# CVEs published 2019-08-13

68 CVEs were published on August 13, 2019: 0 critical, 9 high. Days are UTC.

- [CVE-2019-11207](https://cve.now/CVE-2019-11207.md): TIBCO LogLogic Log Management Intelligence Multiple Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) Vulnerabilities (CVSS 8.8, TIBCO Software TIBCO LogLogic Enterprise Virtual Appliance…)
- [CVE-2019-14809](https://cve.now/CVE-2019-14809.md): net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applica (no CVSS, stdlib)
- [CVE-2019-9511](https://cve.now/CVE-2019-9511.md): Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (CVSS 7.5)
- [CVE-2019-9512](https://cve.now/CVE-2019-9512.md): Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service (CVSS 7.5, stdlib · golang.org/x/net)
- [CVE-2019-9513](https://cve.now/CVE-2019-9513.md): Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service (CVSS 7.5)
- [CVE-2019-9515](https://cve.now/CVE-2019-9515.md): Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service (CVSS 7.5)
- [CVE-2019-9516](https://cve.now/CVE-2019-9516.md): Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service (CVSS 7.5)
- [CVE-2019-9517](https://cve.now/CVE-2019-9517.md): Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service (CVSS 7.5)
- [CVE-2019-9518](https://cve.now/CVE-2019-9518.md): Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service (CVSS 7.5)
- [CVE-2019-12479](https://cve.now/CVE-2019-12479.md): An issue was discovered in 20|20 Storage 2.11.0. (no CVSS)
- [CVE-2019-5280](https://cve.now/CVE-2019-5280.md): The SIP TLS module of Huawei CloudLink Phone 7900 with V600R019C10 has a TLS certificate verification vulnerability. (no CVSS, Huawei CloudLink Phone)
- [CVE-2019-5299](https://cve.now/CVE-2019-5299.md): Huawei mobile phones Hima-AL00Bhave with Versions earlier than HMA-AL00C00B175 have a signature verification bypass vulnerability. (no CVSS, Huawei Hima-AL00B)
- [CVE-2019-5223](https://cve.now/CVE-2019-5223.md): PCManager 9.1.3.1 has an improper authentication vulnerability. (no CVSS, Huawei PC Manager)
- [CVE-2019-12808](https://cve.now/CVE-2019-12808.md): ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. (no CVSS, ESTSOFT ALTOOLS Update Service)
- [CVE-2019-12807](https://cve.now/CVE-2019-12807.md): Alzip 10.83 and earlier version contains a stack-based buffer overflow vulnerability, caused by improper bounds checking during the parsing (no CVSS, ESTSOFT ALZIP)
- [CVE-2019-14986](https://cve.now/CVE-2019-14986.md): eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with ac (no CVSS)
- [CVE-2019-14985](https://cve.now/CVE-2019-14985.md): eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web i (no CVSS)
- [CVE-2019-14984](https://cve.now/CVE-2019-14984.md): eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with ac (no CVSS)
- [CVE-2019-12806](https://cve.now/CVE-2019-12806.md): UniSign 2.0.4.0 and earlier version contains a stack-based buffer overflow vulnerability which can overwrite the stack with arbitrary data, (no CVSS, CROSSCERT UniSign)
- [CVE-2019-13415](https://cve.now/CVE-2019-13415.md): Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data (no CVSS, floragunn Search Guard)
- [CVE-2019-13416](https://cve.now/CVE-2019-13416.md): Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the (no CVSS, floragunn Search Guard)
- [CVE-2019-10927](https://cve.now/CVE-2019-10927.md): A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCA (no CVSS, Siemens AG SCALANCE SC-600 · Siemens AG SCALANCE XB-200 +4)
- [CVE-2019-10928](https://cve.now/CVE-2019-10928.md): A vulnerability has been identified in SCALANCE SC-600 (V2.0). (no CVSS, Siemens AG SCALANCE SC-600)
- [CVE-2019-10929](https://cve.now/CVE-2019-10929.md): A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. (no CVSS, Siemens SIMATIC CP · Siemens SIMATIC ET 200SP Open Cont… +10)
- [CVE-2019-10942](https://cve.now/CVE-2019-10942.md): A vulnerability has been identified in SCALANCE X-200 switch family (incl. (no CVSS, Siemens SCALANCE X-200 switch family · Siemens SCALANCE… +1)
- [CVE-2019-10943](https://cve.now/CVE-2019-10943.md): A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. (no CVSS, Siemens SIMATIC Drive Controller family · Siemens SIMATI… +5)
- [CVE-2017-18487](https://cve.now/CVE-2017-18487.md): The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2017-18488](https://cve.now/CVE-2017-18488.md): The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2016-10866](https://cve.now/CVE-2016-10866.md): The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2016-10867](https://cve.now/CVE-2016-10867.md): The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages. (no CVSS)
- [CVE-2019-14993](https://cve.now/CVE-2019-14993.md): Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JW (no CVSS, istio.io/istio)
- [CVE-2016-10868](https://cve.now/CVE-2016-10868.md): The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection s (no CVSS)
- [CVE-2015-9293](https://cve.now/CVE-2015-9293.md): The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature. (no CVSS)
- [CVE-2015-9294](https://cve.now/CVE-2015-9294.md): The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add\_query\_arg and remove\_query\_arg function instances. (no CVSS)
- [CVE-2017-18489](https://cve.now/CVE-2017-18489.md): The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS. (no CVSS)
- [CVE-2017-18490](https://cve.now/CVE-2017-18490.md): The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2017-18491](https://cve.now/CVE-2017-18491.md): The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2016-10869](https://cve.now/CVE-2016-10869.md): The contact-form-plugin plugin before 4.0.2 for WordPress has XSS. (no CVSS)
- [CVE-2015-9295](https://cve.now/CVE-2015-9295.md): The contact-form-plugin plugin before 3.96 for WordPress has XSS. (no CVSS)
- [CVE-2013-7475](https://cve.now/CVE-2013-7475.md): The contact-form-plugin plugin before 3.52 for WordPress has XSS. (no CVSS)
- [CVE-2017-18492](https://cve.now/CVE-2017-18492.md): The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2018-20963](https://cve.now/CVE-2018-20963.md): The contact-form-to-email plugin before 1.2.66 for WordPress has XSS. (no CVSS)
- [CVE-2018-20964](https://cve.now/CVE-2018-20964.md): The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF. (no CVSS)
- [CVE-2017-18493](https://cve.now/CVE-2017-18493.md): The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2017-18494](https://cve.now/CVE-2017-18494.md): The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2015-9296](https://cve.now/CVE-2015-9296.md): The download-monitor plugin before 1.7.1 for WordPress has XSS related to add\_query\_arg. (no CVSS)
- [CVE-2015-9297](https://cve.now/CVE-2015-9297.md): The events-manager plugin before 5.6 for WordPress has XSS. (no CVSS)
- [CVE-2015-9298](https://cve.now/CVE-2015-9298.md): The events-manager plugin before 5.6 for WordPress has code injection. (no CVSS)
- [CVE-2015-9299](https://cve.now/CVE-2015-9299.md): The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS. (no CVSS)
- [CVE-2015-9300](https://cve.now/CVE-2015-9300.md): The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2016-10870](https://cve.now/CVE-2016-10870.md): The google-language-translator plugin before 5.0.06 for WordPress has XSS. (no CVSS)
- [CVE-2017-18495](https://cve.now/CVE-2017-18495.md): The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS. (no CVSS)
- [CVE-2017-18496](https://cve.now/CVE-2017-18496.md): The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2012-6713](https://cve.now/CVE-2012-6713.md): The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2017-18497](https://cve.now/CVE-2017-18497.md): The liveforms plugin before 3.4.0 for WordPress has XSS. (no CVSS)
- [CVE-2015-9301](https://cve.now/CVE-2015-9301.md): The liveforms plugin before 3.2.0 for WordPress has SQL injection. (no CVSS)
- [CVE-2016-10871](https://cve.now/CVE-2016-10871.md): The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page. (no CVSS)
- [CVE-2015-9302](https://cve.now/CVE-2015-9302.md): The simple-fields plugin before 1.4.11 for WordPress has XSS. (no CVSS)
- [CVE-2017-18498](https://cve.now/CVE-2017-18498.md): The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search. (no CVSS)
- [CVE-2017-18507](https://cve.now/CVE-2017-18507.md): The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS. (no CVSS)
- [CVE-2019-8448](https://cve.now/CVE-2019-8448.md): The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attackers to enumerate usern (no CVSS, Atlassian Jira)
- [CVE-2019-13419](https://cve.now/CVE-2019-13419.md): Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked. (no CVSS, floragunn Search Guard)
- [CVE-2019-13420](https://cve.now/CVE-2019-13420.md): Search Guard versions before 21.0 had an timing side channel issue when using the internal user database. (no CVSS, floragunn Search Guard)
- [CVE-2019-14516](https://cve.now/CVE-2019-14516.md): The mAadhaar application 1.2.7 for Android lacks SSL Certificate Validation, leading to man-in-the-middle attacks against requests for FAQs (no CVSS)
- [CVE-2019-14530](https://cve.now/CVE-2019-14530.md): An issue was discovered in custom/ajax\_download.php in OpenEMR before 5.0.2 via the fileName parameter. (no CVSS)
- [CVE-2017-18509](https://cve.now/CVE-2017-18509.md): An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. (no CVSS)
- [CVE-2019-14987](https://cve.now/CVE-2019-14987.md): Adive Framework through 2.0.7 is affected by XSS in the Create New Table and Create New Navigation Link functions. (no CVSS)
- [CVE-2019-9514](https://cve.now/CVE-2019-9514.md): Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service (CVSS 7.5, stdlib · golang.org/x/net)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-08-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.