CVEs published August 5, 2019
60 CVEs were published on August 5, 2019: 0 critical, 3 high.
- Published
- 60
- Critical
- 0
- High
- 3
- Medium
- 3
- Low
- 0
- Unrated
- 54
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- LCDS LAquis SCADA
- 2
- Cloud Foundry CF CLI Release · Cloud Foundry CF CLI
- 1
- Cloud Foundry UAA Release
- 1
- Data ONTAP operating in 7-Mode
- 1
- Dell Client Commercial and Consumer platforms
- 1
- grumpydictator/firefly-iii
- 1
- IBM Cloud Private
- 1
- IBM Java
- 1
- IBM MQ
- 1
High 3
- CVE-2019-3717Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability.Dell Client Commercial and Consumer platforms
- CVE-2019-11270UAA clients.write vulnerabilityCloud Foundry UAA Release
- CVE-2019-4473Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate coIBM Java
Medium, low and unrated 57
- CVE-2019-14475eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks.
- CVE-2019-14664In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email.
- CVE-2019-14667Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction desc
- CVE-2019-14668Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field.
- CVE-2019-14669Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name.
- CVE-2019-14670Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field.
- CVE-2019-14671Firefly III 4.7.17.3 is vulnerable to local file enumeration.grumpydictator/firefly-iii
- CVE-2019-14672Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field.
- CVE-2019-14547An issue was discovered in EspoCRM before 5.6.9.
- CVE-2019-14548An issue was discovered in EspoCRM before 5.6.9.
- CVE-2019-14546An issue was discovered in EspoCRM before 5.6.9.
- CVE-2019-14550An issue was discovered in EspoCRM before 5.6.9.
- CVE-2019-14549An issue was discovered in EspoCRM before 5.6.9.
- CVE-2019-5502SMB in Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 has weak cryptography which when exploited could lead to information disclosData ONTAP operating in 7-Mode
- CVE-2019-10994Processing a specially crafted project file in LAquis SCADA 4.3.1.71 may trigger an out-of-bounds read, which may allow an attacker to obtaiLCDS LAquis SCADA
- CVE-2019-10980A type confusion vulnerability may be exploited when LAquis SCADA 4.3.1.71 processes a specially crafted project file.LCDS LAquis SCADA
- CVE-2019-14665Brandy 1.20.1 has a heap-based buffer overflow in define_array in variables.c via crafted BASIC source code.
- CVE-2019-12264Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc DHCP client component
- CVE-2019-11198Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script
- CVE-2019-3800CF CLI writes the client id and secret to config fileCloud Foundry CF CLI Release · Cloud Foundry CF CLI
- CVE-2019-14348The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_seaso
- CVE-2019-4284IBM Cloud Private 2.1.0 , 3.1.0, 3.1.1, and 3.1.2 could allow a local privileged user to obtain sensitive OIDC token that is printed to log IBM Cloud Private
- CVE-2019-4261IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulnerable to a denial of service attack causIBM MQ
- CVE-2016-10775cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173).
- CVE-2016-10774cPanel before 60.0.25 allows self XSS in the tail_ea4_migration.cgi interface (SEC-172).
- CVE-2016-10773cPanel before 60.0.25 allows format-string injection in exception-message handling (SEC-171).
- CVE-2016-10772cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).
- CVE-2016-10771cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165).
- CVE-2016-10770cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164).
- CVE-2016-10769cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162).
- CVE-2016-10768cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161).
- CVE-2016-10767cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159).
- CVE-2017-18482cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213).
- CVE-2017-18481cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).
- CVE-2017-18480cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).
- CVE-2017-18479In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).
- CVE-2017-18478In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207).
- CVE-2017-18477In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).
- CVE-2017-18476Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).
- CVE-2017-18475In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204).
- CVE-2017-18474cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201).
- CVE-2017-18473cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).
- CVE-2017-18472cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).
- CVE-2017-18471cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197).
- CVE-2017-18470cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196).
- CVE-2017-18469cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233).
- CVE-2017-18468cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232).
- CVE-2017-18467cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229).
- CVE-2017-18465cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227).
- CVE-2017-18466cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).
- CVE-2017-18464cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226).
- CVE-2017-18462cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224).
- CVE-2019-14521The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location o
- CVE-2019-14525In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to
- CVE-2019-14663Brandy 1.20.1 has a stack-based buffer overflow in fileio_openin in fileio.c via crafted BASIC source code.
- CVE-2019-14662Brandy 1.20.1 has a stack-based buffer overflow in fileio_openout in fileio.c via crafted BASIC source code.
- CVE-2019-14654In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inj