CVEs published August 7, 2019
76 CVEs were published on August 7, 2019: 3 critical, 10 high.
- Published
- 76
- Critical
- 3
- High
- 10
- Medium
- 2
- Low
- 0
- Unrated
- 61
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- Cisco WebEx WRF Player
- 6
- Cisco Adaptive Security Appliance (ASA) Software
- 3
- Cisco Small Business 220 Series Smart Plus Switches
- 3
- Cisco IOS XR Software
- 2
- Jenkins project Jenkins Gitlab Authentication Plugin · org.…
- 2
- Jenkins project Jenkins JClouds Plugin · org.jenkins-ci.plu…
- 2
- Jenkins project Jenkins Relution Enterprise Appstore Publis…
- 2
- Jenkins project Jenkins XL TestView Plugin · com.xebialabs.…
- 2
- Apache Spark · org.apache.spark:spark-core_2.11 +1
- 1
- Cisco Enterprise NFV Infrastructure Software
- 1
Critical 3
- CVE-2019-1895Cisco Enterprise NFV Infrastructure Software VNC Authentication Bypass VulnerabilityCisco Enterprise NFV Infrastructure Software
- CVE-2019-1913Cisco Small Business 220 Series Smart Switches Remote Code Execution VulnerabilitiesCisco Small Business 220 Series Smart Plus Switches
- CVE-2019-1912Cisco Small Business 220 Series Smart Switches Authentication Bypass VulnerabilityCisco Small Business 220 Series Smart Plus Switches
High 10
- CVE-2019-1928Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesCisco WebEx WRF Player
- CVE-2019-1929Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesCisco WebEx WRF Player
- CVE-2019-1934Cisco Adaptive Security Appliance Software Web-Based Management Interface Privilege Escalation VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2019-1926Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesCisco WebEx WRF Player
- CVE-2019-1927Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesCisco WebEx WRF Player
- CVE-2019-1918Cisco IOS XR Software Intermediate System–to–Intermediate System Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2019-1924Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesCisco WebEx WRF Player
- CVE-2019-1925Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesCisco WebEx WRF Player
- CVE-2019-1910Cisco IOS XR Software Intermediate System to Intermediate System Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2019-1914Cisco Small Business 220 Series Smart Switches Command Injection VulnerabilityCisco Small Business 220 Series Smart Plus Switches
Medium, low and unrated 63
- CVE-2019-14763In the Linux kernel before 4.16.4, a double-locking error in drivers/usb/dwc3/gadget.c may potentially cause a deadlock with f_hid.
- CVE-2019-1945Cisco Adaptive Security Appliance Smart Tunnel VulnerabilitiesCisco Adaptive Security Appliance (ASA) Software
- CVE-2019-1944Cisco Adaptive Security Appliance Smart Tunnel VulnerabilitiesCisco Adaptive Security Appliance (ASA) Software
- CVE-2019-14474eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic process, resulting in the abilit
- CVE-2019-14537YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.yourls/yourls
- CVE-2019-14748An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.
- CVE-2019-14749An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.
- CVE-2019-14750An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.
- CVE-2019-11653Remote Access Control Bypass in Micro Focus Content Manager.Micro Focus Content Manager
- CVE-2019-5476An SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (running on https://lookup.nextcloud.com) caused unauthenticated users to be able tlookup.nextcloud.com
- CVE-2019-10099Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true.Apache Spark · org.apache.spark:spark-core_2.11 +1
- CVE-2016-5431The PHP JOSE Library by Gree Inc.jose-php · gree/jose
- CVE-2019-14747DWSurvey through 2019-07-22 has stored XSS via the design/my-survey-design!copySurvey.action surveyName parameter.
- CVE-2019-14746A issue was discovered in KuaiFanCMS 5.0.
- CVE-2019-14745In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c.
- CVE-2019-14432Incorrect authentication of application WebSocket connections in Loom Desktop for Mac up to 0.16.0 allows remote code execution from either
- CVE-2018-20961In the Linux kernel before 4.16.4, a double free vulnerability in the f_midi_set_alt function of drivers/usb/gadget/function/f_midi.c in the
- CVE-2019-14744In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interactio
- CVE-2019-10387A missing permission check in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users withJenkins project Jenkins XL TestView Plugin · com.xebialabs.…
- CVE-2019-10388A cross-site request forgery vulnerability in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to havJenkins project Jenkins Relution Enterprise Appstore Publis…
- CVE-2019-10389A missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiaJenkins project Jenkins Relution Enterprise Appstore Publis…
- CVE-2019-10371A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attJenkins project Jenkins Gitlab Authentication Plugin · org.…
- CVE-2019-10372An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirJenkins project Jenkins Gitlab Authentication Plugin · org.…
- CVE-2019-10373A stored cross-site scripting vulnerability in Jenkins Build Pipeline Plugin 1.5.8 and earlier allows attackers able to edit the build pipelJenkins project Jenkins Build Pipeline Plugin · org.jenkins…
- CVE-2019-10374A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions aJenkins project Jenkins PegDown Formatter Plugin · org.jenk…
- CVE-2019-10375An arbitrary file read vulnerability in Jenkins File System SCM Plugin 2.1 and earlier allows attackers able to configure jobs in Jenkins toJenkins project Jenkins File System SCM Plugin · hudson.plu…
- CVE-2019-10376A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML aJenkins project Jenkins Wall Display Plugin · org.jenkins-c…
- CVE-2019-10377A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any usJenkins project Jenkins Avatar Plugin · net.hurstfrost.jenk…
- CVE-2019-10378Jenkins TestLink Plugin 3.16 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they caJenkins project Jenkins TestLink Plugin · org.jenkins-ci.pl…
- CVE-2019-10379Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the JeJenkins project Jenkins Google Cloud Messaging Notification…
- CVE-2019-10380Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attacJenkins project Jenkins Simple Travis Pipeline Runner Plugi…
- CVE-2019-10381Jenkins Codefresh Integration Plugin 1.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM.Jenkins project Jenkins Codefresh Integration Plugin · org.…
- CVE-2019-10382Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM.Jenkins project Jenkins VMware Lab Manager Slaves Plugin ·…
- CVE-2019-10385Jenkins eggPlant Plugin 2.2 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be vieweJenkins project Jenkins eggPlant Plugin · org.jenkins-ci.pl…
- CVE-2019-10386A cross-site request forgery vulnerability in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection aJenkins project Jenkins XL TestView Plugin · com.xebialabs.…
- CVE-2019-10367Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some valJenkins project Jenkins Configuration as Code Plugin · io.j…
- CVE-2019-10368A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection anJenkins project Jenkins JClouds Plugin · org.jenkins-ci.plu…
- CVE-2019-10369A missing permission check in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DJenkins project Jenkins JClouds Plugin · org.jenkins-ci.plu…
- CVE-2019-10370Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, poJenkins project Jenkins Mask Passwords Plugin · org.jenkins…
- CVE-2018-14383The Transition Technologies "The Scheduler" app 5.1.3 for Jira allows XXE due to a weakly configured/parameterized XML parser.
- CVE-2019-14743In Valve Steam Client for Windows through 2019-08-07, HKLM\SOFTWARE\Wow6432Node\Valve\Steam has explicit "Full control" for the Users group,
- CVE-2018-20959Jura E8 devices lack Bluetooth connection security.
- CVE-2018-20958The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however, t
- CVE-2017-18483ANNKE SP1 HD wireless camera 3.4.1.1604071109 devices allow XSS via a crafted SSID.
- CVE-2016-10861Neet AirStream NAS1.1 devices allow CSRF attacks that cause the settings binary to change the AP name and password.
- CVE-2016-10812In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117).
- CVE-2016-10811In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116).
- CVE-2016-10810In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115).
- CVE-2016-10809In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114).
- CVE-2016-10808In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113).
- CVE-2016-10807cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112).
- CVE-2016-10806cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110).
- CVE-2016-10805cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109).
- CVE-2016-10804The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58).
- CVE-2016-10803cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923).
- CVE-2016-10802cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142).
- CVE-2016-10801cPanel before 58.0.4 has improper session handling for shared users (SEC-139).
- CVE-2016-10800cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138).
- CVE-2016-10799cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137).
- CVE-2016-10798cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134).
- CVE-2019-14732AdPlug 2.3.1 has multiple heap-based buffer overflows in Ca2mLoader::load() in a2m.cpp.
- CVE-2019-14733AdPlug 2.3.1 has multiple heap-based buffer overflows in CradLoader::load() in rad.cpp.
- CVE-2019-14734AdPlug 2.3.1 has multiple heap-based buffer overflows in CmtkLoader::load() in mtk.cpp.