CVEs published October 29, 2019
56 CVEs were published on October 29, 2019: 0 critical, 2 high.
- Published
- 56
- Critical
- 0
- High
- 2
- Medium
- 1
- Low
- 1
- Unrated
- 52
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA mod…
- 5
- Kaspersky TightVNC
- 4
- postgresql
- 4
- Modicon M580, Modicon BMENOC 0311, Modicon BMENOC
- 2
- Modicon M580, Modicon M340, Modicon Premium , Modicon Quant…
- 2
- rpcbind
- 2
- Adobe Magento
- 1
- asterisk
- 1
- Bitlbee
- 1
- cezerin
- 1
High 2
- CVE-2019-10211Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unpropostgresql
- CVE-2019-10208A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x beforpostgresql
Medium, low and unrated 54
- CVE-2019-8235An insecure direct object reference (IDOR) vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 vAdobe Magento
- CVE-2010-2064rpcbind 0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /tmp/portmap.xdr and (2) /tmp/rprpcbind
- CVE-2010-2061rpcbind 0.2.0 does not properly validate (1) /tmp/portmap.xdr and (2) /tmp/rpcbind.xdr, which can be created by an attacker before the daemorpcbind
- CVE-2012-0694SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary
- CVE-2010-1678Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile parsing.
- CVE-2018-19151qtum through 0.16 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service.
- CVE-2011-1408ikiwiki before 3.20110608 allows remote attackers to hijack root's tty and run symlink attacks.
- CVE-2018-18931An issue was discovered in the Tightrope Media Carousel digital signage product 7.0.4.104.
- CVE-2018-18930The Tightrope Media Carousel digital signage product 7.0.4.104 contains an arbitrary file upload vulnerability in the Manage Bulletins/Uploa
- CVE-2018-18929The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a default local administrator username and passwor
- CVE-2016-4289A stack based buffer overflow vulnerability exists in the method receiving data from SysTreeView32 control of the GMER 2.1.19357 applicationGMER
- CVE-2018-10727Reflected Cross-Site Scripting (XSS) vulnerability in the fabrik_referrer hidden field in the Fabrikar Fabrik component through v3.8.1 for J
- CVE-2011-0428Cross Site Scripting (XSS) in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient chec
- CVE-2019-18624Opera Mini for Android allows attackers to bypass intended restrictions on .apk file download/installation via an RTLO (aka Right to Left Ov
- CVE-2010-4237Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate sigmercurial
- CVE-2019-13066Sahi Pro 8.0.0 has a script manager arena located at _s_/dyn/pro/DBReports with many different areas that are vulnerable to reflected XSS, b
- CVE-2019-15683TurboVNC server code contains stack buffer overflow vulnerability in commit prior to cea98166008301e614e0d36776bf9435a536136e.Kaspersky TurboVNC
- CVE-2019-9926An issue was discovered in LabKey Server 19.1.0.
- CVE-2019-15680TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS).Kaspersky TightVNC
- CVE-2019-15679TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution.Kaspersky TightVNC
- CVE-2019-15678TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result code execution..Kaspersky TightVNC
- CVE-2019-8287TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution.Kaspersky TightVNC
- CVE-2019-9758An issue was discovered in LabKey Server 19.1.0.
- CVE-2019-9757An issue was discovered in LabKey Server 19.1.0.
- CVE-2019-10749sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Posequelize
- CVE-2019-15681LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker tKaspersky LibVNC
- CVE-2019-16647Unquoted Search Path in Maxthon 5.1.0 to 5.2.7 Browser for Windows.
- CVE-2019-18611An issue was discovered in the CheckUser extension through 1.34 for MediaWiki.
- CVE-2019-18612An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki.
- CVE-2019-18608Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting cezerin
- CVE-2019-6851A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (alModicon M580, Modicon M340, Modicon Premium , Modicon Quant…
- CVE-2019-6850A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the diModicon M580, Modicon BMENOC 0311, Modicon BMENOC
- CVE-2019-6849A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the diModicon M580, Modicon BMENOC 0311, Modicon BMENOC
- CVE-2019-6848A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU (BMEx58*) and Modicon M580 communication modModicon M580 CPU (BMEx58*) and Modicon M580 communication m…
- CVE-2019-6847A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modulesModicon M580, Modicon M340, and Modicon BMxCRA / 140CRA mod…
- CVE-2019-6846A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modModicon M580, Modicon M340, Modicon BMxCRA and 140CRA modul…
- CVE-2019-6845A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon QuaModicon M580, Modicon M340, Modicon Premium , Modicon Quant…
- CVE-2019-6844A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modulesModicon M580, Modicon M340, and Modicon BMxCRA / 140CRA mod…
- CVE-2019-6843A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA mod…
- CVE-2019-6842A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modulesModicon M580, Modicon M340, and Modicon BMxCRA / 140CRA mod…
- CVE-2019-6841A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA mod…
- CVE-2019-18602OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to an information disclosure vulnerability because uninitialized scalars are sent over
- CVE-2019-18603OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to information leakage upon certain error conditions because uninitialized RPC output
- CVE-2019-18601OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to denial of service from unserialized data access because remote attackers can make a
- CVE-2019-10209Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.postgresql
- CVE-2012-0046mediawiki allows deleted text to be exposedmediawiki
- CVE-2011-4931gpw generates shorter passwords than requiredgpw
- CVE-2012-1187Bitlbee does not drop extra group privileges correctly in unix.cBitlbee
- CVE-2009-3723asterisk allows calls on prohibited networksasterisk
- CVE-2009-3887ytnef has directory traversalytnef
- CVE-2010-3375qtparted has insecure library loading which may allow arbitrary code execution
- CVE-2010-3373paxtest handles temporary files insecurely
- CVE-2019-10210Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotectedpostgresql
- CVE-2019-18604In axohelp.c before 1.3 in axohelp in axodraw2 before 2.1.1b, as distributed in TeXLive and other collections, sprintf is mishandled.