CVEs published August 21, 2019
114 CVEs were published on August 21, 2019: 8 critical, 18 high.
- Published
- 114
- Critical
- 8
- High
- 18
- Medium
- 12
- Low
- 1
- Unrated
- 75
- Now in CISA KEV
- 0
- Fix available
- 29
Most affected products
- Cisco Unified Computing System E-Series Software
- 7
- Cisco Unified Computing System Director
- 6
- Cisco Unified Computing System
- 5
- Aspose
- 3
- Cisco Enterprise NFV Infrastructure Software
- 2
- McAfee Data Loss Prevention (DLPe) for Windows
- 2
- Bosch IoT Gateway Software · ProSyst mBS SDK
- 1
- Cisco Firepower Threat Defense Software
- 1
- Cisco HyperFlex HX-Series
- 1
- Cisco IOS XE Software
- 1
Critical 8
- CVE-2019-11601Path traversal in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software
- CVE-2019-1938Cisco UCS Director and Cisco UCS Director Express for Big Data API Authentication Bypass VulnerabilityCisco Unified Computing System Director
- CVE-2019-1974Cisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass VulnerabilityCisco Unified Computing System Director
- CVE-2019-1935Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials VulnerabilityCisco Unified Computing System Director
- CVE-2019-1937Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass VulnerabilityCisco Unified Computing System Director
- CVE-2019-5032An exploitable out-of-bounds read vulnerability exists in the LabelSst record parser of Aspose Aspose.Cells 19.1.0 library.Aspose
- CVE-2019-5041An exploitable Stack Based Buffer Overflow vulnerability exists in the EnumMetaInfo function of Aspose Aspose.Words library, version 18.11.0Aspose
- CVE-2019-5033An exploitable out-of-bounds read vulnerability exists in the Number record parser of Aspose Aspose.Cells 19.1.0 library.Aspose
High 18
- CVE-2019-6177A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to nLenovo Solution Center
- CVE-2019-5638Rapid7 Nexpose Insufficient Session ManagementRapid7 Nexpose
- CVE-2019-11603Path traversal in ProSyst mBS SDK and Bosch IoT Gateway Software
- CVE-2019-1907Cisco Integrated Management Controller Substring Comparison Privilege Escalation VulnerabilityCisco Unified Computing System
- CVE-2019-1908Cisco Integrated Management Controller Information Disclosure VulnerabilityCisco Unified Computing System
- CVE-2019-1936Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Command Injection VulnerabilityCisco Unified Computing System Director
- CVE-2019-1883Cisco Integrated Management Controller CLI Command Injection VulnerabilityCisco Unified Computing System E-Series Software
- CVE-2019-1885Cisco Integrated Management Controller Command Injection VulnerabilityCisco Unified Computing System
- CVE-2019-1896Cisco Integrated Management Controller CSR Generation Command Injection VulnerabilityCisco Unified Computing System E-Series Software
- CVE-2019-1900Cisco Integrated Management Controller Unauthenticated Denial of Service VulnerabilityCisco Unified Computing System
- CVE-2019-1864Cisco Integrated Management Controller Command Injection VulnerabilityCisco Unified Computing System E-Series Software
- CVE-2019-1865Cisco Integrated Management Controller Command Injection VulnerabilityCisco Unified Computing System E-Series Software
- CVE-2019-1871Cisco Integrated Management Controller Buffer Overflow VulnerabilityCisco Unified Computing System
- CVE-2019-1634Cisco Integrated Management Controller Command Injection VulnerabilityCisco Unified Computing System E-Series Software
- CVE-2019-1850Cisco Integrated Management Controller Command Injection VulnerabilityCisco Unified Computing System E-Series Software
- CVE-2019-12624Cisco IOS XE NGWC Legacy Wireless Device Manager GUI Cross-Site Request Forgery VulnerabilityCisco IOS XE Software
- CVE-2019-12634Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Denial of Service VulnerabilityCisco Unified Computing System Director
- CVE-2019-11897Server-side request forgery in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway SoftwareBosch IoT Gateway Software · ProSyst mBS SDK
Medium, low and unrated 88
- CVE-2019-14686A DLL hijacking vulnerability exists in the Trend Micro Security's 2019 consumer family of products (v15) Folder Shield component and the stTrend Micro Ransom Buster, Trend Micro Security
- CVE-2019-14685A local privilege escalation vulnerability exists in Trend Micro Security 2019 (v15.0) in which, if exploited, would allow an attacker to maTrend Micro Security
- CVE-2019-15316Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via
- CVE-2019-15315Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local users can replace the c
- CVE-2018-17791Newgen OmniFlow Intelligent Business Process Suite (iBPS) 7.0 has an "improper server side validation" vulnerability where client-side valid
- CVE-2019-11602Leakage of stack traces in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software
- CVE-2019-10687KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entry_id[0] parameter, the admin/index.php?module=log id paramet
- CVE-2019-13476In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access
- CVE-2019-13477In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password
- CVE-2019-13599In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comp
- CVE-2019-14245In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete databases (such as oa
- CVE-2019-14246In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to discover phpMyAdmin password
- CVE-2019-14257pyraw in Zenoss 2.5.3 allows local privilege escalation by modifying environment variables to redirect execution before privileges are dropp
- CVE-2019-14258The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988.
- CVE-2019-1948Cisco Webex Meetings Mobile (iOS) SSL Certificate Validation VulnerabilityCisco WebEx Meetings for iOS
- CVE-2019-1984Cisco Enterprise Network Functions Virtualization Infrastructure Software Arbitrary File Write VulnerabilityCisco Enterprise NFV Infrastructure Software
- CVE-2019-15045AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration.
- CVE-2019-15074The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing executiomantisbt/mantisbt
- CVE-2016-10890The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.
- CVE-2016-10891The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.
- CVE-2017-18516The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.
- CVE-2017-18521The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.
- CVE-2017-18525The megamenu plugin before 2.4 for WordPress has XSS.
- CVE-2018-20970The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.
- CVE-2019-1863Cisco Integrated Management Controller Privilege Escalation VulnerabilityCisco Unified Computing System E-Series Software
- CVE-2017-18535The smokesignal plugin before 1.2.7 for WordPress has XSS.
- CVE-2019-15127REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file.
- CVE-2018-20977The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page.
- CVE-2017-18559The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.
- CVE-2014-10377The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.
- CVE-2019-1839Cisco Remote PHY Device Software Command Injection VulnerabilityCisco Remote PHY
- CVE-2012-6714The count-per-day plugin before 3.2.3 for WordPress has XSS via search words.
- CVE-2014-10378The duplicate-post plugin before 2.6 for WordPress has XSS.
- CVE-2014-10379The duplicate-post plugin before 2.6 for WordPress has SQL injection.
- CVE-2017-18561The embed-comment-images plugin before 0.6 for WordPress has XSS.
- CVE-2017-18562The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.
- CVE-2019-12626Cisco Unified Contact Center Express Stored Cross-Site Scripting VulnerabilityCisco Unified Contact Center Express
- CVE-2019-12627Cisco Firepower Threat Defense Software Information Disclosure VulnerabilityCisco Firepower Threat Defense Software
- CVE-2019-12621Cisco HyperFlex Static SSL Key VulnerabilityCisco HyperFlex HX-Series
- CVE-2019-12622Cisco RoomOS Software Privilege Escalation VulnerabilityCisco TelePresence CE Software
- CVE-2019-12623Cisco Enterprise Network Functions Virtualization Infrastructure Software File Enumeration VulnerabilityCisco Enterprise NFV Infrastructure Software
- CVE-2015-9327The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS.
- CVE-2016-10910The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.
- CVE-2019-11551In Code42 Enterprise and Crashplan for Small Business through Client version 6.9.1, an attacker can craft a restore request to restore a fil
- CVE-2012-6715The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header.
- CVE-2016-10911The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.
- CVE-2015-9328The profile-builder plugin before 2.2.5 for WordPress has XSS.
- CVE-2014-10380The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.
- CVE-2017-18563The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.
- CVE-2017-18564The sender plugin before 1.2.1 for WordPress has multiple XSS issues.
- CVE-2016-10912The universal-analytics plugin before 1.3.1 for WordPress has XSS.
- CVE-2019-15295An Untrusted Search Path vulnerability in the ServiceInstance.dll library versions 1.0.15.119 and lower, as used in Bitdefender Antivirus Fr
- CVE-2019-3634Buffer overflow in DLP Endpoint for WindowsMcAfee Data Loss Prevention (DLPe) for Windows
- CVE-2019-3633Buffer overflow in DLP Endpoint for WindowsMcAfee Data Loss Prevention (DLPe) for Windows
- CVE-2017-18560The content-audit plugin before 1.9.2 for WordPress has XSS.
- CVE-2017-18558The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.
- CVE-2017-18557The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.
- CVE-2017-18556The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.
- CVE-2017-18555The booking-sms plugin before 1.1.0 for WordPress has XSS.
- CVE-2017-18554The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.
- CVE-2017-18553The ad-buttons plugin before 2.3.2 for WordPress has XSS.
- CVE-2016-10903The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.
- CVE-2016-10902The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.
- CVE-2016-10909The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.
- CVE-2016-10901The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.
- CVE-2016-10908The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.
- CVE-2016-10900The uji-countdown plugin before 2.0.7 for WordPress has XSS.
- CVE-2019-15112The wp-slimstat plugin before 4.8.1 for WordPress has XSS.
- CVE-2017-18565The updater plugin before 1.35 for WordPress has multiple XSS issues.
- CVE-2019-15111The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.
- CVE-2019-15110The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.
- CVE-2017-18540The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.
- CVE-2017-18539The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.
- CVE-2017-18538The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.
- CVE-2017-18537The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.
- CVE-2016-10898The total-security plugin before 3.4.1 for WordPress has XSS.
- CVE-2016-10899The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.
- CVE-2019-15109The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.
- CVE-2015-9321The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.
- CVE-2017-18534The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.
- CVE-2016-10897The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.
- CVE-2017-18536The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.
- CVE-2016-10896The seo-redirection plugin before 4.3 for WordPress has stored XSS.
- CVE-2019-15296An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8.
- CVE-2019-15293An issue was discovered in ACDSee Photo Studio Standard 22.1 Build 1159.
- CVE-2019-15292An issue was discovered in the Linux kernel before 5.0.9.
- CVE-2019-12746An issue was discovered in Open Ticket Request System (OTRS) Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19.
- CVE-2019-13458An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x throu