CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2019 (CVSS score >= 7)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-15826 Bypass 2019-08-30 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.
2 CVE-2019-15825 Bypass 2019-08-30 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.
3 CVE-2019-15824 Bypass 2019-08-30 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.
4 CVE-2019-15823 Bypass 2019-08-30 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.
5 CVE-2019-15822 22 Dir. Trav. 2019-08-30 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal.
6 CVE-2019-15819 306 2019-08-30 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.
7 CVE-2019-15806 326 Bypass 2019-08-29 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/basic_sett.html. Any user connected to the Wi-Fi can exploit this.
8 CVE-2019-15805 326 Bypass 2019-08-29 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/login.html. Any user connected to the Wi-Fi can exploit this.
9 CVE-2019-15788 190 Overflow 2019-08-29 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
Clara Genomics Analysis before 0.2.0 has an integer overflow for cudapoa memory management in allocate_block.cpp.
10 CVE-2019-15787 190 Overflow 2019-08-29 2019-09-04
7.8
None Remote Low Not required None None Complete
libZetta.rs through 0.1.2 has an integer overflow in the zpool parser (for error stats) that leads to a panic.
11 CVE-2019-15786 119 Overflow 2019-08-29 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
ROBOTIS Dynamixel SDK through 3.7.11 has a buffer overflow via a large rxpacket.
12 CVE-2019-15785 119 Overflow 2019-08-29 2020-01-13
7.5
None Remote Low Not required Partial Partial Partial
FontForge 20190813 through 20190820 has a buffer overflow in PrefsUI_LoadPrefs in prefs.c.
13 CVE-2019-15784 129 Overflow 2019-08-29 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
Secure Reliable Transport (SRT) through 1.3.4 has a CSndUList array overflow if there are many SRT connections.
14 CVE-2019-15783 119 Overflow 2019-08-29 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
Lute-Tab before 2019-08-23 has a buffer overflow in pdf_print.cc.
15 CVE-2019-15780 502 2019-08-29 2021-10-14
7.5
None Remote Low Not required Partial Partial Partial
The formidable plugin before 4.02.01 for WordPress has unsafe deserialization.
16 CVE-2019-15752 732 +Priv 2019-08-28 2020-08-31
9.3
None Remote Medium Not required Complete Complete Complete
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.
17 CVE-2019-15720 269 2019-08-28 2020-08-24
7.2
None Local Low Not required Complete Complete Complete
CloudBerry Backup v6.1.2.34 allows local privilege escalation via a Pre or Post backup action. With only user-level access, a user can modify the backup plan and add a Pre backup action script that executes on behalf of NT AUTHORITY\SYSTEM.
18 CVE-2019-15717 416 2019-08-29 2019-09-14
7.5
None Remote Low Not required Partial Partial Partial
Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP.
19 CVE-2019-15659 89 Sql 2019-08-27 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.
20 CVE-2019-15658 89 Sql 2019-08-26 2019-08-30
7.5
None Remote Low Not required Partial Partial Partial
connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data.
21 CVE-2019-15657 Exec Code 2019-08-26 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code.
22 CVE-2019-15651 125 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
wolfSSL 4.1.0 has a one-byte heap-based buffer over-read in DecodeCertExtensions in wolfcrypt/src/asn.c because reading the ASN_BOOLEAN byte is mishandled for a crafted DER certificate in GetLength_ex.
23 CVE-2019-15646 89 Sql 2019-08-27 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
The rsvpmaker plugin before 6.2 for WordPress has SQL injection.
24 CVE-2019-15574 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
Gesior-AAC before 2019-05-01 allows serviceID SQL injection in accountmanagement.php.
25 CVE-2019-15573 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
Gesior-AAC before 2019-05-01 allows SQL injection in tankyou.php.
26 CVE-2019-15572 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
Gesior-AAC before 2019-05-01 allows ServiceCategoryID SQL injection in shop.php.
27 CVE-2019-15571 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
The WEB control panel before 2019-04-30 for ClonOS allows SQL injection in clonos.php.
28 CVE-2019-15570 89 Sql 2019-08-26 2019-08-29
7.5
None Remote Low Not required Partial Partial Partial
BEdita through 4.0.0-RC2 allows SQL injection during a save operation for a relation with parameters.
29 CVE-2019-15569 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
HM Courts & Tribunals ccd-data-store-api before 2019-06-10 allows SQL injection, related to SearchQueryFactoryOperation.java and SortDirection.java.
30 CVE-2019-15568 89 Sql 2019-08-26 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
idseq-web before 2019-07-01 in Infectious Disease Sequencing Platform IDseq allows SQL injection via tax_levels.
31 CVE-2019-15567 89 Sql 2019-08-26 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
OpenForis Arena before 2019-05-07 allows SQL injection in the sorting feature.
32 CVE-2019-15566 89 Sql 2019-08-26 2019-08-27
7.5
None Remote Low Not required Partial Partial Partial
The Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider.java.
33 CVE-2019-15565 89 Sql 2019-08-26 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
The ICOMMKT connector before 1.0.7 for PrestaShop allows SQL injection in icommktconnector.php.
34 CVE-2019-15564 89 Sql 2019-08-26 2019-08-27
7.5
None Remote Low Not required Partial Partial Partial
The Compassion Switzerland addons 10.01.4 for Odoo allow SQL injection in models/partner_compassion.py.
35 CVE-2019-15563 89 Sql 2019-08-26 2019-08-29
7.5
None Remote Low Not required Partial Partial Partial
Observational Health Data Sciences and Informatics (OHDSI) WebAPI before 2.7.2 allows SQL injection in FeatureExtractionService.java.
36 CVE-2019-15562 89 Sql Bypass 2019-08-26 2021-03-30
7.5
None Remote Low Not required Partial Partial Partial
** DISPUTED ** GORM before 1.9.10 allows SQL injection via incomplete parentheses. NOTE: Misusing Gorm by passing untrusted user input where Gorm expects trusted SQL fragments is a vulnerability in the application, not in Gorm.
37 CVE-2019-15561 89 Sql 2019-08-26 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
FlashLingo before 2019-06-12 allows SQL injection, related to flashlingo.js and db.js.
38 CVE-2019-15560 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
The Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js.
39 CVE-2019-15559 89 Sql 2019-08-26 2019-08-29
7.5
None Remote Low Not required Partial Partial Partial
DianoxDragon Hawn before 2019-07-10 allows SQL injection.
40 CVE-2019-15558 89 Sql 2019-08-26 2019-08-30
7.5
None Remote Low Not required Partial Partial Partial
XM^online 2 Common Utils and Endpoints 0.2.1 allows SQL injection, related to Constants.java, DropSchemaResolver.java, and SchemaChangeResolver.java.
41 CVE-2019-15557 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
XM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key.
42 CVE-2019-15556 89 Sql 2019-08-26 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
Pvanloon1983 social_network before 2019-07-03 allows SQL injection in includes/form_handlers/register_handler.php.
43 CVE-2019-15555 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
FredReinink Wellness-app before 2019-06-19 allows SQL injection, related to dietTrack.php, exerciseGenerator.php, fitnessTrack.php, and server.php.
44 CVE-2019-15554 787 Mem. Corr. 2019-08-26 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is memory corruption for certain grow attempts with less than the current capacity.
45 CVE-2019-15552 416 Exec Code 2019-08-26 2019-09-05
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.
46 CVE-2019-15551 415 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is a double free for certain grow attempts with the current capacity.
47 CVE-2019-15548 119 Overflow 2019-08-26 2019-08-29
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are instr and mvwinstr buffer overflows because interaction with C functions is mishandled.
48 CVE-2019-15543 787 Mem. Corr. 2019-08-26 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in the slice-deque crate before 0.2.0 for Rust. There is memory corruption in certain allocation cases.
49 CVE-2019-15540 787 Overflow 2019-08-25 2020-08-24
7.2
None Local Low Not required Complete Complete Complete
filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user.
50 CVE-2019-15538 400 2019-08-25 2021-06-02
7.8
None Remote Low Not required None None Complete
An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.
Total number of vulnerabilities : 499   Page : 1 (This Page)2 3 4 5 6 7 8 9 10
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.