# CVEs published 2019-10-30

34 CVEs were published on October 30, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2019-18644](https://cve.now/CVE-2019-18644.md): The malware scan function in Total Defense Anti-virus 11.5.2.28 is vulnerable to a TOCTOU bug; consequently, symbolic link attacks allow pri (no CVSS)
- [CVE-2019-18645](https://cve.now/CVE-2019-18645.md): The quarantine restoration function in Total Defense Anti-virus 11.5.2.28 is vulnerable to symbolic link attacks, allowing files to be writt (no CVSS)
- [CVE-2010-1673](https://cve.now/CVE-2010-1673.md): A cross-site scripting (XSS) vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web script or HTML via a (no CVSS)
- [CVE-2010-0749](https://cve.now/CVE-2010-0749.md): Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame. (no CVSS, transmission)
- [CVE-2010-0748](https://cve.now/CVE-2010-0748.md): Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified impact via a large numbe (no CVSS, transmission)
- [CVE-2010-0747](https://cve.now/CVE-2010-0747.md): drbd8 allows local users to bypass intended restrictions for certain actions via netlink packets, similar to CVE-2009-3725. (no CVSS, drbd8)
- [CVE-2010-0737](https://cve.now/CVE-2010-0737.md): A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permissions, which allows J (no CVSS, Red Hat JBoss)
- [CVE-2019-18635](https://cve.now/CVE-2019-18635.md): An issue was discovered in Mooltipass Moolticute through v0.42.1 and v0.42.x-testing through v0.42.5-testing. (no CVSS)
- [CVE-2018-21029](https://cve.now/CVE-2018-21029.md): systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. (no CVSS)
- [CVE-2019-18633](https://cve.now/CVE-2019-18633.md): European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain ExplicitKeyTrustEvaluat (no CVSS)
- [CVE-2019-18632](https://cve.now/CVE-2019-18632.md): European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a manipulated SAML re (no CVSS)
- [CVE-2019-10762](https://cve.now/CVE-2019-10762.md): columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping. (no CVSS, medoo · catfan/medoo)
- [CVE-2010-0398](https://cve.now/CVE-2010-0398.md): The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack. (no CVSS)
- [CVE-2019-12417](https://cve.now/CVE-2019-12417.md): A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page view (no CVSS, Apache Airflow · airflow +1)
- [CVE-2019-17326](https://cve.now/CVE-2019-17326.md): ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to arbitrary file deletion by issuing a HTTP GET request with a specia (no CVSS, ClipSoft REXPERT)
- [CVE-2019-17325](https://cve.now/CVE-2019-17325.md): ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to upload arbitrary local file via the ActiveX method in RexViewerCtrl (no CVSS, ClipSoft REXPERT)
- [CVE-2019-17324](https://cve.now/CVE-2019-17324.md): ClipSoft REXPERT 1.0.0.527 and earlier version allows directory traversal by issuing a special HTTP POST request with ../ characters. (no CVSS, ClipSoft REXPERT)
- [CVE-2019-17323](https://cve.now/CVE-2019-17323.md): ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation and execution via report print function of rexpert viewer with (no CVSS, ClipSoft REXPERT)
- [CVE-2010-0207](https://cve.now/CVE-2010-0207.md): In xpdf, the xref table contains an infinite loop which allows remote attackers to cause a denial of service (application crash) in xpdf-bas (no CVSS, poppler)
- [CVE-2019-17322](https://cve.now/CVE-2019-17322.md): ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set to the file path to (no CVSS, ClipSoft REXPERT)
- [CVE-2019-17321](https://cve.now/CVE-2019-17321.md): ClipSoft REXPERT 1.0.0.527 and earlier version have an information disclosure issue. (no CVSS, ClipSoft REXPERT)
- [CVE-2013-1391](https://cve.now/CVE-2013-1391.md): Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR sys (no CVSS)
- [CVE-2010-0206](https://cve.now/CVE-2010-0206.md): xpdf allows remote attackers to cause a denial of service (NULL pointer dereference and crash) in the way it processes JBIG2 PDF stream obje (no CVSS, xpdf)
- [CVE-2019-18207](https://cve.now/CVE-2019-18207.md): In Zucchetti InfoBusiness before and including 4.4.1, an authenticated user can inject client-side code due to improper validation of the Ti (no CVSS)
- [CVE-2019-18206](https://cve.now/CVE-2019-18206.md): A cross-site request forgery (CSRF) vulnerability in Zucchetti InfoBusiness before and including 4.4.1 allows arbitrary file upload. (no CVSS)
- [CVE-2019-18205](https://cve.now/CVE-2019-18205.md): Multiple Reflected Cross-site Scripting (XSS) vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1. (no CVSS)
- [CVE-2019-18204](https://cve.now/CVE-2019-18204.md): Zucchetti InfoBusiness before and including 4.4.1 allows any authenticated user to upload .php files in order to achieve code execution. (no CVSS)
- [CVE-2018-18678](https://cve.now/CVE-2018-18678.md): GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board group extra contents" pa (no CVSS)
- [CVE-2018-16417](https://cve.now/CVE-2018-16417.md): Aruba Instant 4.x prior to 6.4.4.8-4.2.4.12, 6.5.x prior to 6.5.4.11, 8.3.x prior to 8.3.0.6, and 8.4.x prior to 8.4.0.1 allows Command inje (no CVSS)
- [CVE-2019-15682](https://cve.now/CVE-2019-15682.md): RDesktop version 1.8.4 contains multiple out-of-bound access read vulnerabilities in its code, which results in a denial of service (DoS) co (no CVSS, RDesktop)
- [CVE-2018-5742](https://cve.now/CVE-2018-5742.md): An oversight while backporting a feature leads to an assertion failure in buffer.c:420 (CVSS 5.9, RedHat BIND9)
- [CVE-2018-5735](https://cve.now/CVE-2018-5735.md): Backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858 (CVSS 7.5, Debian BIND9)
- [CVE-2019-7620](https://cve.now/CVE-2019-7620.md): Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. (no CVSS, Elastic Logstash)
- [CVE-2019-7619](https://cve.now/CVE-2019-7619.md): Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.