CVEs published August 16, 2019
45 CVEs were published on August 16, 2019: 1 critical, 0 high. 1 is now in CISA KEV.
- Published
- 45
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 1
- Unrated
- 43
- Now in CISA KEV
- 1
- Fix available
- 2
Most affected products
- Adobe Creative Cloud Desktop Application
- 4
- Adobe Experience Manager
- 1
- ehang.io/nps · github.com/cnlh/nps
- 1
- Nokogiri · rexical
- 1
Critical 1
Medium, low and unrated 44
- CVE-2017-18541The xo-security plugin before 1.5.3 for WordPress has XSS.
- CVE-2017-18542The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.
- CVE-2018-20971The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.
- CVE-2018-20972The companion-auto-update plugin before 3.2.1 for WordPress has CSRF.
- CVE-2018-20973The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion.
- CVE-2019-15113The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.
- CVE-2015-9322The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.
- CVE-2019-15114The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.
- CVE-2017-18543The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.
- CVE-2017-18544The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.
- CVE-2017-18545The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.
- CVE-2017-18546The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.
- CVE-2018-20974The js-jobs plugin before 1.0.7 for WordPress has CSRF.
- CVE-2017-18547The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.
- CVE-2019-15115The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.
- CVE-2015-9323The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
- CVE-2019-15116The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.
- CVE-2015-9324The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.
- CVE-2014-10376The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.
- CVE-2019-7959Creative Cloud Desktop Application versions 4.6.1 and earlier have a using components with known vulnerabilities vulnerability.Adobe Creative Cloud Desktop Application
- CVE-2019-7958Creative Cloud Desktop Application versions 4.6.1 and earlier have an insecure inherited permissions vulnerability.Adobe Creative Cloud Desktop Application
- CVE-2019-7957Creative Cloud Desktop Application versions 4.6.1 and earlier have a security bypass vulnerability.Adobe Creative Cloud Desktop Application
- CVE-2019-8063Creative Cloud Desktop Application 4.6.1 and earlier versions have an insecure transmission of sensitive data vulnerability.Adobe Creative Cloud Desktop Application
- CVE-2019-7964Adobe Experience Manager versions 6.5, and 6.4 have an authentication bypass vulnerability.Adobe Experience Manager
- CVE-2019-15120The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode.
- CVE-2019-15119lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrehang.io/nps · github.com/cnlh/nps
- CVE-2019-15117parse_audio_mixer_unit in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles a short descriptor, leading to out-of-bounds memory
- CVE-2019-15118check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack exhaustion.
- CVE-2017-18548The note-press plugin before 0.1.2 for WordPress has SQL injection.
- CVE-2016-10904The olimometer plugin before 2.57 for WordPress has SQL injection.
- CVE-2015-9325The visitors-online plugin before 0.4 for WordPress has SQL injection.
- CVE-2015-9326The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.
- CVE-2019-14923EyesOfNetwork 5.1 allows Remote Command Execution via shell metacharacters in the module/tool_all/ host field.
- CVE-2019-15091filemgr.php in Artica Integria IMS 5.0.86 allows index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload arbitrary file upload.
- CVE-2018-20969do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character.
- CVE-2019-15108An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457.
- CVE-2016-10894xtrlock through 2.10 does not block multitouch events.
- CVE-2019-15104An issue was discovered in Zoho ManageEngine OpManager through 12.4x.
- CVE-2019-15105An issue was discovered in Zoho ManageEngine Application Manager through 14.2.
- CVE-2019-15106An issue was discovered in Zoho ManageEngine OpManager in builds before 14310.
- CVE-2019-15098drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete address in an endpo
- CVE-2019-15099drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpo
- CVE-2019-15095DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter.
- CVE-2019-5477A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` meNokogiri · rexical