CVEs published August 14, 2019
173 CVEs were published on August 14, 2019: 10 critical, 43 high. 1 is now in CISA KEV.
- Published
- 173
- Critical
- 10
- High
- 43
- Medium
- 32
- Low
- 0
- Unrated
- 88
- Now in CISA KEV
- 1
- Fix available
- 30
Most affected products
- Microsoft Windows
- 54
- Microsoft ChakraCore · Microsoft Edge +1
- 7
- SAP SE SAP BusinessObjects Business Intelligence Platform
- 5
- Microsoft Windows · Microsoft Office 2019 for Mac
- 4
- McAfee Web Gateway
- 2
- Microsoft Internet Explorer
- 2
- Microsoft Internet Explorer · Microsoft Edge
- 2
- Microsoft Office · Microsoft Outlook
- 2
- Microsoft SharePoint Enterprise Server · Microsoft Share… +2
- 2
- Microsoft Windows · Microsoft Remote Desktop for Android +2
- 2
Critical 10
- CVE-2019-1205Microsoft Word Remote Code Execution VulnerabilityMicrosoft SharePoint Server · Microsoft Office
- CVE-2019-1212Windows DHCP Server Denial of Service VulnerabilityMicrosoft Windows
- CVE-2019-1213Windows DHCP Server Remote Code Execution VulnerabilityMicrosoft Windows Server 2008 Service Pack · Microsoft Wind…
- CVE-2019-1222Remote Desktop Services Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2019-1226Remote Desktop Services Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2019-1181Remote Desktop Services Remote Code Execution VulnerabilityMicrosoft Windows · Microsoft Remote Desktop for Android +2
- CVE-2019-1182Remote Desktop Services Remote Code Execution VulnerabilityMicrosoft Windows · Microsoft Remote Desktop for Android +2
- CVE-2019-0736Windows DHCP Client Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2019-15052The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host.
- CVE-2019-0344Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possiSAP SE SAP Commerce Cloud
High 43
- CVE-2019-1206Windows DHCP Server Denial of Service VulnerabilityMicrosoft Windows Server, · Microsoft Windows Server
- CVE-2019-1223Windows Remote Desktop Protocol (RDP) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2019-1224Remote Desktop Protocol Server Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2019-1225Remote Desktop Protocol Server Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2019-1175Windows Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1176DirectX Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1177Windows Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1178Windows Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1179Windows Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1180Windows Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1185Windows Subsystem for Linux Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1186Windows Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1188LNK Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2019-1190Windows Image Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1194Scripting Engine Memory Corruption VulnerabilityMicrosoft Internet Explorer
- CVE-2019-1151Microsoft Graphics Remote Code Execution VulnerabilityMicrosoft Windows · Microsoft Office 2019 for Mac
- CVE-2019-1152Microsoft Graphics Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2019-1155Jet Database Engine Remote Code Execution VulnerabilityMicrosoft Windows · Microsoft Office
- CVE-2019-1156Jet Database Engine Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2019-1157Jet Database Engine Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2019-1159Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1162Windows ALPC Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1164Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1168Microsoft Windows p2pimsvc Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1169Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1170Windows NTFS Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1173Windows Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1174Windows Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-0720Hyper-V Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2019-0965Windows Hyper-V Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2019-1057MS XML Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2019-1133Scripting Engine Memory Corruption VulnerabilityMicrosoft Internet Explorer
- CVE-2019-1140Chakra Scripting Engine Memory Corruption VulnerabilityMicrosoft ChakraCore · Microsoft Edge +1
- CVE-2019-1144Microsoft Graphics Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2019-1145Microsoft Graphics Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2019-1146Jet Database Engine Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2019-1147Jet Database Engine Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2019-1149Microsoft Graphics Remote Code Execution VulnerabilityMicrosoft Windows · Microsoft Office 2019 for Mac
- CVE-2019-1150Microsoft Graphics Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2019-9506Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiationBluetooth BR/EDR
- CVE-2019-3639MWG UI: Cross-Frame Scripting vulnerabilityMcAfee Web Gateway
- CVE-2019-10201It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures.Red Hat keycloak · org.keycloak:keycloak-core
- CVE-2019-8062Adobe After Effects versions 16 and earlier have an insecure library loading (dll hijacking) vulnerability.Adobe After Effects
Medium, low and unrated 120
- CVE-2019-15062An issue was discovered in Dolibarr 11.0.0-alpha.dolibarr/dolibarr
- CVE-2019-14427XSS exists in WEB STUDIO Ultimate Loan Manager 2.0 by adding a branch under the Branches button that sets the notes parameter with crafted J
- CVE-2019-1228Windows Kernel Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2019-1229Dynamics On-Premise Elevation of Privilege VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2019-1258Azure Active Directory Authentication Library Elevation of Privilege VulnerabilityMicrosoft ADAL.NET · Microsoft Nuget +1
- CVE-2019-1196Chakra Scripting Engine Memory Corruption VulnerabilityMicrosoft ChakraCore · Microsoft Edge +1
- CVE-2019-1197Chakra Scripting Engine Memory Corruption VulnerabilityMicrosoft ChakraCore · Microsoft Edge +1
- CVE-2019-1198Microsoft Windows Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1199Microsoft Outlook Memory Corruption VulnerabilityMicrosoft Office
- CVE-2019-1200Microsoft Outlook Remote Code Execution VulnerabilityMicrosoft Office · Microsoft Outlook
- CVE-2019-1201Microsoft Word Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +2
- CVE-2019-1202SharePoint Information Disclosure VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +2
- CVE-2019-1203Microsoft Office SharePoint XSS VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2019-1204Microsoft Outlook Elevation of Privilege VulnerabilityMicrosoft Office · Microsoft Outlook
- CVE-2019-1211Git for Visual Studio Elevation of Privilege VulnerabilityMicrosoft Visual Studio
- CVE-2019-1218Outlook iOS Spoofing VulnerabilityMicrosoft Outlook for iOS
- CVE-2019-1227Windows Kernel Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2019-1183Windows VBScript Engine Remote Code Execution VulnerabilityMicrosoft None Available
- CVE-2019-1184Windows Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1187XmlLite Runtime Denial of Service VulnerabilityMicrosoft Windows
- CVE-2019-1192Microsoft Browsers Security Feature Bypass VulnerabilityMicrosoft Internet Explorer · Microsoft Edge
- CVE-2019-1193Microsoft Browser Memory Corruption VulnerabilityMicrosoft Internet Explorer · Microsoft Edge
- CVE-2019-1195Chakra Scripting Engine Memory Corruption VulnerabilityMicrosoft ChakraCore · Microsoft Edge +1
- CVE-2019-1153Microsoft Graphics Component Information Disclosure VulnerabilityMicrosoft Windows · Microsoft Office 2019 for Mac
- CVE-2019-1154Windows Graphics Component Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2019-1158Windows Graphics Component Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2019-1161Microsoft Defender Elevation of Privilege VulnerabilityMicrosoft Forefront Endpoint Protection · Microsoft Syst… +4
- CVE-2019-1163Windows File Signature Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2019-1171SymCrypt Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2019-1172Windows Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2019-0723Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows
- CVE-2019-1030Microsoft Edge based on Edge HTML Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2019-1078Microsoft Graphics Component Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2019-1131Chakra Scripting Engine Memory Corruption VulnerabilityMicrosoft ChakraCore · Microsoft Edge +1
- CVE-2019-1139Chakra Scripting Engine Memory Corruption VulnerabilityMicrosoft ChakraCore · Microsoft Edge +1
- CVE-2019-1141Chakra Scripting Engine Memory Corruption VulnerabilityMicrosoft ChakraCore · Microsoft Edge +1
- CVE-2019-1143Windows Graphics Component Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2019-1148Microsoft Graphics Component Information Disclosure VulnerabilityMicrosoft Windows · Microsoft Office 2019 for Mac
- CVE-2019-0714Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows
- CVE-2019-0715Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows
- CVE-2019-0716Windows Denial of Service VulnerabilityMicrosoft Windows
- CVE-2019-0717Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows
- CVE-2019-0718Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows
- CVE-2019-14527An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03.
- CVE-2019-14526An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03.
- CVE-2019-12104The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by several post-authentication command
- CVE-2019-15058stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information Disclosure or Denial
- CVE-2019-12103The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by a pre-authentication command inject
- CVE-2019-13030eQ-3 Homematic CCU3 AddOn 'Mediola NEO Server for Homematic CCU3' prior to 2.4.5 allows uncontrolled admin access to start or stop the Node.
- CVE-2019-9585eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.***Metadata related operat
- CVE-2019-9584eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details,
- CVE-2019-14216An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress.
- CVE-2019-9582eQ-3 Homematic CCU2 outdated base software packages allows Denial of Service.
- CVE-2019-9583eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login.
- CVE-2018-19386SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page param
- CVE-2019-12262Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component.
- CVE-2019-3637Privilege Escalation vulnerability in FRP 5.x earlier than 5.1.0.209McAfee FRP
- CVE-2019-3635MWG Proxy: Cross-Frame Scripting vulnerabilityMcAfee Web Gateway
- CVE-2019-10199It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests.Red Hat keycloak · org.keycloak:keycloak-core
- CVE-2019-15053The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection me
- CVE-2019-11652A potential authorization bypass issue was found in Micro Focus Self Service Password Reset (SSPR) versions prior to: 4.4.0.3, 4.3.0.6, and Micro Focus Self Service Password Reset
- CVE-2019-14974SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.
- CVE-2017-18510The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
- CVE-2017-18511The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.
- CVE-2016-10880The google-document-embedder plugin before 2.6.1 for WordPress has XSS.
- CVE-2016-10881The google-document-embedder plugin before 2.6.2 for WordPress has XSS.
- CVE-2016-10882The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.
- CVE-2017-18512The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.
- CVE-2017-18513The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.
- CVE-2016-10883The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.
- CVE-2013-7476The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.
- CVE-2016-10884The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
- CVE-2016-10885The wp-editor plugin before 1.2.6 for WordPress has CSRF.
- CVE-2016-10886The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.
- CVE-2015-9307The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
- CVE-2015-9308The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
- CVE-2015-9309The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.
- CVE-2018-20967The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.
- CVE-2018-20968The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF.
- CVE-2016-10887The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.
- CVE-2016-10888The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.
- CVE-2015-9310The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.
- CVE-2019-15047An issue was discovered in Bento4 1.5.1.0.
- CVE-2019-15048An issue was discovered in Bento4 1.5.1.0.
- CVE-2019-15049An issue was discovered in Bento4 1.5.1.0.
- CVE-2019-15050An issue was discovered in Bento4 1.5.1.0.
- CVE-2015-9311The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.
- CVE-2019-0349SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT,SAP SE SAP Kernel
- CVE-2015-9312The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.
- CVE-2015-9313The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.
- CVE-2015-9314The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.
- CVE-2019-7931Adobe Premiere Pro CC versions 13.1.2 and earlier have an insecure library loading (dll hijacking) vulnerability.Adobe Premiere Pro CC
- CVE-2015-9315The newstatpress plugin before 1.0.1 for WordPress has SQL injection.
- CVE-2019-15046Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) repli
- CVE-2016-10889The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.
- CVE-2019-15025The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.
- CVE-2017-18514The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
- CVE-2019-7961Adobe Prelude CC versions 8.1 and earlier have an insecure library loading (dll hijacking) vulnerability.Adobe Prelude CC
- CVE-2015-9316The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via t
- CVE-2019-7870Adobe Character Animator versions 2.1 and earlier have an insecure library loading (dll hijacking) vulnerability.Adobe Character Animator
- CVE-2019-0351A remote code execution vulnerability exists in the SAP NetWeaver UDDI Server (Services Registry), versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.SAP SE SAP NetWeaver UDDI Server
- CVE-2019-0348SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, eSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2019-0346Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to dSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2019-0345A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versSAP SE SAP NetWeaver Application Server for Java
- CVE-2019-0343SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user tSAP SE SAP Commerce Cloud
- CVE-2019-0340The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML ValidatiSAP SE SAP Enable Now
- CVE-2019-0341The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set.SAP SE SAP Enable Now
- CVE-2019-0338During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not propSAP SE SAP Gateway
- CVE-2019-0334When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it is possible to storeSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2019-0333In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.SAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2019-0337Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-contSAP SE SAP NetWeaver Process Integration
- CVE-2019-0335Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an SAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2019-0332SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some payload for keyword SAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2019-0331Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, allows an attacker to aSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2017-18515The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.
- CVE-2019-14975Artifex MuPDF before 1.16.0 has a heap-based buffer over-read in fz_chartorune in fitz/string.c because pdf/pdf-op-filter.c does not check f
- CVE-2019-15027The MediaTek Embedded Multimedia Card (eMMC) subsystem for Android on MT65xx, MT66xx, and MT8163 SoC devices allows attackers to execute arb
- CVE-2019-14973_TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compile
- CVE-2014-10375handle_messages in eXtl_tls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header.
- CVE-2019-15028In Joomla! before 3.9.11, inadequate checks in com_contact could allow mail submission in disabled forms.