List of latest published vulnerabilities.

Exploit-DB

• [local] National Instruments Circuit Design Suite 14.0 - Local Privilege Escalation October 11, 2019
  National Instruments Circuit Design Suite 14.0 - Local Privilege Escalation
• [webapps] Intelbras Router WRN150 1.0.18 - Persistent Cross-Site Scripting October 11, 2019
  Intelbras Router WRN150 1.0.18 - Persistent Cross-Site Scripting
• [webapps] WordPress Arforms 3.7.1 - Directory Traversal October 11, 2019
  WordPress Arforms 3.7.1 - Directory Traversal
• [webapps] SMA Solar Technology AG Sunny WebBox device - 1.6 - Cross-Site Request Forgery October 10, 2019
  SMA Solar Technology AG Sunny WebBox device - 1.6 - Cross-Site Request Forgery
• [local] ASX to MP3 converter 3.1.3.7 - '.asx' Local Stack Overflow (Metasploit, DEP Bypass) October 10, 2019
  ASX to MP3 converter 3.1.3.7 - '.asx' Local Stack Overflow (Metasploit, DEP Bypass)
• [webapps] TP-Link TL-WR1043ND 2 - Authentication Bypass October 10, 2019
  TP-Link TL-WR1043ND 2 - Authentication Bypass
• [dos] Windows Kernel - win32k.sys TTF Font Processing Pool Corruption in win32k!ulClearTypeFilter October 10, 2019
  Windows Kernel - win32k.sys TTF Font Processing Pool Corruption in win32k!ulClearTypeFilter
• [dos] Windows Kernel - NULL Pointer Dereference in nt!MiOffsetToProtos While Parsing Malformed PE File October 10, 2019
  Windows Kernel - NULL Pointer Dereference in nt!MiOffsetToProtos While Parsing Malformed PE File
• [dos] Windows Kernel - Out-of-Bounds Read in CI!CipFixImageType While Parsing Malformed PE File October 10, 2019
  Windows Kernel - Out-of-Bounds Read in CI!CipFixImageType While Parsing Malformed PE File
• [dos] Windows Kernel - Out-of-Bounds Read in nt!MiParseImageLoadConfig While Parsing Malformed PE File October 10, 2019
  Windows Kernel - Out-of-Bounds Read in nt!MiParseImageLoadConfig While Parsing Malformed PE File

National Vulnerability Database

• CVE-2019-17593 October 14, 2019
  JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.
• CVE-2019-17594 October 14, 2019
  There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
• CVE-2019-17595 October 14, 2019
  There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.
• CVE-2019-14823 October 14, 2019
  A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.
• CVE-2019-17592 October 14, 2019
  The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The __isInt() function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option.
• CVE-2019-14737 October 14, 2019
  Ubisoft Uplay 92.0.0.6280 has Insecure Permissions.
• CVE-2019-16282 October 14, 2019
  In NCH Express Invoice v7.12, persistent cross site scripting (XSS) exists via the Invoices/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Items/Customers fields parameter to inject arbitrary JavaScript.
• CVE-2019-3767 October 14, 2019
  Dell ImageAssist versions prior to 8.7.15 contain an information disclosure vulnerability. Dell ImageAssist stores some sensitive encrypted information in the images it creates. A privileged user of a system running an operating system that was deployed with Dell ImageAssist could potentially retrieve this sensitive information to then compromise the system and related systems.
• CVE-2017-14948 October 14, 2019
  Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code (remote). The component is: htdocs/fileaccess.cgi. The attack vector is: A crafted HTTP request handled by fileacces.cgi could allow an attacker to mount a ROP attack: if the HTTP header field CONTENT_TYPE starts with […]
• CVE-2019-12941 October 14, 2019
  AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary attack to gain access to the WiFi network, which provides root access to the device. The default WiFi password and WiFi SSID are derived from the same hash function output (input is only 8 characters), which allows an […]