# CVEs published 2019-08-15

56 CVEs were published on August 15, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2019-15090](https://cve.now/CVE-2019-15090.md): An issue was discovered in drivers/scsi/qedi/qedi\_dbg.c in the Linux kernel before 5.1.12. (no CVSS)
- [CVE-2019-15084](https://cve.now/CVE-2019-15084.md): Realtek Waves MaxxAudio driver 1.6.2.0, as used on Dell laptops, installs with incorrect file permissions. (no CVSS)
- [CVE-2019-9852](https://cve.now/CVE-2019-9852.md): Insufficient URL encoding flaw in allowed script location check (no CVSS, Document Foundation LibreOffice)
- [CVE-2019-9851](https://cve.now/CVE-2019-9851.md): LibreLogo global-event script execution (no CVSS, Document Foundation LibreOffice)
- [CVE-2019-9850](https://cve.now/CVE-2019-9850.md): Insufficient url validation allowing LibreLogo script execution (no CVSS, Document Foundation LibreOffice)
- [CVE-2019-10081](https://cve.now/CVE-2019-10081.md): HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the (no CVSS, Apache HTTP Server)
- [CVE-2018-14062](https://cve.now/CVE-2018-14062.md): The COSPAS-SARSAT protocol allows remote attackers to forge messages, replay encrypted messages, conduct denial of service attacks, and send (no CVSS)
- [CVE-2019-12792](https://cve.now/CVE-2019-12792.md): A command injection vulnerability in UploadHandler.php in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular regi (no CVSS)
- [CVE-2019-12791](https://cve.now/CVE-2019-12791.md): A directory traversal vulnerability in the v-list-user script in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regul (no CVSS)
- [CVE-2019-3974](https://cve.now/CVE-2019-3974.md): Nessus 8.5.2 and earlier on Windows platforms were found to contain an issue where certain system files could be overwritten arbitrarily, po (no CVSS, Tenable Nessus)
- [CVE-2019-12809](https://cve.now/CVE-2019-12809.md): Yes24ViewerX ActiveX Control 1.0.327.50126 and earlier versions contains a vulnerability that could allow remote attackers to download and e (no CVSS, YES24 PC VIEWER)
- [CVE-2019-13516](https://cve.now/CVE-2019-13516.md): In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection settin (no CVSS, OSIsoft PI Web API)
- [CVE-2019-13514](https://cve.now/CVE-2019-13514.md): In Delta Industrial Automation DOPSoft, Version 4.00.06.15 and prior, processing a specially crafted project file may trigger a use-after-fr (no CVSS, Delta Industrial Automation DOPSoft)
- [CVE-2019-13515](https://cve.now/CVE-2019-13515.md): OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information. (no CVSS, OSIsoft PI Web API)
- [CVE-2019-13513](https://cve.now/CVE-2019-13513.md): In Delta Industrial Automation DOPSoft, Version 4.00.06.15 and prior, processing a specially crafted project file may trigger multiple out-o (no CVSS, Delta Industrial Automation DOPSoft)
- [CVE-2019-13510](https://cve.now/CVE-2019-13510.md): Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416. (no CVSS, Rockwell Automation Arena Simulation Software versions 16.0…)
- [CVE-2019-13511](https://cve.now/CVE-2019-13511.md): Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200. (no CVSS, Rockwell Automation Arena Simulation Software versions 16.0…)
- [CVE-2019-13512](https://cve.now/CVE-2019-13512.md): Fuji Electric FRENIC Loader 3.5.0.0 and prior is vulnerable to an out-of-bounds read vulnerability, which may allow an attacker to read limi (no CVSS, Fuji Electric FRENIC Loader 3.5.0.0 and prior)
- [CVE-2018-14672](https://cve.now/CVE-2018-14672.md): In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messag (no CVSS, ClickHouse)
- [CVE-2019-9012](https://cve.now/CVE-2019-9012.md): An issue was discovered in 3S-Smart CODESYS V3 products. (no CVSS)
- [CVE-2018-14671](https://cve.now/CVE-2018-14671.md): In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vu (no CVSS, ClickHouse)
- [CVE-2019-9010](https://cve.now/CVE-2019-9010.md): An issue was discovered in 3S-Smart CODESYS V3 products. (no CVSS)
- [CVE-2018-14669](https://cve.now/CVE-2018-14669.md): ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database (no CVSS, ClickHouse)
- [CVE-2018-14668](https://cve.now/CVE-2018-14668.md): In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default\_database" fields which (no CVSS, ClickHouse)
- [CVE-2018-14670](https://cve.now/CVE-2018-14670.md): Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database. (no CVSS, ClickHouse)
- [CVE-2019-10140](https://cve.now/CVE-2019-10140.md): A vulnerability was found in Linux kernel's, versions up to 3.10, implementation of overlayfs. (CVSS 5.5, OpenSource kernel:)
- [CVE-2018-12101](https://cve.now/CVE-2018-12101.md): CMS Clipper 1.3.3 has XSS in the Security tab search, User Groups, Resource Groups, and User/Resource Group Links fields. (no CVSS)
- [CVE-2018-12357](https://cve.now/CVE-2018-12357.md): Arista CloudVision Portal through 2018.1.1 has Incorrect Permissions. (no CVSS)
- [CVE-2018-14008](https://cve.now/CVE-2018-14008.md): Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled. (no CVSS)
- [CVE-2018-17790](https://cve.now/CVE-2018-17790.md): Prospecta Master Data Online (MDO) 2.0 has Stored XSS. (no CVSS)
- [CVE-2017-14232](https://cve.now/CVE-2017-14232.md): The read\_chunk function in flif-dec.cpp in Free Lossless Image Format (FLIF) 0.3 allows remote attackers to cause a denial of service (inval (no CVSS)
- [CVE-2019-11187](https://cve.now/CVE-2019-11187.md): Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username con (no CVSS)
- [CVE-2019-12854](https://cve.now/CVE-2019-12854.md): Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. (no CVSS)
- [CVE-2019-9013](https://cve.now/CVE-2019-9013.md): An issue was discovered in 3S-Smart CODESYS V3 products. (no CVSS)
- [CVE-2019-13377](https://cve.now/CVE-2019-13377.md): The implementations of SAE and EAP-pwd in hostapd and wpa\_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of o (no CVSS)
- [CVE-2019-14422](https://cve.now/CVE-2019-14422.md): An issue was discovered in in TortoiseSVN 1.12.1. (no CVSS)
- [CVE-2019-14518](https://cve.now/CVE-2019-14518.md): Evolution CMS 2.0.x allows XSS via a description and new category location in a template. (no CVSS)
- [CVE-2019-14784](https://cve.now/CVE-2019-14784.md): The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition. (no CVSS)
- [CVE-2019-14786](https://cve.now/CVE-2019-14786.md): The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb paramet (no CVSS)
- [CVE-2019-14788](https://cve.now/CVE-2019-14788.md): wp-admin/admin-ajax.php?action=newsletters\_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory t (no CVSS)
- [CVE-2019-14789](https://cve.now/CVE-2019-14789.md): The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter. (no CVSS)
- [CVE-2019-13578](https://cve.now/CVE-2019-13578.md): A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. (no CVSS)
- [CVE-2019-14790](https://cve.now/CVE-2019-14790.md): The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=short (no CVSS)
- [CVE-2019-14795](https://cve.now/CVE-2019-14795.md): The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update\_title\_options isA (no CVSS)
- [CVE-2019-14800](https://cve.now/CVE-2019-14800.md): The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via (no CVSS)
- [CVE-2019-3418](https://cve.now/CVE-2019-3418.md): All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by cross-site scripting vulnerability (XSS). (CVSS 5.7, ZTE ZXHN F670)
- [CVE-2019-3417](https://cve.now/CVE-2019-3417.md): All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by command injection vulnerability. (CVSS 8.1, ZTE ZXHN F670)
- [CVE-2019-14755](https://cve.now/CVE-2019-14755.md): The profile photo upload feature in Leaf Admin 61.9.0212.10 f allows Unrestricted Upload of a File with a Dangerous Type. (no CVSS)
- [CVE-2019-15081](https://cve.now/CVE-2019-15081.md): OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categor (no CVSS)
- [CVE-2019-13217](https://cve.now/CVE-2019-13217.md): A heap buffer overflow in the start\_decoder function in stb\_vorbis through 2019-03-04 allows an attacker to cause a denial of service or exe (no CVSS)
- [CVE-2019-13218](https://cve.now/CVE-2019-13218.md): Division by zero in the predict\_point function in stb\_vorbis through 2019-03-04 allows an attacker to cause a denial of service by opening a (no CVSS)
- [CVE-2019-13219](https://cve.now/CVE-2019-13219.md): A NULL pointer dereference in the get\_window function in stb\_vorbis through 2019-03-04 allows an attacker to cause a denial of service by op (no CVSS)
- [CVE-2019-13220](https://cve.now/CVE-2019-13220.md): Use of uninitialized stack variables in the start\_decoder function in stb\_vorbis through 2019-03-04 allows an attacker to cause a denial of (no CVSS)
- [CVE-2019-13221](https://cve.now/CVE-2019-13221.md): A stack buffer overflow in the compute\_codewords function in stb\_vorbis through 2019-03-04 allows an attacker to cause a denial of service o (no CVSS)
- [CVE-2019-13222](https://cve.now/CVE-2019-13222.md): An out-of-bounds read of a global buffer in the draw\_line function in stb\_vorbis through 2019-03-04 allows an attacker to cause a denial of (no CVSS)
- [CVE-2019-13223](https://cve.now/CVE-2019-13223.md): A reachable assertion in the lookup1\_values function in stb\_vorbis through 2019-03-04 allows an attacker to cause a denial of service by ope (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-08-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.