# CVEs published 2019-08-12

47 CVEs were published on August 12, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-14359](https://cve.now/CVE-2019-14359.md): On BC Vault devices, a side channel for the row-based SSD1309 OLED display was found. (no CVSS)
- [CVE-2019-14982](https://cve.now/CVE-2019-14982.md): In Exiv2 before v0.27.2, there is an integer overflow vulnerability in the WebPImage::getHeaderOffset function in webpimage.cpp. (no CVSS)
- [CVE-2019-14981](https://cve.now/CVE-2019-14981.md): In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. (no CVSS)
- [CVE-2019-14980](https://cve.now/CVE-2019-14980.md): In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows a (no CVSS)
- [CVE-2019-13418](https://cve.now/CVE-2019-13418.md): Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized. (no CVSS, floragunn Search Guard)
- [CVE-2019-14976](https://cve.now/CVE-2019-14976.md): iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter. (no CVSS)
- [CVE-2019-13417](https://cve.now/CVE-2019-13417.md): Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not al (no CVSS, floragunn Search Guard)
- [CVE-2019-14969](https://cve.now/CVE-2019-14969.md): Netwrix Auditor before 9.8 has insecure permissions on %PROGRAMDATA%\\Netwrix Auditor\\Logs\\ActiveDirectory\\ and sub-folders. (no CVSS)
- [CVE-2019-14968](https://cve.now/CVE-2019-14968.md): An issue was discovered in imcat 4.9. (no CVSS)
- [CVE-2019-14965](https://cve.now/CVE-2019-14965.md): An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. (no CVSS)
- [CVE-2019-14966](https://cve.now/CVE-2019-14966.md): An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. (no CVSS)
- [CVE-2019-14967](https://cve.now/CVE-2019-14967.md): An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. (no CVSS)
- [CVE-2019-12618](https://cve.now/CVE-2019-12618.md): HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver. (no CVSS, github.com/hashicorp/nomad)
- [CVE-2019-13462](https://cve.now/CVE-2019-13462.md): Lansweeper before 7.1.117.4 allows unauthenticated SQL injection. (no CVSS)
- [CVE-2017-18499](https://cve.now/CVE-2017-18499.md): The simple-membership plugin before 3.5.7 for WordPress has XSS. (no CVSS)
- [CVE-2015-9303](https://cve.now/CVE-2015-9303.md): The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS. (no CVSS)
- [CVE-2017-18500](https://cve.now/CVE-2017-18500.md): The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2017-18501](https://cve.now/CVE-2017-18501.md): The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2017-18502](https://cve.now/CVE-2017-18502.md): The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2017-18503](https://cve.now/CVE-2017-18503.md): The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS. (no CVSS)
- [CVE-2017-18504](https://cve.now/CVE-2017-18504.md): The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF. (no CVSS)
- [CVE-2017-18505](https://cve.now/CVE-2017-18505.md): The twitter-plugin plugin before 2.55 for WordPress has XSS. (no CVSS)
- [CVE-2019-14945](https://cve.now/CVE-2019-14945.md): The ultimate-member plugin before 2.0.54 for WordPress has XSS. (no CVSS)
- [CVE-2019-14946](https://cve.now/CVE-2019-14946.md): The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations. (no CVSS)
- [CVE-2019-14947](https://cve.now/CVE-2019-14947.md): The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade. (no CVSS)
- [CVE-2018-20965](https://cve.now/CVE-2018-20965.md): The ultimate-member plugin before 2.0.4 for WordPress has XSS. (no CVSS)
- [CVE-2016-10872](https://cve.now/CVE-2016-10872.md): The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form. (no CVSS)
- [CVE-2015-9304](https://cve.now/CVE-2015-9304.md): The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input. (no CVSS)
- [CVE-2018-20966](https://cve.now/CVE-2018-20966.md): The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature. (no CVSS)
- [CVE-2019-14951](https://cve.now/CVE-2019-14951.md): The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-forc (no CVSS)
- [CVE-2017-18506](https://cve.now/CVE-2017-18506.md): The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens. (no CVSS)
- [CVE-2019-14948](https://cve.now/CVE-2019-14948.md): The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure. (no CVSS)
- [CVE-2019-14949](https://cve.now/CVE-2019-14949.md): The wp-database-backup plugin before 5.1.2 for WordPress has XSS. (no CVSS)
- [CVE-2016-10873](https://cve.now/CVE-2016-10873.md): The wp-database-backup plugin before 4.3.3 for WordPress has XSS. (no CVSS)
- [CVE-2016-10874](https://cve.now/CVE-2016-10874.md): The wp-database-backup plugin before 4.3.3 for WordPress has CSRF. (no CVSS)
- [CVE-2016-10875](https://cve.now/CVE-2016-10875.md): The wp-database-backup plugin before 4.3.1 for WordPress has XSS. (no CVSS)
- [CVE-2016-10876](https://cve.now/CVE-2016-10876.md): The wp-database-backup plugin before 4.3.1 for WordPress has CSRF. (no CVSS)
- [CVE-2016-10877](https://cve.now/CVE-2016-10877.md): The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2016-10878](https://cve.now/CVE-2016-10878.md): The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS. (no CVSS)
- [CVE-2015-9305](https://cve.now/CVE-2015-9305.md): The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add\_query\_arg() and remove\_query\_arg() functions. (no CVSS)
- [CVE-2019-14950](https://cve.now/CVE-2019-14950.md): The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page. (no CVSS)
- [CVE-2017-18508](https://cve.now/CVE-2017-18508.md): The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS. (no CVSS)
- [CVE-2016-10879](https://cve.now/CVE-2016-10879.md): The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS. (no CVSS)
- [CVE-2015-9306](https://cve.now/CVE-2015-9306.md): The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS. (no CVSS)
- [CVE-2019-14932](https://cve.now/CVE-2019-14932.md): The Recruitment module in Humanica Humatrix 7 1.0.0.681 and 1.0.0.203 allows remote attackers to access all candidates' information on the w (no CVSS)
- [CVE-2019-14940](https://cve.now/CVE-2019-14940.md): In Storage Performance Development Kit (SPDK) before 19.07, a user of a vhost can cause a crash if the target is sent invalid input. (no CVSS)
- [CVE-2019-14939](https://cve.now/CVE-2019-14939.md): An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. (no CVSS, mysql)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-08-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.