CVEs published October 31, 2019
73 CVEs were published on October 31, 2019: 2 critical, 3 high.
- Published
- 73
- Critical
- 2
- High
- 3
- Medium
- 4
- Low
- 0
- Unrated
- 64
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- chicken
- 6
- Advantech WISE-PaaS/RMM
- 4
- mantisBT
- 4
- CUJO
- 2
- IcedTea6
- 2
- YouPHPTube
- 2
- AMD ATI
- 1
- Antenna House
- 1
- Atlantis Word Processor
- 1
- Atlassian
- 1
Critical 2
High 3
- CVE-2018-3983An exploitable uninitialized pointer vulnerability exists in the Word document parser of the the Atlantis Word Processor.Atlantis Word Processor
- CVE-2019-5030A buffer overflow vulnerability exists in the PowerPoint document conversion function of Rainbow PDF Office Server Document Converter V7.0 PAntenna House
- CVE-2019-5150An exploitable SQL injection vulnerability exist in YouPHPTube 7.7.YouPHPTube
Medium, low and unrated 68
- CVE-2019-16907An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira.
- CVE-2019-16906An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira.
- CVE-2019-16675An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86.
- CVE-2019-18226Honeywell equIP series and Performance series IP cameras and recorders, A vulnerability exists in the affected products where IP cameras andHoneywell equIP series cameras, Honeywell Performance serie…
- CVE-2019-18230Honeywell equIP and Performance series IP cameras, multiple versions, A vulnerability exists where the affected product allows unauthenticatHoneywell equIP & Performance series IP cameras
- CVE-2019-18228Honeywell equIP series IP cameras Multiple equIP Series Cameras, A vulnerability exists in the affected products where a specially crafted HHoneywell equIP series IP cameras
- CVE-2019-18229Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior.Advantech WISE-PaaS/RMM
- CVE-2019-18227Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior.Advantech WISE-PaaS/RMM
- CVE-2019-16295Stored XSS in filemanager2.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.885 exists via the cmd_arg parameter.
- CVE-2019-13547Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior.Advantech WISE-PaaS/RMM
- CVE-2010-2783IcedTea6 before 1.7.4 allow unsigned apps to read and write arbitrary files, related to Extended JNLP Services.IcedTea6
- CVE-2010-2548IcedTea6 before 1.7.4 does not properly check property access, which allows unsigned apps to read and write arbitrary files.IcedTea6
- CVE-2019-13508FreeTDS through 1.1.11 has a Buffer Overflow.
- CVE-2019-13551Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior.Advantech WISE-PaaS/RMM
- CVE-2012-6125Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions.chicken
- CVE-2012-6124A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number generator to return a constant value.chicken
- CVE-2012-6123Chicken before 4.8.0 does not properly handle NUL bytes in certain strings, which allows an attacker to conduct "poisoned NUL byte attack."chicken
- CVE-2012-6122Buffer overflow in the thread scheduler in Chicken before 4.8.0.1 allows attackers to cause a denial of service (crash) by opening a file dechicken
- CVE-2013-2075Multiple buffer overflows in the (1) R5RS char-ready, (2) tcp-accept-ready, and (3) file-select procedures in Chicken through 4.8.0.3 allowschicken
- CVE-2018-4002An exploitable denial-of-service vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003.CUJO
- CVE-2018-4064An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FSierra Wireless
- CVE-2019-5023An exploitable vulnerability exists in the grsecurity PaX patch for the function read_kmem, in PaX from version pax-linux-4.9.8-test1 to 4.9PaX
- CVE-2019-5010An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6.Python
- CVE-2019-5043An exploitable denial-of-service vulnerability exists in the Weave daemon of the Nest Cam IQ Indoor, version 4620002.Nest Labs
- CVE-2013-2024OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0.chicken
- CVE-2019-5049An exploitable memory corruption vulnerability exists in AMD ATIDXX64.DLL driver, versions 25.20.15031.5004 and 25.20.15031.9002.AMD ATI
- CVE-2019-5095An issue summary information disclosure vulnerability exists in Atlassian Jira Tempo plugin, version 4.10.0.Atlassian
- CVE-2013-2012autojump before 21.5.8 allows local users to gain privileges via a Trojan horse custom_install directory in the current working directory.autojump
- CVE-2013-1951A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4 and allows remote attackers to inject arbitraikimedia Foundation MediaWiki
- CVE-2019-15710An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized adminiFortinet FortiExtender
- CVE-2013-1945ruby193 uses an insecure LD_LIBRARY_PATH setting.ruby193
- CVE-2019-18396An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices.
- CVE-2013-1934A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.0rc1 before 1.2.14 allowmantisBT
- CVE-2013-1932A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.13 allows remote authentmantisBT
- CVE-2013-1931A cross-site scripting (XSS) vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, mantisBT
- CVE-2013-1930MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues.mantisBT
- CVE-2019-18657ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function.
- CVE-2013-1910yum does not properly handle bad metadata, which allows an attacker to cause a denial of service and possibly have other unspecified impact yum
- CVE-2019-14356On Coldcard MK1 and MK2 devices, a side channel for the row-based OLED display was found.
- CVE-2019-18656Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles cpimcore/pimcore
- CVE-2019-18464In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3), multiple SQL Inje
- CVE-2019-18465In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without full credenti
- CVE-2019-16251plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.
- CVE-2019-12612An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitrary code to the BOX a
- CVE-2009-5042python-docutils allows insecure usage of temporary filesdocutils
- CVE-2009-5041overkill has buffer overflow via long player names that can corrupt data on the server machine
- CVE-2009-5043burn allows file names to escape via mishandled quotation marks
- CVE-2019-3421The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection vulnerability.ZTE ZX297520V3
- CVE-2019-18369In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible.
- CVE-2019-18368In JetBrains Toolbox App before 1.15.5666 for Windows, privilege escalation was possible.
- CVE-2010-2490Mumble: murmur-server has DoS due to malformed client query
- CVE-2019-3419A security vulnerability exists in a management port in the version of ZTE's ZXMP M721V3.10P01B10_M2NCP.ZTE ZXMP M721 DX
- CVE-2019-18367In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions.
- CVE-2019-18366In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission.
- CVE-2019-18365In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.
- CVE-2019-18364In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution.
- CVE-2018-21030Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin.notebook
- CVE-2019-18363In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumsta
- CVE-2019-18362JetBrains MPS before 2019.2.2 exposed listening ports to the network.
- CVE-2019-18361JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code execution.
- CVE-2019-18360In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery.
- CVE-2019-18425An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using descript
- CVE-2019-18424An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain
- CVE-2019-18423An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add_to_physmap hypercall
- CVE-2019-18422An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the
- CVE-2019-18421An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pag
- CVE-2019-18420An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall.
- CVE-2019-17551In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload t