# CVEs published 2019-10-29

56 CVEs were published on October 29, 2019: 0 critical, 2 high. Days are UTC.

- [CVE-2019-8235](https://cve.now/CVE-2019-8235.md): An insecure direct object reference (IDOR) vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 v (no CVSS, Adobe Magento)
- [CVE-2010-2064](https://cve.now/CVE-2010-2064.md): rpcbind 0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /tmp/portmap.xdr and (2) /tmp/rp (no CVSS, rpcbind)
- [CVE-2010-2061](https://cve.now/CVE-2010-2061.md): rpcbind 0.2.0 does not properly validate (1) /tmp/portmap.xdr and (2) /tmp/rpcbind.xdr, which can be created by an attacker before the daemo (no CVSS, rpcbind)
- [CVE-2012-0694](https://cve.now/CVE-2012-0694.md): SugarCRM CE \<= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2010-1678](https://cve.now/CVE-2010-1678.md): Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile parsing. (no CVSS)
- [CVE-2018-19151](https://cve.now/CVE-2018-19151.md): qtum through 0.16 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. (no CVSS)
- [CVE-2011-1408](https://cve.now/CVE-2011-1408.md): ikiwiki before 3.20110608 allows remote attackers to hijack root's tty and run symlink attacks. (no CVSS)
- [CVE-2018-18931](https://cve.now/CVE-2018-18931.md): An issue was discovered in the Tightrope Media Carousel digital signage product 7.0.4.104. (no CVSS)
- [CVE-2018-18930](https://cve.now/CVE-2018-18930.md): The Tightrope Media Carousel digital signage product 7.0.4.104 contains an arbitrary file upload vulnerability in the Manage Bulletins/Uploa (no CVSS)
- [CVE-2018-18929](https://cve.now/CVE-2018-18929.md): The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a default local administrator username and passwor (no CVSS)
- [CVE-2016-4289](https://cve.now/CVE-2016-4289.md): A stack based buffer overflow vulnerability exists in the method receiving data from SysTreeView32 control of the GMER 2.1.19357 application (no CVSS, GMER)
- [CVE-2018-10727](https://cve.now/CVE-2018-10727.md): Reflected Cross-Site Scripting (XSS) vulnerability in the fabrik\_referrer hidden field in the Fabrikar Fabrik component through v3.8.1 for J (no CVSS)
- [CVE-2011-0428](https://cve.now/CVE-2011-0428.md): Cross Site Scripting (XSS) in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient chec (no CVSS)
- [CVE-2019-18624](https://cve.now/CVE-2019-18624.md): Opera Mini for Android allows attackers to bypass intended restrictions on .apk file download/installation via an RTLO (aka Right to Left Ov (no CVSS)
- [CVE-2010-4237](https://cve.now/CVE-2010-4237.md): Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate sig (no CVSS, mercurial)
- [CVE-2019-13066](https://cve.now/CVE-2019-13066.md): Sahi Pro 8.0.0 has a script manager arena located at \_s\_/dyn/pro/DBReports with many different areas that are vulnerable to reflected XSS, b (no CVSS)
- [CVE-2019-15683](https://cve.now/CVE-2019-15683.md): TurboVNC server code contains stack buffer overflow vulnerability in commit prior to cea98166008301e614e0d36776bf9435a536136e. (no CVSS, Kaspersky TurboVNC)
- [CVE-2019-9926](https://cve.now/CVE-2019-9926.md): An issue was discovered in LabKey Server 19.1.0. (no CVSS)
- [CVE-2019-15680](https://cve.now/CVE-2019-15680.md): TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). (no CVSS, Kaspersky TightVNC)
- [CVE-2019-15679](https://cve.now/CVE-2019-15679.md): TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution. (no CVSS, Kaspersky TightVNC)
- [CVE-2019-15678](https://cve.now/CVE-2019-15678.md): TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result code execution.. (no CVSS, Kaspersky TightVNC)
- [CVE-2019-8287](https://cve.now/CVE-2019-8287.md): TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution. (no CVSS, Kaspersky TightVNC)
- [CVE-2019-9758](https://cve.now/CVE-2019-9758.md): An issue was discovered in LabKey Server 19.1.0. (no CVSS)
- [CVE-2019-9757](https://cve.now/CVE-2019-9757.md): An issue was discovered in LabKey Server 19.1.0. (no CVSS)
- [CVE-2019-10749](https://cve.now/CVE-2019-10749.md): sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Po (no CVSS, sequelize)
- [CVE-2019-15681](https://cve.now/CVE-2019-15681.md): LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker t (no CVSS, Kaspersky LibVNC)
- [CVE-2019-16647](https://cve.now/CVE-2019-16647.md): Unquoted Search Path in Maxthon 5.1.0 to 5.2.7 Browser for Windows. (no CVSS)
- [CVE-2019-18611](https://cve.now/CVE-2019-18611.md): An issue was discovered in the CheckUser extension through 1.34 for MediaWiki. (no CVSS)
- [CVE-2019-18612](https://cve.now/CVE-2019-18612.md): An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. (no CVSS)
- [CVE-2019-18608](https://cve.now/CVE-2019-18608.md): Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting (no CVSS, cezerin)
- [CVE-2019-6851](https://cve.now/CVE-2019-6851.md): A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (al (no CVSS, Modicon M580, Modicon M340, Modicon Premium , Modicon Quant…)
- [CVE-2019-6850](https://cve.now/CVE-2019-6850.md): A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the di (no CVSS, Modicon M580, Modicon BMENOC 0311, Modicon BMENOC)
- [CVE-2019-6849](https://cve.now/CVE-2019-6849.md): A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the di (no CVSS, Modicon M580, Modicon BMENOC 0311, Modicon BMENOC)
- [CVE-2019-6848](https://cve.now/CVE-2019-6848.md): A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU (BMEx58\*) and Modicon M580 communication mod (no CVSS, Modicon M580 CPU (BMEx58\*) and Modicon M580 communication m…)
- [CVE-2019-6847](https://cve.now/CVE-2019-6847.md): A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (no CVSS, Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA mod…)
- [CVE-2019-6846](https://cve.now/CVE-2019-6846.md): A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA mod (no CVSS, Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modul…)
- [CVE-2019-6845](https://cve.now/CVE-2019-6845.md): A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Qua (no CVSS, Modicon M580, Modicon M340, Modicon Premium , Modicon Quant…)
- [CVE-2019-6844](https://cve.now/CVE-2019-6844.md): A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (no CVSS, Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA mod…)
- [CVE-2019-6843](https://cve.now/CVE-2019-6843.md): A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon (no CVSS, Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA mod…)
- [CVE-2019-6842](https://cve.now/CVE-2019-6842.md): A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules (no CVSS, Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA mod…)
- [CVE-2019-6841](https://cve.now/CVE-2019-6841.md): A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior to V3.10), Modicon (no CVSS, Modicon M580, Modicon M340, and Modicon BMxCRA / 140CRA mod…)
- [CVE-2019-18602](https://cve.now/CVE-2019-18602.md): OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to an information disclosure vulnerability because uninitialized scalars are sent over (no CVSS)
- [CVE-2019-18603](https://cve.now/CVE-2019-18603.md): OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to information leakage upon certain error conditions because uninitialized RPC output (no CVSS)
- [CVE-2019-18601](https://cve.now/CVE-2019-18601.md): OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to denial of service from unserialized data access because remote attackers can make a (no CVSS)
- [CVE-2019-10211](https://cve.now/CVE-2019-10211.md): Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unpro (CVSS 7.8, postgresql)
- [CVE-2019-10208](https://cve.now/CVE-2019-10208.md): A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x befor (CVSS 7.5, postgresql)
- [CVE-2019-10209](https://cve.now/CVE-2019-10209.md): Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan. (CVSS 3.1, postgresql)
- [CVE-2012-0046](https://cve.now/CVE-2012-0046.md): mediawiki allows deleted text to be exposed (no CVSS, mediawiki)
- [CVE-2011-4931](https://cve.now/CVE-2011-4931.md): gpw generates shorter passwords than required (no CVSS, gpw)
- [CVE-2012-1187](https://cve.now/CVE-2012-1187.md): Bitlbee does not drop extra group privileges correctly in unix.c (no CVSS, Bitlbee)
- [CVE-2009-3723](https://cve.now/CVE-2009-3723.md): asterisk allows calls on prohibited networks (no CVSS, asterisk)
- [CVE-2009-3887](https://cve.now/CVE-2009-3887.md): ytnef has directory traversal (no CVSS, ytnef)
- [CVE-2010-3375](https://cve.now/CVE-2010-3375.md): qtparted has insecure library loading which may allow arbitrary code execution (no CVSS)
- [CVE-2010-3373](https://cve.now/CVE-2010-3373.md): paxtest handles temporary files insecurely (no CVSS)
- [CVE-2019-10210](https://cve.now/CVE-2019-10210.md): Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected (CVSS 6.7, postgresql)
- [CVE-2019-18604](https://cve.now/CVE-2019-18604.md): In axohelp.c before 1.3 in axohelp in axodraw2 before 2.1.1b, as distributed in TeXLive and other collections, sprintf is mishandled. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.