# CVEs published 2019-10-31

73 CVEs were published on October 31, 2019: 2 critical, 3 high. Days are UTC.

- [CVE-2019-16907](https://cve.now/CVE-2019-16907.md): An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13\_J8 for Jira. (no CVSS)
- [CVE-2019-16906](https://cve.now/CVE-2019-16906.md): An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13\_J8 for Jira. (no CVSS)
- [CVE-2019-16675](https://cve.now/CVE-2019-16675.md): An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Worx Express through 1.86, and Config+ through 1.86. (no CVSS)
- [CVE-2019-18226](https://cve.now/CVE-2019-18226.md): Honeywell equIP series and Performance series IP cameras and recorders, A vulnerability exists in the affected products where IP cameras and (no CVSS, Honeywell equIP series cameras, Honeywell Performance serie…)
- [CVE-2019-18230](https://cve.now/CVE-2019-18230.md): Honeywell equIP and Performance series IP cameras, multiple versions, A vulnerability exists where the affected product allows unauthenticat (no CVSS, Honeywell equIP & Performance series IP cameras)
- [CVE-2019-18228](https://cve.now/CVE-2019-18228.md): Honeywell equIP series IP cameras Multiple equIP Series Cameras, A vulnerability exists in the affected products where a specially crafted H (no CVSS, Honeywell equIP series IP cameras)
- [CVE-2019-18229](https://cve.now/CVE-2019-18229.md): Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. (no CVSS, Advantech WISE-PaaS/RMM)
- [CVE-2019-18227](https://cve.now/CVE-2019-18227.md): Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. (no CVSS, Advantech WISE-PaaS/RMM)
- [CVE-2019-16295](https://cve.now/CVE-2019-16295.md): Stored XSS in filemanager2.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.885 exists via the cmd\_arg parameter. (no CVSS)
- [CVE-2019-13547](https://cve.now/CVE-2019-13547.md): Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. (no CVSS, Advantech WISE-PaaS/RMM)
- [CVE-2010-2783](https://cve.now/CVE-2010-2783.md): IcedTea6 before 1.7.4 allow unsigned apps to read and write arbitrary files, related to Extended JNLP Services. (no CVSS, IcedTea6)
- [CVE-2010-2548](https://cve.now/CVE-2010-2548.md): IcedTea6 before 1.7.4 does not properly check property access, which allows unsigned apps to read and write arbitrary files. (no CVSS, IcedTea6)
- [CVE-2019-13508](https://cve.now/CVE-2019-13508.md): FreeTDS through 1.1.11 has a Buffer Overflow. (no CVSS)
- [CVE-2019-13551](https://cve.now/CVE-2019-13551.md): Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. (no CVSS, Advantech WISE-PaaS/RMM)
- [CVE-2012-6125](https://cve.now/CVE-2012-6125.md): Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions. (no CVSS, chicken)
- [CVE-2012-6124](https://cve.now/CVE-2012-6124.md): A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number generator to return a constant value. (no CVSS, chicken)
- [CVE-2012-6123](https://cve.now/CVE-2012-6123.md): Chicken before 4.8.0 does not properly handle NUL bytes in certain strings, which allows an attacker to conduct "poisoned NUL byte attack." (no CVSS, chicken)
- [CVE-2012-6122](https://cve.now/CVE-2012-6122.md): Buffer overflow in the thread scheduler in Chicken before 4.8.0.1 allows attackers to cause a denial of service (crash) by opening a file de (no CVSS, chicken)
- [CVE-2013-2075](https://cve.now/CVE-2013-2075.md): Multiple buffer overflows in the (1) R5RS char-ready, (2) tcp-accept-ready, and (3) file-select procedures in Chicken through 4.8.0.3 allows (no CVSS, chicken)
- [CVE-2018-4002](https://cve.now/CVE-2018-4002.md): An exploitable denial-of-service vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. (CVSS 5.3, CUJO)
- [CVE-2018-3983](https://cve.now/CVE-2018-3983.md): An exploitable uninitialized pointer vulnerability exists in the Word document parser of the the Atlantis Word Processor. (CVSS 8.8, Atlantis Word Processor)
- [CVE-2018-4031](https://cve.now/CVE-2018-4031.md): An exploitable vulnerability exists in the safe browsing function of the CUJO Smart Firewall, version 7003. (CVSS 9.0, CUJO)
- [CVE-2018-4064](https://cve.now/CVE-2018-4064.md): An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 F (no CVSS, Sierra Wireless)
- [CVE-2019-5023](https://cve.now/CVE-2019-5023.md): An exploitable vulnerability exists in the grsecurity PaX patch for the function read\_kmem, in PaX from version pax-linux-4.9.8-test1 to 4.9 (CVSS 5.9, PaX)
- [CVE-2019-5030](https://cve.now/CVE-2019-5030.md): A buffer overflow vulnerability exists in the PowerPoint document conversion function of Rainbow PDF Office Server Document Converter V7.0 P (CVSS 8.8, Antenna House)
- [CVE-2019-5010](https://cve.now/CVE-2019-5010.md): An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. (CVSS 5.9, Python)
- [CVE-2019-5043](https://cve.now/CVE-2019-5043.md): An exploitable denial-of-service vulnerability exists in the Weave daemon of the Nest Cam IQ Indoor, version 4620002. (CVSS 5.3, Nest Labs)
- [CVE-2013-2024](https://cve.now/CVE-2013-2024.md): OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0. (no CVSS, chicken)
- [CVE-2019-5049](https://cve.now/CVE-2019-5049.md): An exploitable memory corruption vulnerability exists in AMD ATIDXX64.DLL driver, versions 25.20.15031.5004 and 25.20.15031.9002. (no CVSS, AMD ATI)
- [CVE-2019-5095](https://cve.now/CVE-2019-5095.md): An issue summary information disclosure vulnerability exists in Atlassian Jira Tempo plugin, version 4.10.0. (no CVSS, Atlassian)
- [CVE-2013-2012](https://cve.now/CVE-2013-2012.md): autojump before 21.5.8 allows local users to gain privileges via a Trojan horse custom\_install directory in the current working directory. (no CVSS, autojump)
- [CVE-2019-5151](https://cve.now/CVE-2019-5151.md): An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. (CVSS 10.0, YouPHPTube)
- [CVE-2013-1951](https://cve.now/CVE-2013-1951.md): A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4 and allows remote attackers to inject arbitra (no CVSS, ikimedia Foundation MediaWiki)
- [CVE-2019-5150](https://cve.now/CVE-2019-5150.md): An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. (CVSS 8.9, YouPHPTube)
- [CVE-2019-15710](https://cve.now/CVE-2019-15710.md): An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized admini (no CVSS, Fortinet FortiExtender)
- [CVE-2013-1945](https://cve.now/CVE-2013-1945.md): ruby193 uses an insecure LD\_LIBRARY\_PATH setting. (no CVSS, ruby193)
- [CVE-2019-18396](https://cve.now/CVE-2019-18396.md): An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. (no CVSS)
- [CVE-2013-1934](https://cve.now/CVE-2013-1934.md): A cross-site scripting (XSS) vulnerability in the configuration report page (adm\_config\_report.php) in MantisBT 1.2.0rc1 before 1.2.14 allow (no CVSS, mantisBT)
- [CVE-2013-1932](https://cve.now/CVE-2013-1932.md): A cross-site scripting (XSS) vulnerability in the configuration report page (adm\_config\_report.php) in MantisBT 1.2.13 allows remote authent (no CVSS, mantisBT)
- [CVE-2013-1931](https://cve.now/CVE-2013-1931.md): A cross-site scripting (XSS) vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, (no CVSS, mantisBT)
- [CVE-2013-1930](https://cve.now/CVE-2013-1930.md): MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues. (no CVSS, mantisBT)
- [CVE-2019-18657](https://cve.now/CVE-2019-18657.md): ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function. (no CVSS)
- [CVE-2013-1910](https://cve.now/CVE-2013-1910.md): yum does not properly handle bad metadata, which allows an attacker to cause a denial of service and possibly have other unspecified impact (no CVSS, yum)
- [CVE-2019-14356](https://cve.now/CVE-2019-14356.md): On Coldcard MK1 and MK2 devices, a side channel for the row-based OLED display was found. (no CVSS)
- [CVE-2019-18656](https://cve.now/CVE-2019-18656.md): Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles c (no CVSS, pimcore/pimcore)
- [CVE-2019-18464](https://cve.now/CVE-2019-18464.md): In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3), multiple SQL Inje (no CVSS)
- [CVE-2019-18465](https://cve.now/CVE-2019-18465.md): In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without full credenti (no CVSS)
- [CVE-2019-16251](https://cve.now/CVE-2019-16251.md): plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. (no CVSS)
- [CVE-2019-12612](https://cve.now/CVE-2019-12612.md): An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitrary code to the BOX a (no CVSS)
- [CVE-2009-5042](https://cve.now/CVE-2009-5042.md): python-docutils allows insecure usage of temporary files (no CVSS, docutils)
- [CVE-2009-5041](https://cve.now/CVE-2009-5041.md): overkill has buffer overflow via long player names that can corrupt data on the server machine (no CVSS)
- [CVE-2009-5043](https://cve.now/CVE-2009-5043.md): burn allows file names to escape via mishandled quotation marks (no CVSS)
- [CVE-2019-3421](https://cve.now/CVE-2019-3421.md): The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection vulnerability. (no CVSS, ZTE ZX297520V3)
- [CVE-2019-18369](https://cve.now/CVE-2019-18369.md): In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible. (no CVSS)
- [CVE-2019-18368](https://cve.now/CVE-2019-18368.md): In JetBrains Toolbox App before 1.15.5666 for Windows, privilege escalation was possible. (no CVSS)
- [CVE-2010-2490](https://cve.now/CVE-2010-2490.md): Mumble: murmur-server has DoS due to malformed client query (no CVSS)
- [CVE-2019-3419](https://cve.now/CVE-2019-3419.md): A security vulnerability exists in a management port in the version of ZTE's ZXMP M721V3.10P01B10\_M2NCP. (no CVSS, ZTE ZXMP M721 DX)
- [CVE-2019-18367](https://cve.now/CVE-2019-18367.md): In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions. (no CVSS)
- [CVE-2019-18366](https://cve.now/CVE-2019-18366.md): In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission. (no CVSS)
- [CVE-2019-18365](https://cve.now/CVE-2019-18365.md): In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages. (no CVSS)
- [CVE-2019-18364](https://cve.now/CVE-2019-18364.md): In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution. (no CVSS)
- [CVE-2018-21030](https://cve.now/CVE-2018-21030.md): Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. (no CVSS, notebook)
- [CVE-2019-18363](https://cve.now/CVE-2019-18363.md): In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumsta (no CVSS)
- [CVE-2019-18362](https://cve.now/CVE-2019-18362.md): JetBrains MPS before 2019.2.2 exposed listening ports to the network. (no CVSS)
- [CVE-2019-18361](https://cve.now/CVE-2019-18361.md): JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code execution. (no CVSS)
- [CVE-2019-18360](https://cve.now/CVE-2019-18360.md): In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery. (no CVSS)
- [CVE-2019-18425](https://cve.now/CVE-2019-18425.md): An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using descript (no CVSS)
- [CVE-2019-18424](https://cve.now/CVE-2019-18424.md): An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain (no CVSS)
- [CVE-2019-18423](https://cve.now/CVE-2019-18423.md): An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM\_add\_to\_physmap hypercall (no CVSS)
- [CVE-2019-18422](https://cve.now/CVE-2019-18422.md): An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the (no CVSS)
- [CVE-2019-18421](https://cve.now/CVE-2019-18421.md): An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pag (no CVSS)
- [CVE-2019-18420](https://cve.now/CVE-2019-18420.md): An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP\_initialise hypercall. (no CVSS)
- [CVE-2019-17551](https://cve.now/CVE-2019-17551.md): In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a malicious payload t (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-10-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.