CVEs published August 13, 2019
68 CVEs were published on August 13, 2019: 0 critical, 9 high.
- Published
- 68
- Critical
- 0
- High
- 9
- Medium
- 0
- Low
- 0
- Unrated
- 59
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- floragunn Search Guard
- 4
- stdlib · golang.org/x/net
- 2
- Atlassian Jira
- 1
- CROSSCERT UniSign
- 1
- ESTSOFT ALTOOLS Update Service
- 1
- ESTSOFT ALZIP
- 1
- Huawei CloudLink Phone
- 1
- Huawei Hima-AL00B
- 1
- Huawei PC Manager
- 1
- istio.io/istio
- 1
High 9
- CVE-2019-11207TIBCO LogLogic Log Management Intelligence Multiple Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) VulnerabilitiesTIBCO Software TIBCO LogLogic Enterprise Virtual Appliance…
- CVE-2019-9511Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service
- CVE-2019-9512Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of servicestdlib · golang.org/x/net
- CVE-2019-9513Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service
- CVE-2019-9515Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service
- CVE-2019-9516Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service
- CVE-2019-9517Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service
- CVE-2019-9518Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service
- CVE-2019-9514Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of servicestdlib · golang.org/x/net
Medium, low and unrated 59
- CVE-2019-14809net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applicastdlib
- CVE-2019-12479An issue was discovered in 20|20 Storage 2.11.0.
- CVE-2019-5280The SIP TLS module of Huawei CloudLink Phone 7900 with V600R019C10 has a TLS certificate verification vulnerability.Huawei CloudLink Phone
- CVE-2019-5299Huawei mobile phones Hima-AL00Bhave with Versions earlier than HMA-AL00C00B175 have a signature verification bypass vulnerability.Huawei Hima-AL00B
- CVE-2019-5223PCManager 9.1.3.1 has an improper authentication vulnerability.Huawei PC Manager
- CVE-2019-12808ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission.ESTSOFT ALTOOLS Update Service
- CVE-2019-12807Alzip 10.83 and earlier version contains a stack-based buffer overflow vulnerability, caused by improper bounds checking during the parsing ESTSOFT ALZIP
- CVE-2019-14986eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with ac
- CVE-2019-14985eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web i
- CVE-2019-14984eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with ac
- CVE-2019-12806UniSign 2.0.4.0 and earlier version contains a stack-based buffer overflow vulnerability which can overwrite the stack with arbitrary data, CROSSCERT UniSign
- CVE-2019-13415Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to datafloragunn Search Guard
- CVE-2019-13416Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on thefloragunn Search Guard
- CVE-2019-10927A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCASiemens AG SCALANCE SC-600 · Siemens AG SCALANCE XB-200 +4
- CVE-2019-10928A vulnerability has been identified in SCALANCE SC-600 (V2.0).Siemens AG SCALANCE SC-600
- CVE-2019-10929A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl.Siemens SIMATIC CP · Siemens SIMATIC ET 200SP Open Cont… +10
- CVE-2019-10942A vulnerability has been identified in SCALANCE X-200 switch family (incl.Siemens SCALANCE X-200 switch family · Siemens SCALANCE… +1
- CVE-2019-10943A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl.Siemens SIMATIC Drive Controller family · Siemens SIMATI… +5
- CVE-2017-18487The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.
- CVE-2017-18488The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.
- CVE-2016-10866The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.
- CVE-2016-10867The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.
- CVE-2019-14993Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWistio.io/istio
- CVE-2016-10868The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection s
- CVE-2015-9293The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.
- CVE-2015-9294The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.
- CVE-2017-18489The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.
- CVE-2017-18490The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.
- CVE-2017-18491The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.
- CVE-2016-10869The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.
- CVE-2015-9295The contact-form-plugin plugin before 3.96 for WordPress has XSS.
- CVE-2013-7475The contact-form-plugin plugin before 3.52 for WordPress has XSS.
- CVE-2017-18492The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.
- CVE-2018-20963The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.
- CVE-2018-20964The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.
- CVE-2017-18493The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.
- CVE-2017-18494The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.
- CVE-2015-9296The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.
- CVE-2015-9297The events-manager plugin before 5.6 for WordPress has XSS.
- CVE-2015-9298The events-manager plugin before 5.6 for WordPress has code injection.
- CVE-2015-9299The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.
- CVE-2015-9300The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.
- CVE-2016-10870The google-language-translator plugin before 5.0.06 for WordPress has XSS.
- CVE-2017-18495The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.
- CVE-2017-18496The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.
- CVE-2012-6713The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues.
- CVE-2017-18497The liveforms plugin before 3.4.0 for WordPress has XSS.
- CVE-2015-9301The liveforms plugin before 3.2.0 for WordPress has SQL injection.
- CVE-2016-10871The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.
- CVE-2015-9302The simple-fields plugin before 1.4.11 for WordPress has XSS.
- CVE-2017-18498The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.
- CVE-2017-18507The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.
- CVE-2019-8448The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attackers to enumerate usernAtlassian Jira
- CVE-2019-13419Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked.floragunn Search Guard
- CVE-2019-13420Search Guard versions before 21.0 had an timing side channel issue when using the internal user database.floragunn Search Guard
- CVE-2019-14516The mAadhaar application 1.2.7 for Android lacks SSL Certificate Validation, leading to man-in-the-middle attacks against requests for FAQs
- CVE-2019-14530An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter.
- CVE-2017-18509An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11.
- CVE-2019-14987Adive Framework through 2.0.7 is affected by XSS in the Create New Table and Create New Navigation Link functions.