# CVEs published 2019-08-07

76 CVEs were published on August 7, 2019: 3 critical, 10 high. Days are UTC.

- [CVE-2019-14763](https://cve.now/CVE-2019-14763.md): In the Linux kernel before 4.16.4, a double-locking error in drivers/usb/dwc3/gadget.c may potentially cause a deadlock with f\_hid. (no CVSS)
- [CVE-2019-1945](https://cve.now/CVE-2019-1945.md): Cisco Adaptive Security Appliance Smart Tunnel Vulnerabilities (CVSS 6.7, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-1928](https://cve.now/CVE-2019-1928.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player)
- [CVE-2019-1929](https://cve.now/CVE-2019-1929.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player)
- [CVE-2019-1934](https://cve.now/CVE-2019-1934.md): Cisco Adaptive Security Appliance Software Web-Based Management Interface Privilege Escalation Vulnerability (CVSS 8.8, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-1944](https://cve.now/CVE-2019-1944.md): Cisco Adaptive Security Appliance Smart Tunnel Vulnerabilities (CVSS 6.7, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2019-1926](https://cve.now/CVE-2019-1926.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player)
- [CVE-2019-1927](https://cve.now/CVE-2019-1927.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player)
- [CVE-2019-1918](https://cve.now/CVE-2019-1918.md): Cisco IOS XR Software Intermediate System–to–Intermediate System Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XR Software)
- [CVE-2019-1924](https://cve.now/CVE-2019-1924.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player)
- [CVE-2019-1925](https://cve.now/CVE-2019-1925.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player)
- [CVE-2019-1910](https://cve.now/CVE-2019-1910.md): Cisco IOS XR Software Intermediate System to Intermediate System Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XR Software)
- [CVE-2019-1895](https://cve.now/CVE-2019-1895.md): Cisco Enterprise NFV Infrastructure Software VNC Authentication Bypass Vulnerability (CVSS 9.8, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2019-14474](https://cve.now/CVE-2019-14474.md): eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic process, resulting in the abilit (no CVSS)
- [CVE-2019-14537](https://cve.now/CVE-2019-14537.md): YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass. (no CVSS, yourls/yourls)
- [CVE-2019-14748](https://cve.now/CVE-2019-14748.md): An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. (no CVSS)
- [CVE-2019-14749](https://cve.now/CVE-2019-14749.md): An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. (no CVSS)
- [CVE-2019-14750](https://cve.now/CVE-2019-14750.md): An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. (no CVSS)
- [CVE-2019-11653](https://cve.now/CVE-2019-11653.md): Remote Access Control Bypass in Micro Focus Content Manager. (no CVSS, Micro Focus Content Manager)
- [CVE-2019-5476](https://cve.now/CVE-2019-5476.md): An SQL Injection in the Nextcloud Lookup-Server \< v0.3.0 (running on https://lookup.nextcloud.com) caused unauthenticated users to be able t (no CVSS, lookup.nextcloud.com)
- [CVE-2019-10099](https://cve.now/CVE-2019-10099.md): Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. (no CVSS, Apache Spark · org.apache.spark:spark-core\_2.11 +1)
- [CVE-2016-5431](https://cve.now/CVE-2016-5431.md): The PHP JOSE Library by Gree Inc. (no CVSS, jose-php · gree/jose)
- [CVE-2019-14747](https://cve.now/CVE-2019-14747.md): DWSurvey through 2019-07-22 has stored XSS via the design/my-survey-design!copySurvey.action surveyName parameter. (no CVSS)
- [CVE-2019-14746](https://cve.now/CVE-2019-14746.md): A issue was discovered in KuaiFanCMS 5.0. (no CVSS)
- [CVE-2019-14745](https://cve.now/CVE-2019-14745.md): In radare2 before 3.7.0, a command injection vulnerability exists in bin\_symbols() in libr/core/cbin.c. (no CVSS)
- [CVE-2019-14432](https://cve.now/CVE-2019-14432.md): Incorrect authentication of application WebSocket connections in Loom Desktop for Mac up to 0.16.0 allows remote code execution from either (no CVSS)
- [CVE-2018-20961](https://cve.now/CVE-2018-20961.md): In the Linux kernel before 4.16.4, a double free vulnerability in the f\_midi\_set\_alt function of drivers/usb/gadget/function/f\_midi.c in the (no CVSS)
- [CVE-2019-14744](https://cve.now/CVE-2019-14744.md): In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interactio (no CVSS)
- [CVE-2019-10387](https://cve.now/CVE-2019-10387.md): A missing permission check in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users with (no CVSS, Jenkins project Jenkins XL TestView Plugin · com.xebialabs.…)
- [CVE-2019-10388](https://cve.now/CVE-2019-10388.md): A cross-site request forgery vulnerability in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to hav (no CVSS, Jenkins project Jenkins Relution Enterprise Appstore Publis…)
- [CVE-2019-10389](https://cve.now/CVE-2019-10389.md): A missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initia (no CVSS, Jenkins project Jenkins Relution Enterprise Appstore Publis…)
- [CVE-2019-10371](https://cve.now/CVE-2019-10371.md): A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized att (no CVSS, Jenkins project Jenkins Gitlab Authentication Plugin · org.…)
- [CVE-2019-10372](https://cve.now/CVE-2019-10372.md): An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redir (no CVSS, Jenkins project Jenkins Gitlab Authentication Plugin · org.…)
- [CVE-2019-10373](https://cve.now/CVE-2019-10373.md): A stored cross-site scripting vulnerability in Jenkins Build Pipeline Plugin 1.5.8 and earlier allows attackers able to edit the build pipel (no CVSS, Jenkins project Jenkins Build Pipeline Plugin · org.jenkins…)
- [CVE-2019-10374](https://cve.now/CVE-2019-10374.md): A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions a (no CVSS, Jenkins project Jenkins PegDown Formatter Plugin · org.jenk…)
- [CVE-2019-10375](https://cve.now/CVE-2019-10375.md): An arbitrary file read vulnerability in Jenkins File System SCM Plugin 2.1 and earlier allows attackers able to configure jobs in Jenkins to (no CVSS, Jenkins project Jenkins File System SCM Plugin · hudson.plu…)
- [CVE-2019-10376](https://cve.now/CVE-2019-10376.md): A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML a (no CVSS, Jenkins project Jenkins Wall Display Plugin · org.jenkins-c…)
- [CVE-2019-10377](https://cve.now/CVE-2019-10377.md): A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any us (no CVSS, Jenkins project Jenkins Avatar Plugin · net.hurstfrost.jenk…)
- [CVE-2019-10378](https://cve.now/CVE-2019-10378.md): Jenkins TestLink Plugin 3.16 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they ca (no CVSS, Jenkins project Jenkins TestLink Plugin · org.jenkins-ci.pl…)
- [CVE-2019-10379](https://cve.now/CVE-2019-10379.md): Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the Je (no CVSS, Jenkins project Jenkins Google Cloud Messaging Notification…)
- [CVE-2019-10380](https://cve.now/CVE-2019-10380.md): Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attac (no CVSS, Jenkins project Jenkins Simple Travis Pipeline Runner Plugi…)
- [CVE-2019-10381](https://cve.now/CVE-2019-10381.md): Jenkins Codefresh Integration Plugin 1.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM. (no CVSS, Jenkins project Jenkins Codefresh Integration Plugin · org.…)
- [CVE-2019-10382](https://cve.now/CVE-2019-10382.md): Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM. (no CVSS, Jenkins project Jenkins VMware Lab Manager Slaves Plugin ·…)
- [CVE-2019-10385](https://cve.now/CVE-2019-10385.md): Jenkins eggPlant Plugin 2.2 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewe (no CVSS, Jenkins project Jenkins eggPlant Plugin · org.jenkins-ci.pl…)
- [CVE-2019-10386](https://cve.now/CVE-2019-10386.md): A cross-site request forgery vulnerability in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection a (no CVSS, Jenkins project Jenkins XL TestView Plugin · com.xebialabs.…)
- [CVE-2019-10367](https://cve.now/CVE-2019-10367.md): Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some val (no CVSS, Jenkins project Jenkins Configuration as Code Plugin · io.j…)
- [CVE-2019-10368](https://cve.now/CVE-2019-10368.md): A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection an (no CVSS, Jenkins project Jenkins JClouds Plugin · org.jenkins-ci.plu…)
- [CVE-2019-10369](https://cve.now/CVE-2019-10369.md): A missing permission check in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.D (no CVSS, Jenkins project Jenkins JClouds Plugin · org.jenkins-ci.plu…)
- [CVE-2019-10370](https://cve.now/CVE-2019-10370.md): Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, po (no CVSS, Jenkins project Jenkins Mask Passwords Plugin · org.jenkins…)
- [CVE-2018-14383](https://cve.now/CVE-2018-14383.md): The Transition Technologies "The Scheduler" app 5.1.3 for Jira allows XXE due to a weakly configured/parameterized XML parser. (no CVSS)
- [CVE-2019-14743](https://cve.now/CVE-2019-14743.md): In Valve Steam Client for Windows through 2019-08-07, HKLM\\SOFTWARE\\Wow6432Node\\Valve\\Steam has explicit "Full control" for the Users group, (no CVSS)
- [CVE-2018-20959](https://cve.now/CVE-2018-20959.md): Jura E8 devices lack Bluetooth connection security. (no CVSS)
- [CVE-2018-20958](https://cve.now/CVE-2018-20958.md): The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however, t (no CVSS)
- [CVE-2017-18483](https://cve.now/CVE-2017-18483.md): ANNKE SP1 HD wireless camera 3.4.1.1604071109 devices allow XSS via a crafted SSID. (no CVSS)
- [CVE-2016-10861](https://cve.now/CVE-2016-10861.md): Neet AirStream NAS1.1 devices allow CSRF attacks that cause the settings binary to change the AP name and password. (no CVSS)
- [CVE-2016-10812](https://cve.now/CVE-2016-10812.md): In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117). (no CVSS)
- [CVE-2016-10811](https://cve.now/CVE-2016-10811.md): In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116). (no CVSS)
- [CVE-2016-10810](https://cve.now/CVE-2016-10810.md): In cPanel before 57.9999.54, /scripts/maildir\_converter exposed a TTY to an unprivileged process (SEC-115). (no CVSS)
- [CVE-2016-10809](https://cve.now/CVE-2016-10809.md): In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114). (no CVSS)
- [CVE-2016-10808](https://cve.now/CVE-2016-10808.md): In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113). (no CVSS)
- [CVE-2016-10807](https://cve.now/CVE-2016-10807.md): cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112). (no CVSS)
- [CVE-2016-10806](https://cve.now/CVE-2016-10806.md): cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110). (no CVSS)
- [CVE-2016-10805](https://cve.now/CVE-2016-10805.md): cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax\_maketext\_syntax\_util.pl (SEC-109). (no CVSS)
- [CVE-2016-10804](https://cve.now/CVE-2016-10804.md): The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58). (no CVSS)
- [CVE-2016-10803](https://cve.now/CVE-2016-10803.md): cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923). (no CVSS)
- [CVE-2016-10802](https://cve.now/CVE-2016-10802.md): cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142). (no CVSS)
- [CVE-2016-10801](https://cve.now/CVE-2016-10801.md): cPanel before 58.0.4 has improper session handling for shared users (SEC-139). (no CVSS)
- [CVE-2016-10800](https://cve.now/CVE-2016-10800.md): cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138). (no CVSS)
- [CVE-2016-10799](https://cve.now/CVE-2016-10799.md): cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137). (no CVSS)
- [CVE-2016-10798](https://cve.now/CVE-2016-10798.md): cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134). (no CVSS)
- [CVE-2019-1913](https://cve.now/CVE-2019-1913.md): Cisco Small Business 220 Series Smart Switches Remote Code Execution Vulnerabilities (CVSS 9.8, Cisco Small Business 220 Series Smart Plus Switches)
- [CVE-2019-1914](https://cve.now/CVE-2019-1914.md): Cisco Small Business 220 Series Smart Switches Command Injection Vulnerability (CVSS 7.2, Cisco Small Business 220 Series Smart Plus Switches)
- [CVE-2019-1912](https://cve.now/CVE-2019-1912.md): Cisco Small Business 220 Series Smart Switches Authentication Bypass Vulnerability (CVSS 9.1, Cisco Small Business 220 Series Smart Plus Switches)
- [CVE-2019-14732](https://cve.now/CVE-2019-14732.md): AdPlug 2.3.1 has multiple heap-based buffer overflows in Ca2mLoader::load() in a2m.cpp. (no CVSS)
- [CVE-2019-14733](https://cve.now/CVE-2019-14733.md): AdPlug 2.3.1 has multiple heap-based buffer overflows in CradLoader::load() in rad.cpp. (no CVSS)
- [CVE-2019-14734](https://cve.now/CVE-2019-14734.md): AdPlug 2.3.1 has multiple heap-based buffer overflows in CmtkLoader::load() in mtk.cpp. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-08-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.