# CVEs published 2019-08-07

76 CVEs were published on August 7, 2019: 3 critical, 10 high. Days are UTC.

- [CVE-2019-14763](https://cve.now/CVE-2019-14763.md): In the Linux kernel before 4.16.4, a double-locking error in drivers/usb/dwc3/gadget.c may potentially cause a deadlock with f\_hid. (no CVSS)
- [CVE-2019-1945](https://cve.now/CVE-2019-1945.md): Cisco Adaptive Security Appliance Smart Tunnel Vulnerabilities (CVSS 6.7, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-1928](https://cve.now/CVE-2019-1928.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player)
- [CVE-2019-1929](https://cve.now/CVE-2019-1929.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player)
- [CVE-2019-1934](https://cve.now/CVE-2019-1934.md): Cisco Adaptive Security Appliance Software Web-Based Management Interface Privilege Escalation Vulnerability (CVSS 8.8, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-1944](https://cve.now/CVE-2019-1944.md): Cisco Adaptive Security Appliance Smart Tunnel Vulnerabilities (CVSS 6.7, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-1926](https://cve.now/CVE-2019-1926.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player)
- [CVE-2019-1927](https://cve.now/CVE-2019-1927.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player)
- [CVE-2019-1918](https://cve.now/CVE-2019-1918.md): Cisco IOS XR Software Intermediate System–to–Intermediate System Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XR Software)
- [CVE-2019-1924](https://cve.now/CVE-2019-1924.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player)
- [CVE-2019-1925](https://cve.now/CVE-2019-1925.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player)
- [CVE-2019-1910](https://cve.now/CVE-2019-1910.md): Cisco IOS XR Software Intermediate System to Intermediate System Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XR Software)
- [CVE-2019-1895](https://cve.now/CVE-2019-1895.md): Cisco Enterprise NFV Infrastructure Software VNC Authentication Bypass Vulnerability (CVSS 9.8, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2019-14474](https://cve.now/CVE-2019-14474.md): eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic process, resulting in the… (no CVSS)
- [CVE-2019-14537](https://cve.now/CVE-2019-14537.md): YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass. (no CVSS, yourls/yourls)
- [CVE-2019-14748](https://cve.now/CVE-2019-14748.md): An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. (no CVSS)
- [CVE-2019-14749](https://cve.now/CVE-2019-14749.md): An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. (no CVSS)
- [CVE-2019-14750](https://cve.now/CVE-2019-14750.md): An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. (no CVSS)
- [CVE-2019-11653](https://cve.now/CVE-2019-11653.md): Remote Access Control Bypass in Micro Focus Content Manager. (no CVSS, Micro Focus Content Manager)
- [CVE-2019-5476](https://cve.now/CVE-2019-5476.md): An SQL Injection in the Nextcloud Lookup-Server \< v0.3.0 (running on https://lookup.nextcloud.com) caused unauthenticated users to be able… (no CVSS, lookup.nextcloud.com)
- [CVE-2019-10099](https://cve.now/CVE-2019-10099.md): Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. (no CVSS, Apache Spark · org.apache.spark:spark-core\_2.11 +1)
- [CVE-2016-5431](https://cve.now/CVE-2016-5431.md): The PHP JOSE Library by Gree Inc. (no CVSS, jose-php · gree/jose)
- [CVE-2019-14747](https://cve.now/CVE-2019-14747.md): DWSurvey through 2019-07-22 has stored XSS via the design/my-survey-design!copySurvey.action surveyName parameter. (no CVSS)
- [CVE-2019-14746](https://cve.now/CVE-2019-14746.md): A issue was discovered in KuaiFanCMS 5.0. (no CVSS)
- [CVE-2019-14745](https://cve.now/CVE-2019-14745.md): In radare2 before 3.7.0, a command injection vulnerability exists in bin\_symbols() in libr/core/cbin.c. (no CVSS)
- [CVE-2019-14432](https://cve.now/CVE-2019-14432.md): Incorrect authentication of application WebSocket connections in Loom Desktop for Mac up to 0.16.0 allows remote code execution from… (no CVSS)
- [CVE-2018-20961](https://cve.now/CVE-2018-20961.md): In the Linux kernel before 4.16.4, a double free vulnerability in the f\_midi\_set\_alt function of drivers/usb/gadget/function/f\_midi.c in… (no CVSS)
- [CVE-2019-14744](https://cve.now/CVE-2019-14744.md): In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user… (no CVSS)
- [CVE-2019-10387](https://cve.now/CVE-2019-10387.md): A missing permission check in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users… (no CVSS, Jenkins project Jenkins XL TestView Plugin · com.xebialabs.…)
- [CVE-2019-10388](https://cve.now/CVE-2019-10388.md): A cross-site request forgery vulnerability in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to… (no CVSS, Jenkins project Jenkins Relution Enterprise Appstore Publis…)
- [CVE-2019-10389](https://cve.now/CVE-2019-10389.md): A missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins… (no CVSS, Jenkins project Jenkins Relution Enterprise Appstore Publis…)
- [CVE-2019-10371](https://cve.now/CVE-2019-10371.md): A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized… (no CVSS, Jenkins project Jenkins Gitlab Authentication Plugin · org.…)
- [CVE-2019-10372](https://cve.now/CVE-2019-10372.md): An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to… (no CVSS, Jenkins project Jenkins Gitlab Authentication Plugin · org.…)
- [CVE-2019-10373](https://cve.now/CVE-2019-10373.md): A stored cross-site scripting vulnerability in Jenkins Build Pipeline Plugin 1.5.8 and earlier allows attackers able to edit the build… (no CVSS, Jenkins project Jenkins Build Pipeline Plugin · org.jenkins…)
- [CVE-2019-10374](https://cve.now/CVE-2019-10374.md): A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions… (no CVSS, Jenkins project Jenkins PegDown Formatter Plugin · org.jenk…)
- [CVE-2019-10375](https://cve.now/CVE-2019-10375.md): An arbitrary file read vulnerability in Jenkins File System SCM Plugin 2.1 and earlier allows attackers able to configure jobs in Jenkins… (no CVSS, Jenkins project Jenkins File System SCM Plugin · hudson.plu…)
- [CVE-2019-10376](https://cve.now/CVE-2019-10376.md): A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML… (no CVSS, Jenkins project Jenkins Wall Display Plugin · org.jenkins-c…)
- [CVE-2019-10377](https://cve.now/CVE-2019-10377.md): A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any… (no CVSS, Jenkins project Jenkins Avatar Plugin · net.hurstfrost.jenk…)
- [CVE-2019-10378](https://cve.now/CVE-2019-10378.md): Jenkins TestLink Plugin 3.16 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they… (no CVSS, Jenkins project Jenkins TestLink Plugin · org.jenkins-ci.pl…)
- [CVE-2019-10379](https://cve.now/CVE-2019-10379.md): Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the… (no CVSS, Jenkins project Jenkins Google Cloud Messaging Notification…)
- [CVE-2019-10380](https://cve.now/CVE-2019-10380.md): Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing… (no CVSS, Jenkins project Jenkins Simple Travis Pipeline Runner Plugi…)
- [CVE-2019-10381](https://cve.now/CVE-2019-10381.md): Jenkins Codefresh Integration Plugin 1.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM. (no CVSS, Jenkins project Jenkins Codefresh Integration Plugin · org.…)
- [CVE-2019-10382](https://cve.now/CVE-2019-10382.md): Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM. (no CVSS, Jenkins project Jenkins VMware Lab Manager Slaves Plugin ·…)
- [CVE-2019-10385](https://cve.now/CVE-2019-10385.md): Jenkins eggPlant Plugin 2.2 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be… (no CVSS, Jenkins project Jenkins eggPlant Plugin · org.jenkins-ci.pl…)
- [CVE-2019-10386](https://cve.now/CVE-2019-10386.md): A cross-site request forgery vulnerability in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection… (no CVSS, Jenkins project Jenkins XL TestView Plugin · com.xebialabs.…)
- [CVE-2019-10367](https://cve.now/CVE-2019-10367.md): Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some… (no CVSS, Jenkins project Jenkins Configuration as Code Plugin · io.j…)
- [CVE-2019-10368](https://cve.now/CVE-2019-10368.md): A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection… (no CVSS, Jenkins project Jenkins JClouds Plugin · org.jenkins-ci.plu…)
- [CVE-2019-10369](https://cve.now/CVE-2019-10369.md): A missing permission check in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and… (no CVSS, Jenkins project Jenkins JClouds Plugin · org.jenkins-ci.plu…)
- [CVE-2019-10370](https://cve.now/CVE-2019-10370.md): Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form… (no CVSS, Jenkins project Jenkins Mask Passwords Plugin · org.jenkins…)
- [CVE-2018-14383](https://cve.now/CVE-2018-14383.md): The Transition Technologies "The Scheduler" app 5.1.3 for Jira allows XXE due to a weakly configured/parameterized XML parser. (no CVSS)
- [CVE-2019-14743](https://cve.now/CVE-2019-14743.md): In Valve Steam Client for Windows through 2019-08-07, HKLM\\SOFTWARE\\Wow6432Node\\Valve\\Steam has explicit "Full control" for the Users… (no CVSS)
- [CVE-2018-20959](https://cve.now/CVE-2018-20959.md): Jura E8 devices lack Bluetooth connection security. (no CVSS)
- [CVE-2018-20958](https://cve.now/CVE-2018-20958.md): The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however… (no CVSS)
- [CVE-2017-18483](https://cve.now/CVE-2017-18483.md): ANNKE SP1 HD wireless camera 3.4.1.1604071109 devices allow XSS via a crafted SSID. (no CVSS)
- [CVE-2016-10861](https://cve.now/CVE-2016-10861.md): Neet AirStream NAS1.1 devices allow CSRF attacks that cause the settings binary to change the AP name and password. (no CVSS)
- [CVE-2016-10812](https://cve.now/CVE-2016-10812.md): In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117). (no CVSS)
- [CVE-2016-10811](https://cve.now/CVE-2016-10811.md): In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116). (no CVSS)
- [CVE-2016-10810](https://cve.now/CVE-2016-10810.md): In cPanel before 57.9999.54, /scripts/maildir\_converter exposed a TTY to an unprivileged process (SEC-115). (no CVSS)
- [CVE-2016-10809](https://cve.now/CVE-2016-10809.md): In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114). (no CVSS)
- [CVE-2016-10808](https://cve.now/CVE-2016-10808.md): In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113). (no CVSS)
- [CVE-2016-10807](https://cve.now/CVE-2016-10807.md): cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112). (no CVSS)
- [CVE-2016-10806](https://cve.now/CVE-2016-10806.md): cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110). (no CVSS)
- [CVE-2016-10805](https://cve.now/CVE-2016-10805.md): cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax\_maketext\_syntax\_util.pl (SEC-109). (no CVSS)
- [CVE-2016-10804](https://cve.now/CVE-2016-10804.md): The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58). (no CVSS)
- [CVE-2016-10803](https://cve.now/CVE-2016-10803.md): cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923). (no CVSS)
- [CVE-2016-10802](https://cve.now/CVE-2016-10802.md): cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142). (no CVSS)
- [CVE-2016-10801](https://cve.now/CVE-2016-10801.md): cPanel before 58.0.4 has improper session handling for shared users (SEC-139). (no CVSS)
- [CVE-2016-10800](https://cve.now/CVE-2016-10800.md): cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138). (no CVSS)
- [CVE-2016-10799](https://cve.now/CVE-2016-10799.md): cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137). (no CVSS)
- [CVE-2016-10798](https://cve.now/CVE-2016-10798.md): cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134). (no CVSS)
- [CVE-2019-1913](https://cve.now/CVE-2019-1913.md): Cisco Small Business 220 Series Smart Switches Remote Code Execution Vulnerabilities (CVSS 9.8, Cisco Small Business 220 Series Smart Plus Switches)
- [CVE-2019-1914](https://cve.now/CVE-2019-1914.md): Cisco Small Business 220 Series Smart Switches Command Injection Vulnerability (CVSS 7.2, Cisco Small Business 220 Series Smart Plus Switches)
- [CVE-2019-1912](https://cve.now/CVE-2019-1912.md): Cisco Small Business 220 Series Smart Switches Authentication Bypass Vulnerability (CVSS 9.1, Cisco Small Business 220 Series Smart Plus Switches)
- [CVE-2019-14732](https://cve.now/CVE-2019-14732.md): AdPlug 2.3.1 has multiple heap-based buffer overflows in Ca2mLoader::load() in a2m.cpp. (no CVSS)
- [CVE-2019-14733](https://cve.now/CVE-2019-14733.md): AdPlug 2.3.1 has multiple heap-based buffer overflows in CradLoader::load() in rad.cpp. (no CVSS)
- [CVE-2019-14734](https://cve.now/CVE-2019-14734.md): AdPlug 2.3.1 has multiple heap-based buffer overflows in CmtkLoader::load() in mtk.cpp. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2019-08-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.