CVEs published October 30, 2019
34 CVEs were published on October 30, 2019: 0 critical, 1 high.
- Published
- 34
- Critical
- 0
- High
- 1
- Medium
- 1
- Low
- 0
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- ClipSoft REXPERT
- 6
- transmission
- 2
- Apache Airflow · airflow +1
- 1
- Debian BIND9
- 1
- drbd8
- 1
- Elastic Logstash
- 1
- Elasticsearch · org.elasticsearch:elasticsearch
- 1
- medoo · catfan/medoo
- 1
- poppler
- 1
- RDesktop
- 1
High 1
Medium, low and unrated 33
- CVE-2019-18644The malware scan function in Total Defense Anti-virus 11.5.2.28 is vulnerable to a TOCTOU bug; consequently, symbolic link attacks allow pri
- CVE-2019-18645The quarantine restoration function in Total Defense Anti-virus 11.5.2.28 is vulnerable to symbolic link attacks, allowing files to be writt
- CVE-2010-1673A cross-site scripting (XSS) vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web script or HTML via a
- CVE-2010-0749Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame.transmission
- CVE-2010-0748Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified impact via a large numbetransmission
- CVE-2010-0747drbd8 allows local users to bypass intended restrictions for certain actions via netlink packets, similar to CVE-2009-3725.drbd8
- CVE-2010-0737A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permissions, which allows JRed Hat JBoss
- CVE-2019-18635An issue was discovered in Mooltipass Moolticute through v0.42.1 and v0.42.x-testing through v0.42.5-testing.
- CVE-2018-21029systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS.
- CVE-2019-18633European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain ExplicitKeyTrustEvaluat
- CVE-2019-18632European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a manipulated SAML re
- CVE-2019-10762columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.medoo · catfan/medoo
- CVE-2010-0398The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack.
- CVE-2019-12417A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page viewApache Airflow · airflow +1
- CVE-2019-17326ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to arbitrary file deletion by issuing a HTTP GET request with a speciaClipSoft REXPERT
- CVE-2019-17325ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to upload arbitrary local file via the ActiveX method in RexViewerCtrlClipSoft REXPERT
- CVE-2019-17324ClipSoft REXPERT 1.0.0.527 and earlier version allows directory traversal by issuing a special HTTP POST request with ../ characters.ClipSoft REXPERT
- CVE-2019-17323ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation and execution via report print function of rexpert viewer withClipSoft REXPERT
- CVE-2010-0207In xpdf, the xref table contains an infinite loop which allows remote attackers to cause a denial of service (application crash) in xpdf-baspoppler
- CVE-2019-17322ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set to the file path to ClipSoft REXPERT
- CVE-2019-17321ClipSoft REXPERT 1.0.0.527 and earlier version have an information disclosure issue.ClipSoft REXPERT
- CVE-2013-1391Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR sys
- CVE-2010-0206xpdf allows remote attackers to cause a denial of service (NULL pointer dereference and crash) in the way it processes JBIG2 PDF stream objexpdf
- CVE-2019-18207In Zucchetti InfoBusiness before and including 4.4.1, an authenticated user can inject client-side code due to improper validation of the Ti
- CVE-2019-18206A cross-site request forgery (CSRF) vulnerability in Zucchetti InfoBusiness before and including 4.4.1 allows arbitrary file upload.
- CVE-2019-18205Multiple Reflected Cross-site Scripting (XSS) vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1.
- CVE-2019-18204Zucchetti InfoBusiness before and including 4.4.1 allows any authenticated user to upload .php files in order to achieve code execution.
- CVE-2018-18678GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board group extra contents" pa
- CVE-2018-16417Aruba Instant 4.x prior to 6.4.4.8-4.2.4.12, 6.5.x prior to 6.5.4.11, 8.3.x prior to 8.3.0.6, and 8.4.x prior to 8.4.0.1 allows Command inje
- CVE-2019-15682RDesktop version 1.8.4 contains multiple out-of-bound access read vulnerabilities in its code, which results in a denial of service (DoS) coRDesktop
- CVE-2018-5742An oversight while backporting a feature leads to an assertion failure in buffer.c:420RedHat BIND9
- CVE-2019-7620Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin.Elastic Logstash
- CVE-2019-7619Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service.Elasticsearch · org.elasticsearch:elasticsearch