# CVEs published 2019-08-12

47 CVEs were published on August 12, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-14359](https://cve.now/CVE-2019-14359.md): On BC Vault devices, a side channel for the row-based SSD1309 OLED display was found. (no CVSS)
- [CVE-2019-14982](https://cve.now/CVE-2019-14982.md): In Exiv2 before v0.27.2, there is an integer overflow vulnerability in the WebPImage::getHeaderOffset function in webpimage.cpp. (no CVSS)
- [CVE-2019-14981](https://cve.now/CVE-2019-14981.md): In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. (no CVSS)
- [CVE-2019-14980](https://cve.now/CVE-2019-14980.md): In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows… (no CVSS)
- [CVE-2019-13418](https://cve.now/CVE-2019-13418.md): Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized. (no CVSS, floragunn Search Guard)
- [CVE-2019-14976](https://cve.now/CVE-2019-14976.md): iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter. (no CVSS)
- [CVE-2019-13417](https://cve.now/CVE-2019-13417.md): Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not… (no CVSS, floragunn Search Guard)
- [CVE-2019-14969](https://cve.now/CVE-2019-14969.md): Netwrix Auditor before 9.8 has insecure permissions on %PROGRAMDATA%\\Netwrix Auditor\\Logs\\ActiveDirectory\\ and sub-folders. (no CVSS)
- [CVE-2019-14968](https://cve.now/CVE-2019-14968.md): An issue was discovered in imcat 4.9. (no CVSS)
- [CVE-2019-14965](https://cve.now/CVE-2019-14965.md): An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. (no CVSS)
- [CVE-2019-14966](https://cve.now/CVE-2019-14966.md): An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. (no CVSS)
- [CVE-2019-14967](https://cve.now/CVE-2019-14967.md): An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. (no CVSS)
- [CVE-2019-12618](https://cve.now/CVE-2019-12618.md): HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver. (no CVSS, github.com/hashicorp/nomad)
- [CVE-2019-13462](https://cve.now/CVE-2019-13462.md): Lansweeper before 7.1.117.4 allows unauthenticated SQL injection. (no CVSS)
- [CVE-2017-18499](https://cve.now/CVE-2017-18499.md): The simple-membership plugin before 3.5.7 for WordPress has XSS. (no CVSS)
- [CVE-2015-9303](https://cve.now/CVE-2015-9303.md): The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS. (no CVSS)
- [CVE-2017-18500](https://cve.now/CVE-2017-18500.md): The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2017-18501](https://cve.now/CVE-2017-18501.md): The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2017-18502](https://cve.now/CVE-2017-18502.md): The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2017-18503](https://cve.now/CVE-2017-18503.md): The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS. (no CVSS)
- [CVE-2017-18504](https://cve.now/CVE-2017-18504.md): The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF. (no CVSS)
- [CVE-2017-18505](https://cve.now/CVE-2017-18505.md): The twitter-plugin plugin before 2.55 for WordPress has XSS. (no CVSS)
- [CVE-2019-14945](https://cve.now/CVE-2019-14945.md): The ultimate-member plugin before 2.0.54 for WordPress has XSS. (no CVSS)
- [CVE-2019-14946](https://cve.now/CVE-2019-14946.md): The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations. (no CVSS)
- [CVE-2019-14947](https://cve.now/CVE-2019-14947.md): The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade. (no CVSS)
- [CVE-2018-20965](https://cve.now/CVE-2018-20965.md): The ultimate-member plugin before 2.0.4 for WordPress has XSS. (no CVSS)
- [CVE-2016-10872](https://cve.now/CVE-2016-10872.md): The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form. (no CVSS)
- [CVE-2015-9304](https://cve.now/CVE-2015-9304.md): The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input. (no CVSS)
- [CVE-2018-20966](https://cve.now/CVE-2018-20966.md): The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature. (no CVSS)
- [CVE-2019-14951](https://cve.now/CVE-2019-14951.md): The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against… (no CVSS)
- [CVE-2017-18506](https://cve.now/CVE-2017-18506.md): The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens. (no CVSS)
- [CVE-2019-14948](https://cve.now/CVE-2019-14948.md): The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure. (no CVSS)
- [CVE-2019-14949](https://cve.now/CVE-2019-14949.md): The wp-database-backup plugin before 5.1.2 for WordPress has XSS. (no CVSS)
- [CVE-2016-10873](https://cve.now/CVE-2016-10873.md): The wp-database-backup plugin before 4.3.3 for WordPress has XSS. (no CVSS)
- [CVE-2016-10874](https://cve.now/CVE-2016-10874.md): The wp-database-backup plugin before 4.3.3 for WordPress has CSRF. (no CVSS)
- [CVE-2016-10875](https://cve.now/CVE-2016-10875.md): The wp-database-backup plugin before 4.3.1 for WordPress has XSS. (no CVSS)
- [CVE-2016-10876](https://cve.now/CVE-2016-10876.md): The wp-database-backup plugin before 4.3.1 for WordPress has CSRF. (no CVSS)
- [CVE-2016-10877](https://cve.now/CVE-2016-10877.md): The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2016-10878](https://cve.now/CVE-2016-10878.md): The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS. (no CVSS)
- [CVE-2015-9305](https://cve.now/CVE-2015-9305.md): The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add\_query\_arg() and remove\_query\_arg() functions. (no CVSS)
- [CVE-2019-14950](https://cve.now/CVE-2019-14950.md): The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page. (no CVSS)
- [CVE-2017-18508](https://cve.now/CVE-2017-18508.md): The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS. (no CVSS)
- [CVE-2016-10879](https://cve.now/CVE-2016-10879.md): The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS. (no CVSS)
- [CVE-2015-9306](https://cve.now/CVE-2015-9306.md): The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS. (no CVSS)
- [CVE-2019-14932](https://cve.now/CVE-2019-14932.md): The Recruitment module in Humanica Humatrix 7 1.0.0.681 and 1.0.0.203 allows remote attackers to access all candidates' information on the… (no CVSS)
- [CVE-2019-14940](https://cve.now/CVE-2019-14940.md): In Storage Performance Development Kit (SPDK) before 19.07, a user of a vhost can cause a crash if the target is sent invalid input. (no CVSS)
- [CVE-2019-14939](https://cve.now/CVE-2019-14939.md): An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. (no CVSS, mysql)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2019-08-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.