# CVEs published 2019-11-08

26 CVEs were published on November 8, 2019: 0 critical, 4 high. Days are UTC.

- [CVE-2019-13531](https://cve.now/CVE-2019-13531.md): Medtronic Valleylab FT10 and LS10 Improper Authentication (CVSS 4.8, Medtronic Valleylab FT10 Energy Platform · Medtronic Valley…)
- [CVE-2019-13535](https://cve.now/CVE-2019-13535.md): Medtronic Valleylab FT10 and LS10 Protection Mechanism Failure (CVSS 4.6, Medtronic Valleylab FT10 Energy Platform · Medtronic Valley…)
- [CVE-2019-13539](https://cve.now/CVE-2019-13539.md): Medtronic Valleylab FT10 and FX8 Reversible One-way Hash (CVSS 7.0, Medtronic Valleylab Exchange Client · Medtronic Valleyla… +1)
- [CVE-2019-13543](https://cve.now/CVE-2019-13543.md): Medtronic Valleylab FT10 and FX8 Use of Hard-coded Credentials (CVSS 5.8, Medtronic Valleylab Exchange Client · Medtronic Valleyla… +1)
- [CVE-2019-3426](https://cve.now/CVE-2019-3426.md): The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by the input validation vulnerability. (no CVSS, ZTE ZXUPN-9000E)
- [CVE-2019-3425](https://cve.now/CVE-2019-3425.md): The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by vulnerability of permission and access contr (no CVSS, ZTE ZXUPN-9000E)
- [CVE-2019-12408](https://cve.now/CVE-2019-12408.md): It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had (no CVSS, Apache Software Foundation Apache Arrow · pyarrow +1)
- [CVE-2019-12410](https://cve.now/CVE-2019-12410.md): While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left (no CVSS, Apache Software Foundation Apache Arrow · pyarrow +1)
- [CVE-2019-17661](https://cve.now/CVE-2019-17661.md): A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control (CVSS 8.8)
- [CVE-2019-17327](https://cve.now/CVE-2019-17327.md): JEUS 7 Fix#0~5 and JEUS 8Fix#0~1 versions contains a directory traversal vulnerability caused by improper input parameter check when uploadi (no CVSS, TmaxSoft JEUS)
- [CVE-2019-18623](https://cve.now/CVE-2019-18623.md): Escalation of privileges in EnergyCAP 7 through 7.5.6 allows an attacker to access data. (no CVSS)
- [CVE-2019-13557](https://cve.now/CVE-2019-13557.md): In Tasy EMR, Tasy WebPortal Versions 3.02.1757 and prior, there is an information exposure vulnerability which may allow a remote attacker t (no CVSS, Tasy EMR)
- [CVE-2019-16209](https://cve.now/CVE-2019-16209.md): A vulnerability, in The ReportsTrustManager class of Brocade SANnav versions before v2.0, could allow an attacker to perform a man-in-the-mi (no CVSS, Brocade Communications Systems Brocade SANnav)
- [CVE-2019-16206](https://cve.now/CVE-2019-16206.md): The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’ and the 'debug' logg (no CVSS, Brocade Communications Systems Brocade SANnav)
- [CVE-2019-16205](https://cve.now/CVE-2019-16205.md): A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. (no CVSS, Brocade Communications Systems Brocade SANnav)
- [CVE-2019-16210](https://cve.now/CVE-2019-16210.md): Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save. (no CVSS, Brocade Communications Systems Brocade SANnav)
- [CVE-2019-16208](https://cve.now/CVE-2019-16208.md): Password-based encryption (PBE) algorithm, of Brocade SANnav versions before v2.0, has a weakness in generating cryptographic keys that may (no CVSS, Brocade Communications Systems Brocade SANnav)
- [CVE-2019-16207](https://cve.now/CVE-2019-16207.md): Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end database (no CVSS, Brocade Communications Systems Brocade SANnav)
- [CVE-2013-1889](https://cve.now/CVE-2013-1889.md): mod\_ruid2 before 0.9.8 improperly handles file descriptors which allows remote attackers to bypass security using a CGI script to break out (no CVSS, libapache2-mod-ruid2)
- [CVE-2019-10219](https://cve.now/CVE-2019-10219.md): A vulnerability was found in Hibernate-Validator. (CVSS 6.5, hibernate-validator · org.hibernate.validator:hibernate-… +1)
- [CVE-2019-3866](https://cve.now/CVE-2019-3866.md): An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were m (CVSS 5.9, \[UNKNOWN\] openstack-mistral)
- [CVE-2019-14860](https://cve.now/CVE-2019-14860.md): It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. (CVSS 7.4, \[UNKNOWN\] syndesis)
- [CVE-2019-14824](https://cve.now/CVE-2019-14824.md): A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. (CVSS 6.5, \[UNKNOWN\] 389-ds-base)
- [CVE-2019-10222](https://cve.now/CVE-2019-10222.md): A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. (CVSS 7.5, The Ceph Project ceph)
- [CVE-2013-1820](https://cve.now/CVE-2013-1820.md): tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service. (no CVSS, tuned)
- [CVE-2019-15005](https://cve.now/CVE-2019-15005.md): The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans an (no CVSS, Atlassian Bitbucket Server · Atlassian Jira Server +5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-11-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.