CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2019

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
51 CVE-2019-15769 352 CSRF 2019-08-29 2019-09-05
6.8
None Remote Medium Not required Partial Partial Partial
The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.
52 CVE-2019-15767 787 Overflow 2019-08-29 2020-08-24
6.8
None Remote Medium Not required Partial Partial Partial
In GNU Chess 6.2.5, there is a stack-based buffer overflow in the cmd_load function in frontend/cmd.cc via a crafted chess position in an EPD file.
53 CVE-2019-15759 476 2019-08-29 2020-06-08
4.3
None Remote Medium Not required None None Partial
An issue was discovered in Binaryen 1.38.32. Two visitors in ir/ExpressionManipulator.cpp can lead to a NULL pointer dereference in wasm::LocalSet::finalize in wasm/wasm.cpp. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js.
54 CVE-2019-15758 617 2019-08-29 2020-06-08
4.3
None Remote Medium Not required None None Partial
An issue was discovered in Binaryen 1.38.32. Missing validation rules in asmjs/asmangle.cpp can lead to an Assertion Failure at wasm/wasm.cpp in wasm::asmangle. A crafted input can cause denial-of-service, as demonstrated by wasm2js.
55 CVE-2019-15757 476 2019-08-29 2019-09-10
4.3
None Remote Medium Not required None None Partial
libMirage 3.2.2 in CDemu has a NULL pointer dereference in the NRG parser in parser.c.
56 CVE-2019-15753 770 2019-08-28 2020-08-24
6.4
None Remote Low Not required Partial None Partial
In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instances belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are affected. This occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py.
57 CVE-2019-15752 732 +Priv 2019-08-28 2020-08-31
9.3
None Remote Medium Not required Complete Complete Complete
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.
58 CVE-2019-15745 798 2019-08-29 2019-09-05
3.3
None Local Network Low Not required Partial None None
The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app. The communication happens over UDP port 27431. An attacker on the local network can use the same key to encrypt and send commands to discover all smart plugs in a network, take over control of a device, and perform actions such as turning it on and off.
59 CVE-2019-15720 269 2019-08-28 2020-08-24
7.2
None Local Low Not required Complete Complete Complete
CloudBerry Backup v6.1.2.34 allows local privilege escalation via a Pre or Post backup action. With only user-level access, a user can modify the backup plan and add a Pre backup action script that executes on behalf of NT AUTHORITY\SYSTEM.
60 CVE-2019-15717 416 2019-08-29 2019-09-14
7.5
None Remote Low Not required Partial Partial Partial
Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP.
61 CVE-2019-15716 276 2019-08-28 2020-08-24
2.1
None Local Low Not required Partial None None
WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions were misconfigured or were based on unsafe OS defaults.
62 CVE-2019-15714 22 Dir. Trav. 2019-08-28 2019-09-04
5.0
None Remote Low Not required Partial None None
cli/lib/main.js in Entropic before 2019-06-13 does not reject / and \ in command names, which might allow a directory traversal attack in unusual situations.
63 CVE-2019-15713 79 XSS 2019-08-28 2019-08-29
4.3
None Remote Medium Not required None Partial None
The my-calendar plugin before 3.1.10 for WordPress has XSS.
64 CVE-2019-15702 835 2019-08-27 2020-02-18
5.0
None Remote Low Not required None None Partial
In the TCP implementation (gnrc_tcp) in RIOT through 2019.07, the parser for TCP options does not terminate on all inputs, allowing a denial-of-service, because sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c has an infinite loop for an unknown zero-length option.
65 CVE-2019-15701 78 Exec Code 2019-08-27 2019-08-30
6.8
None Remote Medium Not required Partial Partial Partial
components/Modals/HelpModal.jsx in BloodHound 2.2.0 allows remote attackers to execute arbitrary OS commands (by spawning a child process as the current user on the victim's machine) when the search function's autocomplete feature is used. The victim must import data from an Active Directory with a GPO containing JavaScript in its name.
66 CVE-2019-15700 79 XSS 2019-08-27 2019-09-04
4.3
None Remote Medium Not required None Partial None
public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text.
67 CVE-2019-15698 200 +Info 2019-08-27 2021-07-21
4.0
None Remote Low ??? Partial None None
In Octopus Deploy 2019.7.3 through 2019.7.9, in certain circumstances, an authenticated user with VariableView permissions could view sensitive values. This is fixed in 2019.7.10.
68 CVE-2019-15666 125 DoS 2019-08-27 2020-04-23
4.9
None Local Low Not required None None Complete
An issue was discovered in the Linux kernel before 5.0.19. There is an out-of-bounds array access in __xfrm_policy_unlink, which will cause denial of service, because verify_newpolicy_info in net/xfrm/xfrm_user.c mishandles directory validation.
69 CVE-2019-15660 352 CSRF 2019-08-27 2019-08-28
6.8
None Remote Medium Not required Partial Partial Partial
The wp-members plugin before 3.2.8 for WordPress has CSRF.
70 CVE-2019-15659 89 Sql 2019-08-27 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.
71 CVE-2019-15658 89 Sql 2019-08-26 2019-08-30
7.5
None Remote Low Not required Partial Partial Partial
connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data.
72 CVE-2019-15657 Exec Code 2019-08-26 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code.
73 CVE-2019-15651 125 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
wolfSSL 4.1.0 has a one-byte heap-based buffer over-read in DecodeCertExtensions in wolfcrypt/src/asn.c because reading the ASN_BOOLEAN byte is mishandled for a crafted DER certificate in GetLength_ex.
74 CVE-2019-15650 2019-08-27 2020-08-24
4.0
None Remote Low ??? None Partial None
The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme updates) because of a nonce check error.
75 CVE-2019-15649 434 2019-08-27 2019-08-30
6.5
None Remote Low ??? Partial Partial Partial
The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload.
76 CVE-2019-15648 287 2019-08-27 2020-08-24
5.5
None Remote Low ??? None Partial Partial
The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.
77 CVE-2019-15647 94 Exec Code 2019-08-27 2019-08-29
6.5
None Remote Low ??? Partial Partial Partial
The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.
78 CVE-2019-15646 89 Sql 2019-08-27 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
The rsvpmaker plugin before 6.2 for WordPress has SQL injection.
79 CVE-2019-15645 352 CSRF 2019-08-27 2019-08-28
6.8
None Remote Medium Not required Partial Partial Partial
The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.
80 CVE-2019-15644 79 XSS 2019-08-27 2019-08-28
4.3
None Remote Medium Not required None Partial None
The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.
81 CVE-2019-15643 79 XSS 2019-08-27 2019-08-28
4.3
None Remote Medium Not required None Partial None
The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.
82 CVE-2019-15642 94 Exec Code 2019-08-26 2019-09-04
6.5
None Remote Low ??? Partial Partial Partial
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must not be granted to un-trusted Webmin users."
83 CVE-2019-15641 611 2019-08-26 2019-08-30
6.8
None Remote Low ??? Complete None None
xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi.
84 CVE-2019-15640 20 2019-08-26 2019-09-03
5.0
None Remote Low Not required None Partial None
Limesurvey before 3.17.10 does not validate both the MIME type and file extension of an image.
85 CVE-2019-15637 611 2019-08-26 2021-09-08
5.5
None Remote Low ??? Partial None Partial
Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tableau Desktop, Tableau Reader, and Tableau Public Desktop.
86 CVE-2019-15630 22 Dir. Trav. 2019-08-30 2019-09-05
5.0
None Remote Low Not required Partial None None
Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gateway released before August 1 2019 allow remote attackers to read files accessible to the Mule process.
87 CVE-2019-15574 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
Gesior-AAC before 2019-05-01 allows serviceID SQL injection in accountmanagement.php.
88 CVE-2019-15573 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
Gesior-AAC before 2019-05-01 allows SQL injection in tankyou.php.
89 CVE-2019-15572 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
Gesior-AAC before 2019-05-01 allows ServiceCategoryID SQL injection in shop.php.
90 CVE-2019-15571 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
The WEB control panel before 2019-04-30 for ClonOS allows SQL injection in clonos.php.
91 CVE-2019-15570 89 Sql 2019-08-26 2019-08-29
7.5
None Remote Low Not required Partial Partial Partial
BEdita through 4.0.0-RC2 allows SQL injection during a save operation for a relation with parameters.
92 CVE-2019-15569 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
HM Courts & Tribunals ccd-data-store-api before 2019-06-10 allows SQL injection, related to SearchQueryFactoryOperation.java and SortDirection.java.
93 CVE-2019-15568 89 Sql 2019-08-26 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
idseq-web before 2019-07-01 in Infectious Disease Sequencing Platform IDseq allows SQL injection via tax_levels.
94 CVE-2019-15567 89 Sql 2019-08-26 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
OpenForis Arena before 2019-05-07 allows SQL injection in the sorting feature.
95 CVE-2019-15566 89 Sql 2019-08-26 2019-08-27
7.5
None Remote Low Not required Partial Partial Partial
The Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider.java.
96 CVE-2019-15565 89 Sql 2019-08-26 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
The ICOMMKT connector before 1.0.7 for PrestaShop allows SQL injection in icommktconnector.php.
97 CVE-2019-15564 89 Sql 2019-08-26 2019-08-27
7.5
None Remote Low Not required Partial Partial Partial
The Compassion Switzerland addons 10.01.4 for Odoo allow SQL injection in models/partner_compassion.py.
98 CVE-2019-15563 89 Sql 2019-08-26 2019-08-29
7.5
None Remote Low Not required Partial Partial Partial
Observational Health Data Sciences and Informatics (OHDSI) WebAPI before 2.7.2 allows SQL injection in FeatureExtractionService.java.
99 CVE-2019-15562 89 Sql Bypass 2019-08-26 2021-03-30
7.5
None Remote Low Not required Partial Partial Partial
** DISPUTED ** GORM before 1.9.10 allows SQL injection via incomplete parentheses. NOTE: Misusing Gorm by passing untrusted user input where Gorm expects trusted SQL fragments is a vulnerability in the application, not in Gorm.
100 CVE-2019-15561 89 Sql 2019-08-26 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
FlashLingo before 2019-06-12 allows SQL injection, related to flashlingo.js and db.js.
Total number of vulnerabilities : 2004   Page : 1 2 (This Page)3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.