# CVEs published 2019-08-16

45 CVEs were published on August 16, 2019: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-18541](https://cve.now/CVE-2017-18541.md): The xo-security plugin before 1.5.3 for WordPress has XSS. (no CVSS)
- [CVE-2017-18542](https://cve.now/CVE-2017-18542.md): The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2018-20971](https://cve.now/CVE-2018-20971.md): The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan. (no CVSS)
- [CVE-2018-20972](https://cve.now/CVE-2018-20972.md): The companion-auto-update plugin before 3.2.1 for WordPress has CSRF. (no CVSS)
- [CVE-2018-20973](https://cve.now/CVE-2018-20973.md): The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion. (no CVSS)
- [CVE-2019-15113](https://cve.now/CVE-2019-15113.md): The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF. (no CVSS)
- [CVE-2015-9322](https://cve.now/CVE-2015-9322.md): The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF. (no CVSS)
- [CVE-2019-15114](https://cve.now/CVE-2019-15114.md): The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF. (no CVSS)
- [CVE-2017-18543](https://cve.now/CVE-2017-18543.md): The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations. (no CVSS)
- [CVE-2017-18544](https://cve.now/CVE-2017-18544.md): The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF. (no CVSS)
- [CVE-2017-18545](https://cve.now/CVE-2017-18545.md): The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input. (no CVSS)
- [CVE-2017-18546](https://cve.now/CVE-2017-18546.md): The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF. (no CVSS)
- [CVE-2018-20974](https://cve.now/CVE-2018-20974.md): The js-jobs plugin before 1.0.7 for WordPress has CSRF. (no CVSS)
- [CVE-2017-18547](https://cve.now/CVE-2017-18547.md): The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms. (no CVSS)
- [CVE-2019-15115](https://cve.now/CVE-2019-15115.md): The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF. (no CVSS)
- [CVE-2015-9323](https://cve.now/CVE-2015-9323.md): The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection. (no CVSS)
- [CVE-2019-15116](https://cve.now/CVE-2019-15116.md): The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging. (no CVSS)
- [CVE-2015-9324](https://cve.now/CVE-2015-9324.md): The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection. (no CVSS)
- [CVE-2014-10376](https://cve.now/CVE-2014-10376.md): The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection. (no CVSS)
- [CVE-2019-7959](https://cve.now/CVE-2019-7959.md): Creative Cloud Desktop Application versions 4.6.1 and earlier have a using components with known vulnerabilities vulnerability. (no CVSS, Adobe Creative Cloud Desktop Application)
- [CVE-2019-7958](https://cve.now/CVE-2019-7958.md): Creative Cloud Desktop Application versions 4.6.1 and earlier have an insecure inherited permissions vulnerability. (no CVSS, Adobe Creative Cloud Desktop Application)
- [CVE-2019-7957](https://cve.now/CVE-2019-7957.md): Creative Cloud Desktop Application versions 4.6.1 and earlier have a security bypass vulnerability. (no CVSS, Adobe Creative Cloud Desktop Application)
- [CVE-2019-8063](https://cve.now/CVE-2019-8063.md): Creative Cloud Desktop Application 4.6.1 and earlier versions have an insecure transmission of sensitive data vulnerability. (no CVSS, Adobe Creative Cloud Desktop Application)
- [CVE-2019-7964](https://cve.now/CVE-2019-7964.md): Adobe Experience Manager versions 6.5, and 6.4 have an authentication bypass vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2019-15120](https://cve.now/CVE-2019-15120.md): The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode. (no CVSS)
- [CVE-2019-15119](https://cve.now/CVE-2019-15119.md): lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwr (no CVSS, ehang.io/nps · github.com/cnlh/nps)
- [CVE-2019-15117](https://cve.now/CVE-2019-15117.md): parse\_audio\_mixer\_unit in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles a short descriptor, leading to out-of-bounds memory (no CVSS)
- [CVE-2019-15118](https://cve.now/CVE-2019-15118.md): check\_input\_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack exhaustion. (no CVSS)
- [CVE-2017-18548](https://cve.now/CVE-2017-18548.md): The note-press plugin before 0.1.2 for WordPress has SQL injection. (no CVSS)
- [CVE-2016-10904](https://cve.now/CVE-2016-10904.md): The olimometer plugin before 2.57 for WordPress has SQL injection. (no CVSS)
- [CVE-2015-9325](https://cve.now/CVE-2015-9325.md): The visitors-online plugin before 0.4 for WordPress has SQL injection. (no CVSS)
- [CVE-2015-9326](https://cve.now/CVE-2015-9326.md): The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection. (no CVSS)
- [CVE-2019-14923](https://cve.now/CVE-2019-14923.md): EyesOfNetwork 5.1 allows Remote Command Execution via shell metacharacters in the module/tool\_all/ host field. (no CVSS)
- [CVE-2019-15091](https://cve.now/CVE-2019-15091.md): filemgr.php in Artica Integria IMS 5.0.86 allows index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload arbitrary file upload. (no CVSS)
- [CVE-2018-20969](https://cve.now/CVE-2018-20969.md): do\_ed\_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. (no CVSS)
- [CVE-2019-15108](https://cve.now/CVE-2019-15108.md): An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457. (CVSS 3.5)
- [CVE-2016-10894](https://cve.now/CVE-2016-10894.md): xtrlock through 2.10 does not block multitouch events. (no CVSS)
- [CVE-2019-15104](https://cve.now/CVE-2019-15104.md): An issue was discovered in Zoho ManageEngine OpManager through 12.4x. (no CVSS)
- [CVE-2019-15105](https://cve.now/CVE-2019-15105.md): An issue was discovered in Zoho ManageEngine Application Manager through 14.2. (no CVSS)
- [CVE-2019-15106](https://cve.now/CVE-2019-15106.md): An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. (no CVSS)
- [CVE-2019-15107](https://cve.now/CVE-2019-15107.md): An issue was discovered in Webmin \<=1.920. (CVSS 9.8, KEV)
- [CVE-2019-15098](https://cve.now/CVE-2019-15098.md): drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete address in an endpo (no CVSS)
- [CVE-2019-15099](https://cve.now/CVE-2019-15099.md): drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplete address in an endpo (no CVSS)
- [CVE-2019-15095](https://cve.now/CVE-2019-15095.md): DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter. (no CVSS)
- [CVE-2019-5477](https://cve.now/CVE-2019-5477.md): A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's \`Kernel.open\` me (no CVSS, Nokogiri · rexical)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-08-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.