CVEs published August 15, 2019
56 CVEs were published on August 15, 2019: 0 critical, 1 high.
- Published
- 56
- Critical
- 0
- High
- 1
- Medium
- 2
- Low
- 0
- Unrated
- 53
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- ClickHouse
- 5
- Document Foundation LibreOffice
- 3
- Delta Industrial Automation DOPSoft
- 2
- OSIsoft PI Web API
- 2
- Rockwell Automation Arena Simulation Software versions 16.0…
- 2
- ZTE ZXHN F670
- 2
- Apache HTTP Server
- 1
- Fuji Electric FRENIC Loader 3.5.0.0 and prior
- 1
- OpenSource kernel:
- 1
- Tenable Nessus
- 1
High 1
Medium, low and unrated 55
- CVE-2019-15090An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12.
- CVE-2019-15084Realtek Waves MaxxAudio driver 1.6.2.0, as used on Dell laptops, installs with incorrect file permissions.
- CVE-2019-9852Insufficient URL encoding flaw in allowed script location checkDocument Foundation LibreOffice
- CVE-2019-9851LibreLogo global-event script executionDocument Foundation LibreOffice
- CVE-2019-9850Insufficient url validation allowing LibreLogo script executionDocument Foundation LibreOffice
- CVE-2019-10081HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the Apache HTTP Server
- CVE-2018-14062The COSPAS-SARSAT protocol allows remote attackers to forge messages, replay encrypted messages, conduct denial of service attacks, and send
- CVE-2019-12792A command injection vulnerability in UploadHandler.php in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular regi
- CVE-2019-12791A directory traversal vulnerability in the v-list-user script in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regul
- CVE-2019-3974Nessus 8.5.2 and earlier on Windows platforms were found to contain an issue where certain system files could be overwritten arbitrarily, poTenable Nessus
- CVE-2019-12809Yes24ViewerX ActiveX Control 1.0.327.50126 and earlier versions contains a vulnerability that could allow remote attackers to download and eYES24 PC VIEWER
- CVE-2019-13516In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection settinOSIsoft PI Web API
- CVE-2019-13514In Delta Industrial Automation DOPSoft, Version 4.00.06.15 and prior, processing a specially crafted project file may trigger a use-after-frDelta Industrial Automation DOPSoft
- CVE-2019-13515OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information.OSIsoft PI Web API
- CVE-2019-13513In Delta Industrial Automation DOPSoft, Version 4.00.06.15 and prior, processing a specially crafted project file may trigger multiple out-oDelta Industrial Automation DOPSoft
- CVE-2019-13510Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416.Rockwell Automation Arena Simulation Software versions 16.0…
- CVE-2019-13511Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200.Rockwell Automation Arena Simulation Software versions 16.0…
- CVE-2019-13512Fuji Electric FRENIC Loader 3.5.0.0 and prior is vulnerable to an out-of-bounds read vulnerability, which may allow an attacker to read limiFuji Electric FRENIC Loader 3.5.0.0 and prior
- CVE-2018-14672In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messagClickHouse
- CVE-2019-9012An issue was discovered in 3S-Smart CODESYS V3 products.
- CVE-2018-14671In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vuClickHouse
- CVE-2019-9010An issue was discovered in 3S-Smart CODESYS V3 products.
- CVE-2018-14669ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL databaseClickHouse
- CVE-2018-14668In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which ClickHouse
- CVE-2018-14670Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.ClickHouse
- CVE-2019-10140A vulnerability was found in Linux kernel's, versions up to 3.10, implementation of overlayfs.OpenSource kernel:
- CVE-2018-12101CMS Clipper 1.3.3 has XSS in the Security tab search, User Groups, Resource Groups, and User/Resource Group Links fields.
- CVE-2018-12357Arista CloudVision Portal through 2018.1.1 has Incorrect Permissions.
- CVE-2018-14008Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled.
- CVE-2018-17790Prospecta Master Data Online (MDO) 2.0 has Stored XSS.
- CVE-2017-14232The read_chunk function in flif-dec.cpp in Free Lossless Image Format (FLIF) 0.3 allows remote attackers to cause a denial of service (inval
- CVE-2019-11187Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username con
- CVE-2019-12854Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory.
- CVE-2019-9013An issue was discovered in 3S-Smart CODESYS V3 products.
- CVE-2019-13377The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of o
- CVE-2019-14422An issue was discovered in in TortoiseSVN 1.12.1.
- CVE-2019-14518Evolution CMS 2.0.x allows XSS via a description and new category location in a template.
- CVE-2019-14784The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.
- CVE-2019-14786The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb paramet
- CVE-2019-14788wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory t
- CVE-2019-14789The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.
- CVE-2019-13578A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress.
- CVE-2019-14790The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=short
- CVE-2019-14795The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isA
- CVE-2019-14800The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via
- CVE-2019-3418All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by cross-site scripting vulnerability (XSS).ZTE ZXHN F670
- CVE-2019-14755The profile photo upload feature in Leaf Admin 61.9.0212.10 f allows Unrestricted Upload of a File with a Dangerous Type.
- CVE-2019-15081OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categor
- CVE-2019-13217A heap buffer overflow in the start_decoder function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or exe
- CVE-2019-13218Division by zero in the predict_point function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a
- CVE-2019-13219A NULL pointer dereference in the get_window function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by op
- CVE-2019-13220Use of uninitialized stack variables in the start_decoder function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of
- CVE-2019-13221A stack buffer overflow in the compute_codewords function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service o
- CVE-2019-13222An out-of-bounds read of a global buffer in the draw_line function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of
- CVE-2019-13223A reachable assertion in the lookup1_values function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service by ope