# CVEs published 2019-11-06

112 CVEs were published on November 6, 2019: 2 critical, 4 high. Days are UTC.

- [CVE-2019-16401](https://cve.now/CVE-2019-16401.md): Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955U (no CVSS)
- [CVE-2019-16400](https://cve.now/CVE-2019-16400.md): Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955U (no CVSS)
- [CVE-2019-18411](https://cve.now/CVE-2019-18411.md): Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. (no CVSS)
- [CVE-2014-9013](https://cve.now/CVE-2014-9013.md): The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to c (no CVSS)
- [CVE-2014-9014](https://cve.now/CVE-2014-9014.md): Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for Word (no CVSS)
- [CVE-2019-12419](https://cve.now/CVE-2019-12419.md): Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. (no CVSS, Apache CXF · org.apache.cxf:cxf)
- [CVE-2011-2808](https://cve.now/CVE-2011-2808.md): A stale layout root is set as an input element in WebKit in Google Chrome before Blink M13 when a child of a keygen with autofocus is access (no CVSS, Google Chrome)
- [CVE-2019-12406](https://cve.now/CVE-2019-12406.md): Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. (no CVSS, Apache CXF · org.apache.cxf:cxf +1)
- [CVE-2009-5046](https://cve.now/CVE-2009-5046.md): JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22. (no CVSS)
- [CVE-2009-5045](https://cve.now/CVE-2009-5045.md): Dump Servlet information leak in jetty before 6.1.22. (no CVSS)
- [CVE-2019-5100](https://cve.now/CVE-2019-5100.md): An exploitable integer overflow vulnerability exists in the BMP header parsing functionality of LEADTOOLS 20. (CVSS 8.8, LEADTOOLS)
- [CVE-2019-5125](https://cve.now/CVE-2019-5125.md): An exploitable heap overflow vulnerability exists in the JPEG2000 parsing functionality of LEADTOOLS 20. (CVSS 8.8, LEADTOOLS)
- [CVE-2019-5099](https://cve.now/CVE-2019-5099.md): An exploitable integer underflow vulnerability exists in the CMP-parsing functionality of LEADTOOLS 20. (CVSS 8.8, LEADTOOLS)
- [CVE-2019-5084](https://cve.now/CVE-2019-5084.md): An exploitable heap out-of-bounds write vulnerability exists in the TIF-parsing functionality of LEADTOOLS 20. (CVSS 8.8, LEADTOOLS)
- [CVE-2014-3180](https://cve.now/CVE-2014-3180.md): In kernel/compat.c in the Linux kernel before 3.17, as used in Google Chrome OS and other products, there is a possible out-of-bounds read. (no CVSS, Linux kernel)
- [CVE-2018-20853](https://cve.now/CVE-2018-20853.md): An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) plugin before 2.8.2 for WordPress. (no CVSS)
- [CVE-2009-5050](https://cve.now/CVE-2009-5050.md): konversation before 1.2.3 allows attackers to cause a denial of service. (no CVSS)
- [CVE-2011-1298](https://cve.now/CVE-2011-1298.md): An Integer Overflow exists in WebKit in Google Chrome before Blink M11 in the macOS WebCore::GraphicsContext::fillRect function. (no CVSS)
- [CVE-2009-5049](https://cve.now/CVE-2009-5049.md): WebApp JSP Snoop page XSS in jetty though 6.1.21. (no CVSS)
- [CVE-2009-5048](https://cve.now/CVE-2009-5048.md): Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20. (no CVSS)
- [CVE-2019-5644](https://cve.now/CVE-2019-5644.md): C4G BLIS Improper Access Control (CVSS 10.0, Computing For Good Basic Laboratory Information System)
- [CVE-2019-5643](https://cve.now/CVE-2019-5643.md): C4G BLIS Improper Access Control (CVSS 5.3, Computing For Good Basic Laboratory Information System)
- [CVE-2019-5642](https://cve.now/CVE-2019-5642.md): MAGICK (CVSS 3.3, Rapid7 Metasploit Pro)
- [CVE-2019-5617](https://cve.now/CVE-2019-5617.md): C4G BLIS Improper Access Control (CVSS 10.0, Computing For Good Basic Laboratory Information System)
- [CVE-2016-1000037](https://cve.now/CVE-2016-1000037.md): Pagure: XSS possible in file attachment endpoint (no CVSS)
- [CVE-2010-4178](https://cve.now/CVE-2010-4178.md): MySQL-GUI-tools (mysql-administrator) leaks passwords into process list after with launch of mysql text console (no CVSS, MySQL-GUI-tools)
- [CVE-2019-6122](https://cve.now/CVE-2019-6122.md): A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error messa (no CVSS)
- [CVE-2019-6121](https://cve.now/CVE-2019-6121.md): An issue was discovered in NiceHash Miner before 2.0.3.0. (no CVSS)
- [CVE-2019-6120](https://cve.now/CVE-2019-6120.md): An issue was discovered in NiceHash Miner before 2.0.3.0. (no CVSS)
- [CVE-2019-2332](https://cve.now/CVE-2019-2332.md): Memory corruption while accessing the memory as payload size is not validated before access in Snapdragon Auto, Snapdragon Compute, Snapdrag (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2325](https://cve.now/CVE-2019-2325.md): Out of boundary access due to token received from ADSP and is used without validation as an index into the array in Snapdragon Auto, Snapdra (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2331](https://cve.now/CVE-2019-2331.md): Possible Integer overflow because of subtracting two integers without checking if the result would overflow or not in Snapdragon Auto, Snapd (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2323](https://cve.now/CVE-2019-2323.md): Lack of check to ensure crypto engine data passed by user is initialized can result in bus error in Snapdragon Auto, Snapdragon Compute, Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2324](https://cve.now/CVE-2019-2324.md): When ADSP is compromised, the audio port index that\`s returned from ADSP might be out of the valid range and leads to out of boundary access (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2019-2285](https://cve.now/CVE-2019-2285.md): Out of bound write issue is observed while giving information about properties that have been set so far for playing video in Snapdragon Aut (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2302](https://cve.now/CVE-2019-2302.md): While processing vendor command which contains corrupted channel count, an integer overflow occurs and finally will lead to heap overflow. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-2275](https://cve.now/CVE-2019-2275.md): While deserializing any key blob during key operations, buffer overflow could occur exposing partial key information if any key operations a (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2283](https://cve.now/CVE-2019-2283.md): Improper validation of read and write index of tx and rx fifo\`s before calculating pointer can lead to out-of-bound access in Snapdragon Aut (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2249](https://cve.now/CVE-2019-2249.md): Kernel can do a memory read from arbitrary address passed by user during execution of a syscall in Snapdragon Auto, Snapdragon Compute, Snap (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2258](https://cve.now/CVE-2019-2258.md): Improper validation of array index causes OOB write and then leads to memory corruption in MMCP in Snapdragon Auto, Snapdragon Compute, Snap (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10542](https://cve.now/CVE-2019-10542.md): Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn\`t match the contents in Sn (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-10565](https://cve.now/CVE-2019-10565.md): Double free issue can happen when sensor power settings is freed by some thread while another thread try to access. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2246](https://cve.now/CVE-2019-2246.md): Thread start can cause invalid memory writes to arbitrary memory location since the argument is passed by user to kernel in Snapdragon Auto, (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10534](https://cve.now/CVE-2019-10534.md): Null-pointer dereference can occur while accessing the super index entry when it is not been allocated in Snapdragon Auto, Snapdragon Comput (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10541](https://cve.now/CVE-2019-10541.md): Dereference on uninitialized buffer can happen when parsing FLV clip with corrupted codec specific data in Snapdragon Auto, Snapdragon Compu (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10531](https://cve.now/CVE-2019-10531.md): Incorrect reading of system image resulting in buffer overflow when size of system image is increased in Snapdragon Auto, Snapdragon Mobile, (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Mobile, Snapdragon Wea…)
- [CVE-2019-10533](https://cve.now/CVE-2019-10533.md): Out of bound access due to improper validation of array index cause the index table entry to get corrupt in Snapdragon Auto, Snapdragon Comp (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10528](https://cve.now/CVE-2019-10528.md): Use after free issue in kernel while accessing freed mdlog session info and its attributes after closing the session in Snapdragon Auto, Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2019-10529](https://cve.now/CVE-2019-10529.md): Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function set\_page\_dirty() in Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10522](https://cve.now/CVE-2019-10522.md): While playing the clip which is nonstandard buffer overflow can occur while parsing in Snapdragon Auto, Snapdragon Compute, Snapdragon Consu (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10524](https://cve.now/CVE-2019-10524.md): Lack of check for a negative value returned for get\_clk is wrongly interpreted as valid pointer and lead to use after free in clk driver in (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-10505](https://cve.now/CVE-2019-10505.md): Out of bound access while processing a non-standard IE measurement request with length crossing past the size of frame in Snapdragon Auto, S (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-10512](https://cve.now/CVE-2019-10512.md): Payload size is not checked before using it as array index in audio in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdra (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10515](https://cve.now/CVE-2019-10515.md): DCI client which might be preemptively freed up might be accessed for transferring packets leading to kernel error in Snapdragon Auto, Snapd (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-10502](https://cve.now/CVE-2019-10502.md): Possible stack overflow when an index equal to io buffer size is accessed in camera module in Snapdragon Compute, Snapdragon Consumer IOT, S (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…)
- [CVE-2019-10504](https://cve.now/CVE-2019-10504.md): Firmware not able to send EXT scan response to host within 1 sec due to resource consumption issue in Snapdragon Auto, Snapdragon Consumer I (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-10495](https://cve.now/CVE-2019-10495.md): Arbitrary buffer write issue while processing sequence header during HEVC or AVC encoding. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10496](https://cve.now/CVE-2019-10496.md): Lack of checking a variable received from driver and populating in Firmware data structure leads to buffer overflow in Snapdragon Auto, Snap (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10488](https://cve.now/CVE-2019-10488.md): Null pointer dereference can occur while parsing invalid chunks while playing the nonstandard clip in Snapdragon Auto, Snapdragon Compute, S (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10491](https://cve.now/CVE-2019-10491.md): ADSP can be compromised since it\`s a general-purpose CPU processing untrusted data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consum (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2010-2471](https://cve.now/CVE-2010-2471.md): Drupal versions 5.x and 6.x has open redirection (no CVSS, drupal6)
- [CVE-2011-4904](https://cve.now/CVE-2011-4904.md): TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve (no CVSS, TYPO3 · typo3/cms)
- [CVE-2011-4903](https://cve.now/CVE-2011-4903.md): Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary we (no CVSS, TYPO3 · typo3/cms)
- [CVE-2010-2247](https://cve.now/CVE-2010-2247.md): makepasswd 1.10 default settings generate insecure passwords (no CVSS, makepasswd)
- [CVE-2011-4902](https://cve.now/CVE-2011-4902.md): TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver. (no CVSS, TYPO3 · typo3/cms)
- [CVE-2011-4901](https://cve.now/CVE-2011-4901.md): TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 data (no CVSS, TYPO3 · typo3/cms)
- [CVE-2011-4900](https://cve.now/CVE-2011-4900.md): TYPO3 before 4.5.4 allows Information Disclosure in the backend. (no CVSS, TYPO3 · typo3/cms)
- [CVE-2011-4632](https://cve.now/CVE-2011-4632.md): Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary we (no CVSS, TYPO3 · typo3/cms)
- [CVE-2011-4631](https://cve.now/CVE-2011-4631.md): Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary we (no CVSS, TYPO3)
- [CVE-2011-4630](https://cve.now/CVE-2011-4630.md): Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary we (no CVSS, TYPO3 · typo3/cms)
- [CVE-2011-4629](https://cve.now/CVE-2011-4629.md): Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary we (no CVSS, TYPO3)
- [CVE-2011-4628](https://cve.now/CVE-2011-4628.md): TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend t (no CVSS, TYPO3 · typo3/cms)
- [CVE-2010-2446](https://cve.now/CVE-2010-2446.md): Rbot Reaction plugin allows command execution (no CVSS)
- [CVE-2011-4627](https://cve.now/CVE-2011-4627.md): TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend. (no CVSS, TYPO3 · typo3/cms)
- [CVE-2011-4626](https://cve.now/CVE-2011-4626.md): Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary we (no CVSS, TYPO3)
- [CVE-2019-18800](https://cve.now/CVE-2019-18800.md): Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Vi (no CVSS)
- [CVE-2017-18639](https://cve.now/CVE-2017-18639.md): Progress Sitefinity CMS before 10.1 allows XSS via /Pages Parameter : Page Title, /Content/News Parameter : News Title, /Content/List Parame (no CVSS)
- [CVE-2019-18797](https://cve.now/CVE-2019-18797.md): LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operator()(Sass::Binary\_Expression\*) in eval.cpp. (no CVSS)
- [CVE-2019-18798](https://cve.now/CVE-2019-18798.md): LibSass before 3.6.3 allows a heap-based buffer over-read in Sass::weaveParents in ast\_sel\_weave.cpp. (no CVSS)
- [CVE-2019-18799](https://cve.now/CVE-2019-18799.md): LibSass before 3.6.3 allows a NULL pointer dereference in Sass::Parser::parseCompoundSelector in parser\_selectors.cpp. (no CVSS)
- [CVE-2015-7276](https://cve.now/CVE-2015-7276.md): Technicolor C2000T and C2100T uses hard-coded cryptographic keys. (no CVSS, Technicolor C2000T · Technicolor C2100T)
- [CVE-2019-13081](https://cve.now/CVE-2019-13081.md): Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the title field in the /common/ticket\_associated (no CVSS)
- [CVE-2019-13080](https://cve.now/CVE-2019-13080.md): Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via an SVG image and HTML file) that allows an authe (no CVSS)
- [CVE-2011-4625](https://cve.now/CVE-2011-4625.md): simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt (no CVSS, simplesamlphp · simplesamlphp/simplesamlphp)
- [CVE-2019-13079](https://cve.now/CVE-2019-13079.md): Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. (no CVSS)
- [CVE-2019-13078](https://cve.now/CVE-2019-13078.md): Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. (no CVSS)
- [CVE-2019-13077](https://cve.now/CVE-2019-13077.md): Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the sam\_detail\_titled.php SAM\_TYPE parameter) th (no CVSS)
- [CVE-2019-13076](https://cve.now/CVE-2019-13076.md): Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. (no CVSS)
- [CVE-2014-8181](https://cve.now/CVE-2014-8181.md): The kernel in Red Hat Enterprise Linux 7 and MRG-2 does not clear garbage data for SG\_IO buffer, which may leaking sensitive information to (no CVSS, Red Hat Enterprise Linux)
- [CVE-2019-12918](https://cve.now/CVE-2019-12918.md): Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. (no CVSS)
- [CVE-2019-12917](https://cve.now/CVE-2019-12917.md): A reflected XSS vulnerability exists in Quest KACE Systems Management Appliance Server Center 9.1.317 affecting the userui/software\_library. (no CVSS)
- [CVE-2016-4401](https://cve.now/CVE-2016-4401.md): Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain database credentials. (no CVSS)
- [CVE-2007-0899](https://cve.now/CVE-2007-0899.md): There is a possible heap overflow in libclamav/fsg.c before 0.100.0. (no CVSS)
- [CVE-2006-4245](https://cve.now/CVE-2006-4245.md): archivemail 0.6.2 uses temporary files insecurely leading to a possible race condition. (no CVSS, archivemail)
- [CVE-2006-4243](https://cve.now/CVE-2006-4243.md): linux vserver 2.6 before 2.6.17 suffers from privilege escalation in remount code. (no CVSS, linux-2.6)
- [CVE-2006-3100](https://cve.now/CVE-2006-3100.md): termpkg 3.3 suffers from buffer overflow. (no CVSS)
- [CVE-2019-18786](https://cve.now/CVE-2019-18786.md): In the Linux kernel through 5.3.8, f-\>fmt.sdr.reserved is uninitialized in rcar\_drif\_g\_fmt\_sdr\_cap in drivers/media/platform/rcar\_drif.c, wh (no CVSS)
- [CVE-2019-18784](https://cve.now/CVE-2019-18784.md): SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection. (no CVSS)
- [CVE-2006-0062](https://cve.now/CVE-2006-0062.md): xlockmore 5.13 allows potential xlock bypass when FVWM switches to the same virtual desktop as a new Gaim window. (no CVSS)
- [CVE-2006-0061](https://cve.now/CVE-2006-0061.md): xlockmore 5.13 and 5.22 segfaults when using libpam-opensc and returns the underlying xsession. (no CVSS)
- [CVE-2019-18650](https://cve.now/CVE-2019-18650.md): An issue was discovered in Joomla! before 3.9.13. (no CVSS)
- [CVE-2019-18674](https://cve.now/CVE-2019-18674.md): An issue was discovered in Joomla! before 3.9.13. (no CVSS)
- [CVE-2019-8132](https://cve.now/CVE-2019-8132.md): A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. (no CVSS, Adobe Systems Incorporated Magento · magento/community-edit…)
- [CVE-2019-8145](https://cve.now/CVE-2019-8145.md): A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. (no CVSS, Adobe Systems Incorporated Magento · magento/community-edit…)
- [CVE-2019-8158](https://cve.now/CVE-2019-8158.md): An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. (no CVSS, Adobe Systems Incorporated Magento · magento/community-edit…)
- [CVE-2019-8157](https://cve.now/CVE-2019-8157.md): A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. (no CVSS, Adobe Systems Incorporated Magento · magento/community-edit…)
- [CVE-2019-8156](https://cve.now/CVE-2019-8156.md): A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. (no CVSS, Adobe Systems Incorporated Magento · magento/community-edit…)
- [CVE-2019-8159](https://cve.now/CVE-2019-8159.md): A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. (no CVSS, Adobe Systems Incorporated Magento · magento/community-edit…)
- [CVE-2019-8227](https://cve.now/CVE-2019-8227.md): In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary (no CVSS, Adobe Systems Incorporated Magento · magento/core)
- [CVE-2019-10218](https://cve.now/CVE-2019-10218.md): A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a path (CVSS 5.3, samba)
- [CVE-2019-14833](https://cve.now/CVE-2019-14833.md): A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user (CVSS 4.2, samba)
- [CVE-2019-14847](https://cve.now/CVE-2019-14847.md): A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. (CVSS 4.9, samba)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-11-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.