# CVEs published 2019-08-09

54 CVEs were published on August 9, 2019: 1 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-14807](https://cve.now/CVE-2019-14807.md): In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/specials/MobileSpecial (no CVSS)
- [CVE-2019-12261](https://cve.now/CVE-2019-12261.md): Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). (no CVSS)
- [CVE-2019-12260](https://cve.now/CVE-2019-12260.md): Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). (no CVSS)
- [CVE-2019-12258](https://cve.now/CVE-2019-12258.md): Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. (no CVSS)
- [CVE-2018-20826](https://cve.now/CVE-2018-20826.md): The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a miss (no CVSS, Atlassian Jira)
- [CVE-2018-20827](https://cve.now/CVE-2018-20827.md): The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scr (no CVSS, Atlassian Jira)
- [CVE-2019-11581](https://cve.now/CVE-2019-11581.md): There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail a (CVSS 9.8, KEV, Atlassian Jira Server and Data Center)
- [CVE-2019-11042](https://cve.now/CVE-2019-11042.md): heap-buffer-overflow on exif\_process\_user\_comment in EXIF extension (CVSS 4.8, PHP Group PHP)
- [CVE-2019-11041](https://cve.now/CVE-2019-11041.md): heap-buffer-overflow on exif\_scan\_thumbnail in EXIF extension (CVSS 4.8, PHP Group PHP)
- [CVE-2019-11274](https://cve.now/CVE-2019-11274.md): UAA SCIM Filter XSS (CVSS 4.3, Cloud Foundry UAA Release)
- [CVE-2019-12255](https://cve.now/CVE-2019-12255.md): Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). (no CVSS)
- [CVE-2019-3744](https://cve.now/CVE-2019-3744.md): Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. (CVSS 7.8, Dell Digital Delivery · Dell Alienware Digital Delivery)
- [CVE-2019-3742](https://cve.now/CVE-2019-3742.md): Dell/Alienware Digital Delivery versions prior to 3.5.2013 contain a privilege escalation vulnerability. (CVSS 7.8, Dell Digital Delivery · Dell Alienware Digital Delivery)
- [CVE-2019-11776](https://cve.now/CVE-2019-11776.md): In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. (no CVSS, The Eclipse Foundation Eclipse BIRT)
- [CVE-2019-14433](https://cve.now/CVE-2019-14433.md): An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. (no CVSS, nova)
- [CVE-2019-12265](https://cve.now/CVE-2019-12265.md): Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. (no CVSS)
- [CVE-2019-12263](https://cve.now/CVE-2019-12263.md): Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). (no CVSS)
- [CVE-2019-12259](https://cve.now/CVE-2019-12259.md): Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. (no CVSS)
- [CVE-2019-5498](https://cve.now/CVE-2019-5498.md): OnCommand Insight versions through 7.3.6 may disclose sensitive account information to an authenticated user. (no CVSS, NetApp OnCommand Insight)
- [CVE-2019-12256](https://cve.now/CVE-2019-12256.md): Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. (no CVSS)
- [CVE-2019-12257](https://cve.now/CVE-2019-12257.md): Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. (no CVSS)
- [CVE-2019-5408](https://cve.now/CVE-2019-5408.md): Command View Advanced Edition (CVAE) products contain a vulnerability that could expose configuration information of hosts and storage syste (no CVSS, Hewlett Packard Enterprise (HPE) HP XP7 CVAE)
- [CVE-2019-5407](https://cve.now/CVE-2019-5407.md): A remote information disclosure vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3 (no CVSS, Hewlett Packard Enterprise (HPE) HPE 3PAR StoreServ Managem…)
- [CVE-2019-5406](https://cve.now/CVE-2019-5406.md): A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1. (no CVSS, Hewlett Packard Enterprise (HPE) HPE 3PAR StoreServ Managem…)
- [CVE-2019-5405](https://cve.now/CVE-2019-5405.md): A remote authorization bypass vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5 (no CVSS, Hewlett Packard Enterprise (HPE) HPE 3PAR StoreServ Managem…)
- [CVE-2019-5404](https://cve.now/CVE-2019-5404.md): A remote script injection vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1 (no CVSS, Hewlett Packard Enterprise (HPE) HPE 3PAR StoreServ Managem…)
- [CVE-2019-5403](https://cve.now/CVE-2019-5403.md): A remote multiple cross-site scripting vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): pri (no CVSS, Hewlett Packard Enterprise (HPE) HPE 3PAR StoreServ Managem…)
- [CVE-2019-5402](https://cve.now/CVE-2019-5402.md): A remote authorization bypass vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5 (no CVSS, Hewlett Packard Enterprise (HPE) HPE 3PAR StoreServ Managem…)
- [CVE-2019-5400](https://cve.now/CVE-2019-5400.md): A remote session reuse vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. (no CVSS, Hewlett Packard Enterprise (HPE) HPE 3PAR Service Processor)
- [CVE-2019-5399](https://cve.now/CVE-2019-5399.md): A remote gain authorized access vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. (no CVSS, Hewlett Packard Enterprise (HPE) HPE 3PAR Service Processor)
- [CVE-2019-5398](https://cve.now/CVE-2019-5398.md): A remote multiple multiple cross-site vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. (no CVSS, Hewlett Packard Enterprise (HPE) HPE 3PAR Service Processor)
- [CVE-2019-5397](https://cve.now/CVE-2019-5397.md): A remote bypass of security restrictions vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. (no CVSS, Hewlett Packard Enterprise (HPE) HPE 3PAR Service Processor)
- [CVE-2019-5396](https://cve.now/CVE-2019-5396.md): A remote authentication bypass vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. (no CVSS, Hewlett Packard Enterprise (HPE) HPE 3PAR Service Processor)
- [CVE-2019-5395](https://cve.now/CVE-2019-5395.md): A remote arbitrary file upload vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. (no CVSS, Hewlett Packard Enterprise (HPE) HPE 3PAR Service Processor)
- [CVE-2017-18486](https://cve.now/CVE-2017-18486.md): Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. (no CVSS)
- [CVE-2019-12805](https://cve.now/CVE-2019-12805.md): NC Launcher 2 Arbitrary Command Injection Vulnerability (CVSS 8.8, NCSOFT NC Launcher2)
- [CVE-2018-20858](https://cve.now/CVE-2018-20858.md): Recommender before 2018-07-18 allows XSS. (no CVSS, recommender-xblock)
- [CVE-2019-14806](https://cve.now/CVE-2019-14806.md): Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same mac (no CVSS, werkzeug)
- [CVE-2019-14805](https://cve.now/CVE-2019-14805.md): studio/builder\_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing. (no CVSS)
- [CVE-2019-14804](https://cve.now/CVE-2019-14804.md): studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing. (no CVSS)
- [CVE-2019-14794](https://cve.now/CVE-2019-14794.md): The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders. (no CVSS)
- [CVE-2019-14791](https://cve.now/CVE-2019-14791.md): The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter. (no CVSS)
- [CVE-2019-14796](https://cve.now/CVE-2019-14796.md): The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/ (no CVSS)
- [CVE-2019-14797](https://cve.now/CVE-2019-14797.md): The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS. (no CVSS)
- [CVE-2019-14798](https://cve.now/CVE-2019-14798.md): The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/ad (no CVSS)
- [CVE-2019-14801](https://cve.now/CVE-2019-14801.md): The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection. (no CVSS)
- [CVE-2019-14785](https://cve.now/CVE-2019-14785.md): The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp\_con (no CVSS)
- [CVE-2016-10865](https://cve.now/CVE-2016-10865.md): The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus (no CVSS)
- [CVE-2019-14312](https://cve.now/CVE-2019-14312.md): Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. (no CVSS)
- [CVE-2019-14787](https://cve.now/CVE-2019-14787.md): The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters\_load\_new\_editor c (no CVSS)
- [CVE-2019-14799](https://cve.now/CVE-2019-14799.md): The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS. (no CVSS)
- [CVE-2019-14234](https://cve.now/CVE-2019-14234.md): An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. (no CVSS, django)
- [CVE-2019-14793](https://cve.now/CVE-2019-14793.md): The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb\_delete\_file atta (no CVSS)
- [CVE-2019-14792](https://cve.now/CVE-2019-14792.md): The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle\_name or rectangle\_opacity parameter. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-08-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.