# CVEs published 2019-08-05

60 CVEs were published on August 5, 2019: 0 critical, 3 high. Days are UTC.

- [CVE-2019-14475](https://cve.now/CVE-2019-14475.md): eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks. (no CVSS)
- [CVE-2019-14664](https://cve.now/CVE-2019-14664.md): In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. (no CVSS)
- [CVE-2019-14667](https://cve.now/CVE-2019-14667.md): Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction desc (no CVSS)
- [CVE-2019-14668](https://cve.now/CVE-2019-14668.md): Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. (no CVSS)
- [CVE-2019-14669](https://cve.now/CVE-2019-14669.md): Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. (no CVSS)
- [CVE-2019-14670](https://cve.now/CVE-2019-14670.md): Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. (no CVSS)
- [CVE-2019-14671](https://cve.now/CVE-2019-14671.md): Firefly III 4.7.17.3 is vulnerable to local file enumeration. (no CVSS, grumpydictator/firefly-iii)
- [CVE-2019-14672](https://cve.now/CVE-2019-14672.md): Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. (no CVSS)
- [CVE-2019-14547](https://cve.now/CVE-2019-14547.md): An issue was discovered in EspoCRM before 5.6.9. (no CVSS)
- [CVE-2019-14548](https://cve.now/CVE-2019-14548.md): An issue was discovered in EspoCRM before 5.6.9. (no CVSS)
- [CVE-2019-14546](https://cve.now/CVE-2019-14546.md): An issue was discovered in EspoCRM before 5.6.9. (no CVSS)
- [CVE-2019-14550](https://cve.now/CVE-2019-14550.md): An issue was discovered in EspoCRM before 5.6.9. (no CVSS)
- [CVE-2019-14549](https://cve.now/CVE-2019-14549.md): An issue was discovered in EspoCRM before 5.6.9. (no CVSS)
- [CVE-2019-5502](https://cve.now/CVE-2019-5502.md): SMB in Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 has weak cryptography which when exploited could lead to information disclos (no CVSS, Data ONTAP operating in 7-Mode)
- [CVE-2019-10994](https://cve.now/CVE-2019-10994.md): Processing a specially crafted project file in LAquis SCADA 4.3.1.71 may trigger an out-of-bounds read, which may allow an attacker to obtai (no CVSS, LCDS LAquis SCADA)
- [CVE-2019-10980](https://cve.now/CVE-2019-10980.md): A type confusion vulnerability may be exploited when LAquis SCADA 4.3.1.71 processes a specially crafted project file. (no CVSS, LCDS LAquis SCADA)
- [CVE-2019-14665](https://cve.now/CVE-2019-14665.md): Brandy 1.20.1 has a heap-based buffer overflow in define\_array in variables.c via crafted BASIC source code. (no CVSS)
- [CVE-2019-12264](https://cve.now/CVE-2019-12264.md): Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc DHCP client component (no CVSS)
- [CVE-2019-11198](https://cve.now/CVE-2019-11198.md): Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2019-3800](https://cve.now/CVE-2019-3800.md): CF CLI writes the client id and secret to config file (CVSS 6.3, Cloud Foundry CF CLI Release · Cloud Foundry CF CLI)
- [CVE-2019-3717](https://cve.now/CVE-2019-3717.md): Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability. (CVSS 7.1, Dell Client Commercial and Consumer platforms)
- [CVE-2019-11270](https://cve.now/CVE-2019-11270.md): UAA clients.write vulnerability (CVSS 7.3, Cloud Foundry UAA Release)
- [CVE-2019-14348](https://cve.now/CVE-2019-14348.md): The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport\_seaso (no CVSS)
- [CVE-2019-4473](https://cve.now/CVE-2019-4473.md): Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate co (CVSS 8.4, IBM Java)
- [CVE-2019-4284](https://cve.now/CVE-2019-4284.md): IBM Cloud Private 2.1.0 , 3.1.0, 3.1.1, and 3.1.2 could allow a local privileged user to obtain sensitive OIDC token that is printed to log (CVSS 4.4, IBM Cloud Private)
- [CVE-2019-4261](https://cve.now/CVE-2019-4261.md): IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulnerable to a denial of service attack caus (CVSS 4.3, IBM MQ)
- [CVE-2016-10775](https://cve.now/CVE-2016-10775.md): cPanel before 60.0.25 allows arbitrary file-chown operations via reassign\_post\_terminate\_cruft (SEC-173). (no CVSS)
- [CVE-2016-10774](https://cve.now/CVE-2016-10774.md): cPanel before 60.0.25 allows self XSS in the tail\_ea4\_migration.cgi interface (SEC-172). (no CVSS)
- [CVE-2016-10773](https://cve.now/CVE-2016-10773.md): cPanel before 60.0.25 allows format-string injection in exception-message handling (SEC-171). (no CVSS)
- [CVE-2016-10772](https://cve.now/CVE-2016-10772.md): cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168). (no CVSS)
- [CVE-2016-10771](https://cve.now/CVE-2016-10771.md): cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165). (no CVSS)
- [CVE-2016-10770](https://cve.now/CVE-2016-10770.md): cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164). (no CVSS)
- [CVE-2016-10769](https://cve.now/CVE-2016-10769.md): cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162). (no CVSS)
- [CVE-2016-10768](https://cve.now/CVE-2016-10768.md): cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161). (no CVSS)
- [CVE-2016-10767](https://cve.now/CVE-2016-10767.md): cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159). (no CVSS)
- [CVE-2017-18482](https://cve.now/CVE-2017-18482.md): cPanel before 62.0.4 allows resellers to use the WHM enqueue\_transfer\_item API for queueing non-rearrange modules (SEC-213). (no CVSS)
- [CVE-2017-18481](https://cve.now/CVE-2017-18481.md): cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211). (no CVSS)
- [CVE-2017-18480](https://cve.now/CVE-2017-18480.md): cPanel before 62.0.4 does not enforce account ownership for has\_mycnf\_for\_cpuser WHM API calls (SEC-210). (no CVSS)
- [CVE-2017-18479](https://cve.now/CVE-2017-18479.md): In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209). (no CVSS)
- [CVE-2017-18478](https://cve.now/CVE-2017-18478.md): In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207). (no CVSS)
- [CVE-2017-18477](https://cve.now/CVE-2017-18477.md): In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206). (no CVSS)
- [CVE-2017-18476](https://cve.now/CVE-2017-18476.md): Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205). (no CVSS)
- [CVE-2017-18475](https://cve.now/CVE-2017-18475.md): In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204). (no CVSS)
- [CVE-2017-18474](https://cve.now/CVE-2017-18474.md): cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201). (no CVSS)
- [CVE-2017-18473](https://cve.now/CVE-2017-18473.md): cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199). (no CVSS)
- [CVE-2017-18472](https://cve.now/CVE-2017-18472.md): cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198). (no CVSS)
- [CVE-2017-18471](https://cve.now/CVE-2017-18471.md): cPanel before 62.0.4 allows self XSS on the paper\_lantern password-change screen (SEC-197). (no CVSS)
- [CVE-2017-18470](https://cve.now/CVE-2017-18470.md): cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196). (no CVSS)
- [CVE-2017-18469](https://cve.now/CVE-2017-18469.md): cPanel before 62.0.17 allows demo accounts to execute code via an NVData\_fetchinc API call (SEC-233). (no CVSS)
- [CVE-2017-18468](https://cve.now/CVE-2017-18468.md): cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232). (no CVSS)
- [CVE-2017-18467](https://cve.now/CVE-2017-18467.md): cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229). (no CVSS)
- [CVE-2017-18465](https://cve.now/CVE-2017-18465.md): cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227). (no CVSS)
- [CVE-2017-18466](https://cve.now/CVE-2017-18466.md): cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228). (no CVSS)
- [CVE-2017-18464](https://cve.now/CVE-2017-18464.md): cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226). (no CVSS)
- [CVE-2017-18462](https://cve.now/CVE-2017-18462.md): cPanel before 62.0.17 allows a CPHulk one-day ban bypass when IP based protection is enabled (SEC-224). (no CVSS)
- [CVE-2019-14521](https://cve.now/CVE-2019-14521.md): The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location o (no CVSS)
- [CVE-2019-14525](https://cve.now/CVE-2019-14525.md): In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to (no CVSS)
- [CVE-2019-14663](https://cve.now/CVE-2019-14663.md): Brandy 1.20.1 has a stack-based buffer overflow in fileio\_openin in fileio.c via crafted BASIC source code. (no CVSS)
- [CVE-2019-14662](https://cve.now/CVE-2019-14662.md): Brandy 1.20.1 has a stack-based buffer overflow in fileio\_openout in fileio.c via crafted BASIC source code. (no CVSS)
- [CVE-2019-14654](https://cve.now/CVE-2019-14654.md): In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inj (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-08-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.