CVEs published August 9, 2019
54 CVEs were published on August 9, 2019: 1 critical, 3 high. 1 is now in CISA KEV.
- Published
- 54
- Critical
- 1
- High
- 3
- Medium
- 3
- Low
- 0
- Unrated
- 47
- Now in CISA KEV
- 1
- Fix available
- 7
Most affected products
- Hewlett Packard Enterprise (HPE) HPE 3PAR Service Processor
- 6
- Hewlett Packard Enterprise (HPE) HPE 3PAR StoreServ Managem…
- 6
- Atlassian Jira
- 2
- Dell Digital Delivery · Dell Alienware Digital Delivery
- 2
- PHP Group PHP
- 2
- Atlassian Jira Server and Data Center
- 1
- Cloud Foundry UAA Release
- 1
- django
- 1
- Hewlett Packard Enterprise (HPE) HP XP7 CVAE
- 1
- NCSOFT NC Launcher2
- 1
Critical 1
High 3
- CVE-2019-3744Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability.Dell Digital Delivery · Dell Alienware Digital Delivery
- CVE-2019-3742Dell/Alienware Digital Delivery versions prior to 3.5.2013 contain a privilege escalation vulnerability.Dell Digital Delivery · Dell Alienware Digital Delivery
- CVE-2019-12805NC Launcher 2 Arbitrary Command Injection VulnerabilityNCSOFT NC Launcher2
Medium, low and unrated 50
- CVE-2019-14807In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/specials/MobileSpecial
- CVE-2019-12261Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4).
- CVE-2019-12260Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4).
- CVE-2019-12258Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component.
- CVE-2018-20826The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missAtlassian Jira
- CVE-2018-20827The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scrAtlassian Jira
- CVE-2019-11042heap-buffer-overflow on exif_process_user_comment in EXIF extensionPHP Group PHP
- CVE-2019-11041heap-buffer-overflow on exif_scan_thumbnail in EXIF extensionPHP Group PHP
- CVE-2019-11274UAA SCIM Filter XSSCloud Foundry UAA Release
- CVE-2019-12255Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4).
- CVE-2019-11776In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter.The Eclipse Foundation Eclipse BIRT
- CVE-2019-14433An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2.nova
- CVE-2019-12265Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component.
- CVE-2019-12263Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4).
- CVE-2019-12259Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component.
- CVE-2019-5498OnCommand Insight versions through 7.3.6 may disclose sensitive account information to an authenticated user.NetApp OnCommand Insight
- CVE-2019-12256Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component.
- CVE-2019-12257Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component.
- CVE-2019-5408Command View Advanced Edition (CVAE) products contain a vulnerability that could expose configuration information of hosts and storage systeHewlett Packard Enterprise (HPE) HP XP7 CVAE
- CVE-2019-5407A remote information disclosure vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3Hewlett Packard Enterprise (HPE) HPE 3PAR StoreServ Managem…
- CVE-2019-5406A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.Hewlett Packard Enterprise (HPE) HPE 3PAR StoreServ Managem…
- CVE-2019-5405A remote authorization bypass vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5Hewlett Packard Enterprise (HPE) HPE 3PAR StoreServ Managem…
- CVE-2019-5404A remote script injection vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1Hewlett Packard Enterprise (HPE) HPE 3PAR StoreServ Managem…
- CVE-2019-5403A remote multiple cross-site scripting vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): priHewlett Packard Enterprise (HPE) HPE 3PAR StoreServ Managem…
- CVE-2019-5402A remote authorization bypass vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5Hewlett Packard Enterprise (HPE) HPE 3PAR StoreServ Managem…
- CVE-2019-5400A remote session reuse vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.Hewlett Packard Enterprise (HPE) HPE 3PAR Service Processor
- CVE-2019-5399A remote gain authorized access vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.Hewlett Packard Enterprise (HPE) HPE 3PAR Service Processor
- CVE-2019-5398A remote multiple multiple cross-site vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.Hewlett Packard Enterprise (HPE) HPE 3PAR Service Processor
- CVE-2019-5397A remote bypass of security restrictions vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.Hewlett Packard Enterprise (HPE) HPE 3PAR Service Processor
- CVE-2019-5396A remote authentication bypass vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.Hewlett Packard Enterprise (HPE) HPE 3PAR Service Processor
- CVE-2019-5395A remote arbitrary file upload vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.Hewlett Packard Enterprise (HPE) HPE 3PAR Service Processor
- CVE-2017-18486Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter.
- CVE-2018-20858Recommender before 2018-07-18 allows XSS.recommender-xblock
- CVE-2019-14806Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same macwerkzeug
- CVE-2019-14805studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing.
- CVE-2019-14804studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing.
- CVE-2019-14794The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders.
- CVE-2019-14791The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.
- CVE-2019-14796The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/
- CVE-2019-14797The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.
- CVE-2019-14798The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/ad
- CVE-2019-14801The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.
- CVE-2019-14785The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_con
- CVE-2016-10865The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus
- CVE-2019-14312Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer.
- CVE-2019-14787The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor c
- CVE-2019-14799The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.
- CVE-2019-14234An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.django
- CVE-2019-14793The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file atta
- CVE-2019-14792The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.