](https://cve.now/CVE-2019-14929.md): An issue was discovered on Mitsubishi Electric Europe B.V. (no CVSS)
- [CVE-2019-14930](https://cve.now/CVE-2019-14930.md): An issue was discovered on Mitsubishi Electric Europe B.V. (no CVSS)
- [CVE-2019-14926](https://cve.now/CVE-2019-14926.md): An issue was discovered on Mitsubishi Electric Europe B.V. (no CVSS)
- [CVE-2019-14928](https://cve.now/CVE-2019-14928.md): An issue was discovered on Mitsubishi Electric Europe B.V. (no CVSS)
- [CVE-2019-14927](https://cve.now/CVE-2019-14927.md): An issue was discovered on Mitsubishi Electric Europe B.V. (no CVSS)
- [CVE-2019-14931](https://cve.now/CVE-2019-14931.md): An issue was discovered on Mitsubishi Electric Europe B.V. (no CVSS)
- [CVE-2019-16663](https://cve.now/CVE-2019-16663.md): An issue was discovered in rConfig 3.9.2. (no CVSS)
- [CVE-2019-16662](https://cve.now/CVE-2019-16662.md): An issue was discovered in rConfig 3.9.2. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.