CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2019 (CVSS score >= 5)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-15841 352 CSRF 2019-08-30 2019-09-03
6.8
None Remote Medium Not required Partial Partial Partial
The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, or ajax_fb_toggle_visibility.
2 CVE-2019-15840 352 CSRF 2019-08-30 2019-09-03
6.8
None Remote Medium Not required Partial Partial Partial
The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF.
3 CVE-2019-15839 22 Dir. Trav. File Inclusion 2019-08-30 2020-08-24
5.0
None Remote Low Not required Partial None None
The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.
4 CVE-2019-15835 352 CSRF 2019-08-30 2019-09-04
6.8
None Remote Medium Not required Partial Partial Partial
The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF.
5 CVE-2019-15834 352 CSRF 2019-08-30 2019-09-04
6.8
None Remote Medium Not required Partial Partial Partial
The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.
6 CVE-2019-15832 352 CSRF 2019-08-30 2019-09-03
6.8
None Remote Medium Not required Partial Partial Partial
The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.
7 CVE-2019-15831 352 CSRF 2019-08-30 2019-09-03
6.8
None Remote Medium Not required Partial Partial Partial
The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.
8 CVE-2019-15828 352 CSRF 2019-08-30 2019-09-05
6.8
None Remote Medium Not required Partial Partial Partial
The one-click-ssl plugin before 1.4.7 for WordPress has CSRF.
9 CVE-2019-15826 Bypass 2019-08-30 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.
10 CVE-2019-15825 Bypass 2019-08-30 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.
11 CVE-2019-15824 Bypass 2019-08-30 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.
12 CVE-2019-15823 Bypass 2019-08-30 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.
13 CVE-2019-15822 22 Dir. Trav. 2019-08-30 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal.
14 CVE-2019-15821 2019-08-30 2020-08-24
5.0
None Remote Low Not required None Partial None
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
15 CVE-2019-15820 601 2019-08-30 2019-09-04
5.8
None Remote Medium Not required Partial Partial None
The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.
16 CVE-2019-15819 306 2019-08-30 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.
17 CVE-2019-15818 601 2019-08-30 2019-09-05
5.8
None Remote Medium Not required Partial Partial None
The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.
18 CVE-2019-15816 79 XSS 2019-08-30 2020-08-24
5.0
None Remote Low Not required None Partial None
The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.
19 CVE-2019-15806 326 Bypass 2019-08-29 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/basic_sett.html. Any user connected to the Wi-Fi can exploit this.
20 CVE-2019-15805 326 Bypass 2019-08-29 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/login.html. Any user connected to the Wi-Fi can exploit this.
21 CVE-2019-15788 190 Overflow 2019-08-29 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
Clara Genomics Analysis before 0.2.0 has an integer overflow for cudapoa memory management in allocate_block.cpp.
22 CVE-2019-15787 190 Overflow 2019-08-29 2019-09-04
7.8
None Remote Low Not required None None Complete
libZetta.rs through 0.1.2 has an integer overflow in the zpool parser (for error stats) that leads to a panic.
23 CVE-2019-15786 119 Overflow 2019-08-29 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
ROBOTIS Dynamixel SDK through 3.7.11 has a buffer overflow via a large rxpacket.
24 CVE-2019-15785 119 Overflow 2019-08-29 2020-01-13
7.5
None Remote Low Not required Partial Partial Partial
FontForge 20190813 through 20190820 has a buffer overflow in PrefsUI_LoadPrefs in prefs.c.
25 CVE-2019-15784 129 Overflow 2019-08-29 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
Secure Reliable Transport (SRT) through 1.3.4 has a CSndUList array overflow if there are many SRT connections.
26 CVE-2019-15783 119 Overflow 2019-08-29 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
Lute-Tab before 2019-08-23 has a buffer overflow in pdf_print.cc.
27 CVE-2019-15781 352 CSRF 2019-08-29 2019-08-30
6.8
None Remote Medium Not required Partial Partial Partial
The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.
28 CVE-2019-15780 502 2019-08-29 2021-10-14
7.5
None Remote Low Not required Partial Partial Partial
The formidable plugin before 4.02.01 for WordPress has unsafe deserialization.
29 CVE-2019-15779 352 2019-08-29 2019-09-03
6.8
None Remote Medium Not required Partial Partial Partial
The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete.
30 CVE-2019-15776 601 2019-08-29 2019-09-04
5.8
None Remote Medium Not required Partial Partial None
The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.
31 CVE-2019-15775 601 2019-08-29 2019-09-04
5.8
None Remote Medium Not required Partial Partial None
The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
32 CVE-2019-15774 601 2019-08-29 2019-09-04
5.8
None Remote Medium Not required Partial Partial None
The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
33 CVE-2019-15773 601 2019-08-29 2019-09-04
5.8
None Remote Medium Not required Partial Partial None
The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
34 CVE-2019-15772 601 2019-08-29 2019-09-04
5.8
None Remote Medium Not required Partial Partial None
The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
35 CVE-2019-15771 601 2019-08-29 2019-09-04
5.8
None Remote Medium Not required Partial Partial None
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
36 CVE-2019-15770 352 2019-08-29 2019-09-04
6.8
None Remote Medium Not required Partial Partial Partial
The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks.
37 CVE-2019-15769 352 CSRF 2019-08-29 2019-09-05
6.8
None Remote Medium Not required Partial Partial Partial
The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.
38 CVE-2019-15767 787 Overflow 2019-08-29 2020-08-24
6.8
None Remote Medium Not required Partial Partial Partial
In GNU Chess 6.2.5, there is a stack-based buffer overflow in the cmd_load function in frontend/cmd.cc via a crafted chess position in an EPD file.
39 CVE-2019-15753 770 2019-08-28 2020-08-24
6.4
None Remote Low Not required Partial None Partial
In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instances belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are affected. This occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py.
40 CVE-2019-15752 732 +Priv 2019-08-28 2020-08-31
9.3
None Remote Medium Not required Complete Complete Complete
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.
41 CVE-2019-15720 269 2019-08-28 2020-08-24
7.2
None Local Low Not required Complete Complete Complete
CloudBerry Backup v6.1.2.34 allows local privilege escalation via a Pre or Post backup action. With only user-level access, a user can modify the backup plan and add a Pre backup action script that executes on behalf of NT AUTHORITY\SYSTEM.
42 CVE-2019-15717 416 2019-08-29 2019-09-14
7.5
None Remote Low Not required Partial Partial Partial
Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP.
43 CVE-2019-15714 22 Dir. Trav. 2019-08-28 2019-09-04
5.0
None Remote Low Not required Partial None None
cli/lib/main.js in Entropic before 2019-06-13 does not reject / and \ in command names, which might allow a directory traversal attack in unusual situations.
44 CVE-2019-15702 835 2019-08-27 2020-02-18
5.0
None Remote Low Not required None None Partial
In the TCP implementation (gnrc_tcp) in RIOT through 2019.07, the parser for TCP options does not terminate on all inputs, allowing a denial-of-service, because sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c has an infinite loop for an unknown zero-length option.
45 CVE-2019-15701 78 Exec Code 2019-08-27 2019-08-30
6.8
None Remote Medium Not required Partial Partial Partial
components/Modals/HelpModal.jsx in BloodHound 2.2.0 allows remote attackers to execute arbitrary OS commands (by spawning a child process as the current user on the victim's machine) when the search function's autocomplete feature is used. The victim must import data from an Active Directory with a GPO containing JavaScript in its name.
46 CVE-2019-15660 352 CSRF 2019-08-27 2019-08-28
6.8
None Remote Medium Not required Partial Partial Partial
The wp-members plugin before 3.2.8 for WordPress has CSRF.
47 CVE-2019-15659 89 Sql 2019-08-27 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.
48 CVE-2019-15658 89 Sql 2019-08-26 2019-08-30
7.5
None Remote Low Not required Partial Partial Partial
connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data.
49 CVE-2019-15657 Exec Code 2019-08-26 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code.
50 CVE-2019-15651 125 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
wolfSSL 4.1.0 has a one-byte heap-based buffer over-read in DecodeCertExtensions in wolfcrypt/src/asn.c because reading the ASN_BOOLEAN byte is mishandled for a crafted DER certificate in GetLength_ex.
Total number of vulnerabilities : 1151   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.