CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2019

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
201 CVE-2019-15291 476 2019-08-20 2019-09-06
4.9
None Local Low Not required None None Complete
An issue was discovered in the Linux kernel through 5.2.9. There is a NULL pointer dereference caused by a malicious USB device in the flexcop_usb_probe function in the drivers/media/usb/b2c2/flexcop-usb.c driver.
202 CVE-2019-15290 476 2019-08-20 2019-09-05
4.9
None Local Low Not required None None Complete
An issue was discovered in the Linux kernel through 5.2.9. There is a NULL pointer dereference caused by a malicious USB device in the ath6kl_usb_alloc_urb_from_pipe function in the drivers/net/wireless/ath/ath6kl/usb.c driver.
203 CVE-2019-15239 416 2019-08-20 2020-08-18
7.2
None Local Low Not required Complete Complete Complete
In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation. NOTE: this affects (for example) Linux distributions that use 4.9.x longterm kernels before 4.9.190 or 4.14.x longterm kernels before 4.14.139.
204 CVE-2019-15238 352 CSRF 2019-08-20 2019-08-22
6.8
None Remote Medium Not required Partial Partial Partial
The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.
205 CVE-2019-15237 2019-08-20 2020-08-24
4.3
None Remote Medium Not required None Partial None
Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.
206 CVE-2019-15233 79 XSS 2019-08-20 2020-04-07
4.3
None Remote Medium Not required None Partial None
The Live:Text Box macro in the Old Street Live Input Macros app before 2.11 for Confluence has XSS, leading to theft of the Administrator Session Cookie.
207 CVE-2019-15232 416 2019-08-20 2020-05-15
7.5
None Remote Low Not required Partial Partial Partial
Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors.
208 CVE-2019-15231 Exec Code 2019-08-19 2019-08-21
0.0
None ??? ??? ??? ??? ??? ???
Webmin 1.890, in a default installation, contains a backdoor that allows an unauthenticated attacker to remotely execute commands. This CVE only refers to the backdoor that was enabled by default, and therefore is a separate CVE from CVE-2019-15107. NOTE: although the vendor's build infrastructure was compromised in 2018, the compromise is not known to affect any GitHub repository. Thus, the relatively uncommon case of an end user building their own copy of Webmin (from the 1.890 tag on GitHub) is thought to be safe.
209 CVE-2019-15230 79 XSS 2019-08-28 2019-08-30
3.5
None Remote Medium ??? None Partial None
LibreNMS v1.54 has XSS in the Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template sections of the admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account.
210 CVE-2019-15229 352 CSRF 2019-08-20 2019-08-26
6.8
None Remote Medium Not required Partial Partial Partial
FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page.
211 CVE-2019-15228 79 XSS 2019-08-20 2019-08-26
3.5
None Remote Medium ??? None Partial None
FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors.
212 CVE-2019-15227 79 XSS 2019-08-20 2019-08-28
4.3
None Remote Medium Not required None Partial None
FlightPath 4.8.3 has XSS in the Content, Edit urgent message, and Users sections of the Admin Console. This could lead to cookie stealing and other malicious actions.
213 CVE-2019-15225 770 DoS 2019-08-19 2020-08-24
5.0
None Remote Low Not required None None Partial
In Envoy through 1.11.1, users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. A remote attacker may send a request with a very long URI to result in a denial of service (memory consumption). This is a related issue to CVE-2019-14993.
214 CVE-2019-15224 94 Exec Code 2019-08-19 2019-08-29
7.5
None Remote Low Not required Partial Partial Partial
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected.
215 CVE-2019-15223 476 2019-08-19 2019-09-06
4.9
None Local Low Not required None None Complete
An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/driver.c driver.
216 CVE-2019-15222 476 2019-08-19 2019-09-06
4.9
None Local Low Not required None None Complete
An issue was discovered in the Linux kernel before 5.2.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/helper.c (motu_microbookii) driver.
217 CVE-2019-15221 476 2019-08-19 2019-09-03
4.9
None Local Low Not required None None Complete
An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/pcm.c driver.
218 CVE-2019-15220 416 2019-08-19 2019-09-03
4.9
None Local Low Not required None None Complete
An issue was discovered in the Linux kernel before 5.2.1. There is a use-after-free caused by a malicious USB device in the drivers/net/wireless/intersil/p54/p54usb.c driver.
219 CVE-2019-15219 476 2019-08-19 2019-08-22
4.9
None Local Low Not required None None Complete
An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/sisusbvga/sisusb.c driver.
220 CVE-2019-15218 476 2019-08-19 2021-06-14
4.9
None Local Low Not required None None Complete
An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/siano/smsusb.c driver.
221 CVE-2019-15217 476 2019-08-19 2019-09-06
4.9
None Local Low Not required None None Complete
An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver.
222 CVE-2019-15216 476 2019-08-19 2019-09-03
4.9
None Local Low Not required None None Complete
An issue was discovered in the Linux kernel before 5.0.14. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/yurex.c driver.
223 CVE-2019-15215 416 2019-08-19 2019-09-03
4.9
None Local Low Not required None None Complete
An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/cpia2/cpia2_usb.c driver.
224 CVE-2019-15214 416 2019-08-19 2020-03-06
6.9
None Local Medium Not required Complete Complete Complete
An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because card disconnection causes certain data structures to be deleted too early. This is related to sound/core/init.c and sound/core/info.c.
225 CVE-2019-15213 416 2019-08-19 2019-09-06
4.9
None Local Low Not required None None Complete
An issue was discovered in the Linux kernel before 5.2.3. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/dvb-usb/dvb-usb-init.c driver.
226 CVE-2019-15212 415 2019-08-19 2019-09-03
4.9
None Local Low Not required None None Complete
An issue was discovered in the Linux kernel before 5.1.8. There is a double-free caused by a malicious USB device in the drivers/usb/misc/rio500.c driver.
227 CVE-2019-15211 416 2019-08-19 2019-09-03
4.9
None Local Low Not required None None Complete
An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/v4l2-core/v4l2-dev.c driver because drivers/media/radio/radio-raremono.c does not properly allocate memory.
228 CVE-2019-15160 611 DoS 2019-08-19 2021-07-21
5.0
None Remote Low Not required None None Partial
The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD.
229 CVE-2019-15151 415 2019-08-18 2021-01-14
7.5
None Remote Low Not required Partial Partial Partial
AdPlug 2.3.1 has a double free in the Cu6mPlayer class in u6m.h.
230 CVE-2019-15150 352 CSRF 2019-08-19 2019-08-26
6.8
None Remote Medium Not required Partial Partial Partial
In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function.
231 CVE-2019-15149 254 2019-08-18 2019-08-30
6.8
None Remote Medium Not required Partial Partial Partial
** DISPUTED ** core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child. The Ansible extension is unaffected. NOTE: the vendor disputes this issue because it is exploitable only in conjunction with hypothetical other factors, i.e., an affected use case within a library caller, and a bug in the message receiver policy code that led to reliance on this extra protection mechanism.
232 CVE-2019-15148 787 2019-08-18 2019-08-22
4.3
None Remote Medium Not required None None Partial
GoPro GPMF-parser 1.2.2 has an out-of-bounds write in OpenMP4Source in demo/GPMF_mp4reader.c.
233 CVE-2019-15147 125 2019-08-18 2019-08-22
4.3
None Remote Medium Not required None None Partial
GoPro GPMF-parser 1.2.2 has an out-of-bounds read and SEGV in GPMF_Next in GPMF_parser.c.
234 CVE-2019-15146 125 2019-08-18 2019-08-22
4.3
None Remote Medium Not required None None Partial
GoPro GPMF-parser 1.2.2 has a heap-based buffer over-read (4 bytes) in GPMF_Next in GPMF_parser.c.
235 CVE-2019-15145 125 2019-08-18 2021-12-28
4.3
None Remote Medium Not required None None Partial
DjVuLibre 3.5.27 allows attackers to cause a denial-of-service attack (application crash via an out-of-bounds read) by crafting a corrupted JB2 image file that is mishandled in JB2Dict::JB2Codec::get_direct_context in libdjvu/JB2Image.h because of a missing zero-bytes check in libdjvu/GBitmap.h.
236 CVE-2019-15144 674 2019-08-18 2021-12-28
4.3
None Remote Medium Not required None None Partial
In DjVuLibre 3.5.27, the sorting functionality (aka GArrayTemplate<TYPE>::sort) allows attackers to cause a denial-of-service (application crash due to an Uncontrolled Recursion) by crafting a PBM image file that is mishandled in libdjvu/GContainer.h.
237 CVE-2019-15143 835 2019-08-18 2021-12-28
4.3
None Remote Medium Not required None None Partial
In DjVuLibre 3.5.27, the bitmap reader component allows attackers to cause a denial-of-service error (resource exhaustion caused by a GBitmap::read_rle_raw infinite loop) by crafting a corrupted image file, related to libdjvu/DjVmDir.cpp and libdjvu/GBitmap.cpp.
238 CVE-2019-15142 125 2019-08-18 2021-12-28
4.3
None Remote Medium Not required None None Partial
In DjVuLibre 3.5.27, DjVmDir.cpp in the DJVU reader component allows attackers to cause a denial-of-service (application crash in GStringRep::strdup in libdjvu/GString.cpp caused by a heap-based buffer over-read) by crafting a DJVU file.
239 CVE-2019-15141 125 2019-08-18 2019-11-15
4.3
None Remote Medium Not required None None Partial
WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
240 CVE-2019-15140 416 DoS 2019-08-18 2020-07-03
6.8
None Remote Medium Not required Partial Partial Partial
coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that is mishandled in ReadImage in MagickCore/constitute.c.
241 CVE-2019-15139 125 2019-08-18 2020-09-08
4.3
None Remote Medium Not required None None Partial
The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than CVE-2019-11472.
242 CVE-2019-15137 2019-08-18 2020-08-24
5.0
None Remote Low Not required None Partial None
The Access Control plugin in eProsima Fast RTPS through 1.9.0 allows fnmatch pattern matches with topic name strings (instead of the permission expressions themselves), which can lead to unintended connections between participants in a Data Distribution Service (DDS) network.
243 CVE-2019-15136 862 Bypass 2019-08-18 2020-08-24
5.0
None Remote Low Not required None Partial None
The Access Control plugin in eProsima Fast RTPS through 1.9.0 does not check partition permissions from remote participant connections, which can lead to policy bypass for a secure Data Distribution Service (DDS) partition.
244 CVE-2019-15135 319 2019-08-18 2020-08-24
5.0
None Remote Low Not required Partial None None
The handshake protocol in Object Management Group (OMG) DDS Security 1.1 sends cleartext information about all of the capabilities of a participant (including capabilities inapplicable to the current session), which makes it easier for attackers to discover potentially sensitive reachability information on a Data Distribution Service (DDS) network.
245 CVE-2019-15134 401 2019-08-17 2020-08-24
7.8
None Remote Low Not required None None Complete
RIOT through 2019.07 contains a memory leak in the TCP implementation (gnrc_tcp), allowing an attacker to consume all memory available for network packets and thus effectively stopping all network threads from working. This is related to _receive in sys/net/gnrc/transport_layer/tcp/gnrc_tcp_eventloop.c upon receiving an ACK before a SYN.
246 CVE-2019-15133 369 2019-08-17 2019-08-29
4.3
None Remote Medium Not required None None Partial
In GIFLIB before 2019-02-16, a malformed GIF file triggers a divide-by-zero exception in the decoder function DGifSlurp in dgif_lib.c if the height field of the ImageSize data structure is equal to zero.
247 CVE-2019-15132 200 +Info 2019-08-17 2021-07-21
5.0
None Remote Low Not required Partial None None
Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php.
248 CVE-2019-15130 434 2019-08-18 2021-07-21
10.0
None Remote Low Not required Complete Complete Complete
The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to upload any file type to a candidate's profile picture folder via a crafted recruitment_online/personalData/act_personaltab.cfm multiple-part POST request with a predictable WRC01_USERID parameter. Moreover, the attacker can upload executable content (e.g., asp or aspx) for executing OS commands on the server.
249 CVE-2019-15129 200 +Info 2019-08-18 2021-07-21
5.0
None Remote Low Not required Partial None None
The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to access all candidates' files in the photo folder on the website by specifying a "user id" parameter and file name, such as in a recruitment_online/upload/user/[user_id]/photo/[file_name] URI.
250 CVE-2019-15127 79 XSS 2019-08-21 2019-08-23
3.5
None Remote Medium ??? None Partial None
REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file.
Total number of vulnerabilities : 2004   Page : 1 2 3 4 5 (This Page)6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.