CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In September 2019

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-16403 2019-09-18 2019-09-18
0.0
None ??? ??? ??? ??? ??? ???
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers.
2 CVE-2019-16399 2019-09-18 2019-09-18
0.0
None ??? ??? ??? ??? ??? ???
Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without credentials. An attacker can easily enable SSH from /admin/system_advanced.php?lang=en and login with the default root password welc0me.
3 CVE-2019-16396 416 2019-09-17 2019-09-18
6.8
None Remote Medium Not required Partial Partial Partial
GnuCOBOL 2.2 has a use-after-free in the end_scope_of_program_name() function in cobc/parser.y via crafted COBOL source code.
4 CVE-2019-16395 120 Overflow 2019-09-17 2019-09-18
6.8
None Remote Medium Not required Partial Partial Partial
GnuCOBOL 2.2 has a stack-based buffer overflow in the cb_name() function in cobc/tree.c via crafted COBOL source code.
5 CVE-2019-16394 200 +Info 2019-09-17 2019-09-18
5.0
None Remote Low Not required Partial None None
SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers to enumerate subscribers.
6 CVE-2019-16393 601 2019-09-17 2019-09-18
5.8
None Remote Medium Not required Partial Partial None
SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character.
7 CVE-2019-16392 79 XSS 2019-09-17 2019-09-18
4.3
None Remote Medium Not required None Partial None
SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.
8 CVE-2019-16391 863 2019-09-17 2019-09-18
4.0
None Remote Low Single system None Partial None
SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiser_action.php.
9 CVE-2019-16378 290 Bypass 2019-09-17 2019-09-17
7.5
None Remote Low Not required Partial Partial Partial
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applications that consider a domain name to be relevant to the origin of an e-mail message.
10 CVE-2019-16371 522 Bypass 2019-09-16 2019-09-17
5.8
None Remote Medium Not required Partial Partial None
LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because do_popupregister can be bypassed via clickjacking.
11 CVE-2019-16370 2019-09-16 2019-09-16
0.0
None ??? ??? ??? ??? ??? ???
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.
12 CVE-2019-16366 120 Overflow 2019-09-16 2019-09-17
7.5
None Remote Low Not required Partial Partial Partial
In XS 9.0.0 in Moddable SDK OS180329, there is a heap-based buffer overflow in fxBeginHost in xsAPI.c when called from fxRunDefine in xsRun.c, as demonstrated by crafted JavaScript code to xst.
13 CVE-2019-16355 276 2019-09-16 2019-09-17
2.1
None Local Low Not required Partial None None
The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files.
14 CVE-2019-16354 362 2019-09-16 2019-09-17
1.9
None Local Medium Not required Partial None None
The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.
15 CVE-2019-16353 20 2019-09-16 2019-09-17
5.0
None Remote Low Not required None None Partial
Emerson GE Automation Proficy Machine Edition 8.0 allows an access violation and application crash via crafted traffic from a remote device, as demonstrated by an RX7i device.
16 CVE-2019-16352 119 Overflow 2019-09-16 2019-09-16
4.3
None Remote Medium Not required None None Partial
ffjpeg before 2019-08-21 has a heap-based buffer overflow in jfif_load() at jfif.c.
17 CVE-2019-16351 476 2019-09-16 2019-09-16
4.3
None Remote Medium Not required None None Partial
ffjpeg before 2019-08-18 has a NULL pointer dereference in huffman_decode_step() at huffman.c.
18 CVE-2019-16350 476 2019-09-16 2019-09-16
4.3
None Remote Medium Not required None None Partial
ffjpeg before 2019-08-18 has a NULL pointer dereference in idct2d8x8() at dct.c.
19 CVE-2019-16349 476 2019-09-16 2019-09-17
4.3
None Remote Medium Not required None None Partial
Bento4 1.5.1-628 has a NULL pointer dereference in AP4_ByteStream::ReadUI32 in Core/Ap4ByteStream.cpp when called from the AP4_TrunAtom class.
20 CVE-2019-16348 476 2019-09-16 2019-09-16
4.3
None Remote Medium Not required None None Partial
marc-q libwav through 2019-08-15 has a NULL pointer dereference in gain_file() at wav_gain.c.
21 CVE-2019-16347 119 Overflow 2019-09-16 2019-09-16
6.8
None Remote Medium Not required Partial Partial Partial
ngiflib 0.4 has a heap-based buffer overflow in WritePixels() in ngiflib.c when called from DecodeGifImg, because deinterlacing for small pictures is mishandled.
22 CVE-2019-16346 119 Overflow 2019-09-16 2019-09-16
6.8
None Remote Medium Not required Partial Partial Partial
ngiflib 0.4 has a heap-based buffer overflow in WritePixel() in ngiflib.c when called from DecodeGifImg, because deinterlacing for small pictures is mishandled.
23 CVE-2019-16335 20 2019-09-15 2019-09-18
7.5
None Remote Low Not required Partial Partial Partial
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
24 CVE-2019-16334 79 XSS 2019-09-15 2019-09-16
3.5
None Remote Medium Single system None Partial None
In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories -> Add New Category -> Name field. NOTE: this may overlap CVE-2017-16636.
25 CVE-2019-16333 79 XSS 2019-09-15 2019-09-16
4.3
None Remote Medium Not required None Partial None
GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php.
26 CVE-2019-16332 79 XSS 2019-09-15 2019-09-17
4.3
None Remote Medium Not required None Partial None
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.
27 CVE-2019-16321 79 XSS 2019-09-15 2019-09-18
4.3
None Remote Medium Not required None Partial None
ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATH_INFO.
28 CVE-2019-16320 200 +Info 2019-09-15 2019-09-18
5.0
None Remote Low Not required Partial None None
Cobham Sea Tel v170 224521 through v194 225444 devices allow attackers to obtain potentially sensitive information, such as a vessel's latitude and longitude, via the public SNMP community.
29 CVE-2019-16319 400 2019-09-15 2019-09-16
7.8
None Remote Low Not required None None Complete
In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite loop. This was addressed in plugins/epan/gryphon/packet-gryphon.c by checking for a message length of zero.
30 CVE-2019-16318 434 Bypass 2019-09-14 2019-09-17
6.5
None Remote Low Single system Partial Partial Partial
In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.
31 CVE-2019-16317 502 2019-09-14 2019-09-17
6.5
None Remote Low Single system Partial Partial Partial
In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different vulnerability than CVE-2019-10867 and CVE-2019-16318.
32 CVE-2019-16314 20 Exec Code 2019-09-14 2019-09-16
7.5
None Remote Low Not required Partial Partial Partial
Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2.
33 CVE-2019-16313 522 2019-09-14 2019-09-16
5.0
None Remote Low Not required Partial None None
ifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML source code.
34 CVE-2019-16312 79 XSS 2019-09-14 2019-09-16
4.3
None Remote Medium Not required None Partial None
s-cms V3.0 has XSS in index.php?type=text via the S_id parameter.
35 CVE-2019-16311 352 CSRF 2019-09-14 2019-09-16
6.8
None Remote Medium Not required Partial Partial Partial
NIUSHOP V1.11 has CSRF via search_info to index.php.
36 CVE-2019-16310 79 XSS 2019-09-14 2019-09-16
3.5
None Remote Medium Single system None Partial None
NIUSHOP V1.11 has XSS via the index.php?s=/admin URI.
37 CVE-2019-16309 89 Sql 2019-09-14 2019-09-16
7.5
None Remote Low Not required Partial Partial Partial
FlameCMS 3.3.5 has SQL injection in account/login.php via accountName.
38 CVE-2019-16307 79 XSS 2019-09-14 2019-09-18
4.3
None Remote Medium Not required None Partial None
A Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp and deleteWebExMeetingCheck.jsp in Fuji Xerox DocuShare through 7.0.0.C1.609 allows remote attackers to inject arbitrary web script or HTML via the handle parameter (webExMeetingLogin.jsp) and meetingKey parameter (deleteWebExMeetingCheck.jsp).
39 CVE-2019-16305 74 Exec Code 2019-09-14 2019-09-16
6.8
None Remote Medium Not required Partial Partial Partial
In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted link can trigger a popup asking whether the user wants to run MobaXterm to handle the link. If accepted, another popup appears asking for further confirmation. If this is also accepted, command execution is achieved, as demonstrated by the MobaXterm://`calc` URI.
40 CVE-2019-16303 338 2019-09-13 2019-09-16
7.5
None Remote Low Not required Partial Partial Partial
A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). This allows an attacker (if able to obtain their own password reset URL) to compute the value for all other password resets for other accounts, thus allowing privilege escalation or account takeover.
41 CVE-2019-16294 20 DoS Exec Code 2019-09-14 2019-09-16
6.8
None Remote Medium Not required Partial Partial Partial
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file.
42 CVE-2019-16293 78 Exec Code 2019-09-13 2019-09-13
6.5
None Remote Low Single system Partial Partial Partial
The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field.
43 CVE-2019-16289 79 XSS 2019-09-13 2019-09-16
3.5
None Remote Medium Single system None Partial None
The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.
44 CVE-2019-16288 20 2019-09-13 2019-09-16
7.8
None Remote Low Not required None None Complete
On Tenda N301 wireless routers, a long string in the wifiSSID parameter of a goform/setWifi POST request causes the device to crash.
45 CVE-2019-16277 119 Overflow 2019-09-13 2019-09-16
6.8
None Remote Medium Not required Partial Partial Partial
PicoC 2.1 has a heap-based buffer overflow in StringStrcpy in cstdlib/string.c when called from ExpressionParseFunctionCall in expression.c.
46 CVE-2019-16275 20 DoS 2019-09-12 2019-09-16
3.3
None Local Network Low Not required None None Partial
hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mishandled. This is a denial of service that should have been prevented by PMF (aka management frame protection). The attacker must send a crafted 802.11 frame from a location that is within the 802.11 communications range.
47 CVE-2019-16264 89 Sql 2019-09-16 2019-09-17
7.5
None Remote Low Not required Partial Partial Partial
In Escuela de Gestion Publica Plurinacional (EGPP) Sistema Integrado de Gestion Academica (GESAC) v1, the username parameter of the authentication form is vulnerable to SQL injection, allowing attackers to access the database.
48 CVE-2019-16261 287 2019-09-12 2019-09-13
8.5
None Remote Low Not required None Partial Complete
Tripp Lite PDUMH15AT 12.04.0053 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the manager or admin password, or shutting off power to an outlet. NOTE: the vendor's position is that a newer firmware version, fixing this vulnerability, had already been released before this vulnerability report about 12.04.0053.
49 CVE-2019-16257 269 Exec Code 2019-09-12 2019-09-16
7.5
None Remote Low Not required Partial Partial Partial
Some Motorola devices include the SIMalliance Toolbox Browser (aka [email protected] Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.
50 CVE-2019-16256 269 Exec Code 2019-09-12 2019-09-16
7.5
None Remote Low Not required Partial Partial Partial
Some Samsung devices include the SIMalliance Toolbox Browser (aka [email protected] Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.
Total number of vulnerabilities : 797   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.