# CVEs published 2019-08-21

114 CVEs were published on August 21, 2019: 8 critical, 18 high. Days are UTC.

- [CVE-2019-6177](https://cve.now/CVE-2019-6177.md): A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to n (CVSS 7.8, Lenovo Solution Center)
- [CVE-2019-14686](https://cve.now/CVE-2019-14686.md): A DLL hijacking vulnerability exists in the Trend Micro Security's 2019 consumer family of products (v15) Folder Shield component and the st (no CVSS, Trend Micro Ransom Buster, Trend Micro Security)
- [CVE-2019-14685](https://cve.now/CVE-2019-14685.md): A local privilege escalation vulnerability exists in Trend Micro Security 2019 (v15.0) in which, if exploited, would allow an attacker to ma (no CVSS, Trend Micro Security)
- [CVE-2019-5638](https://cve.now/CVE-2019-5638.md): Rapid7 Nexpose Insufficient Session Management (CVSS 8.7, Rapid7 Nexpose)
- [CVE-2019-15316](https://cve.now/CVE-2019-15316.md): Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\\SYSTEM) via (no CVSS)
- [CVE-2019-15315](https://cve.now/CVE-2019-15315.md): Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\\SYSTEM) because local users can replace the c (no CVSS)
- [CVE-2019-11603](https://cve.now/CVE-2019-11603.md): Path traversal in ProSyst mBS SDK and Bosch IoT Gateway Software (CVSS 7.5)
- [CVE-2018-17791](https://cve.now/CVE-2018-17791.md): Newgen OmniFlow Intelligent Business Process Suite (iBPS) 7.0 has an "improper server side validation" vulnerability where client-side valid (no CVSS)
- [CVE-2019-11602](https://cve.now/CVE-2019-11602.md): Leakage of stack traces in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software (CVSS 5.3)
- [CVE-2019-10687](https://cve.now/CVE-2019-10687.md): KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entry\_id\[0\] parameter, the admin/index.php?module=log id paramet (no CVSS)
- [CVE-2019-11601](https://cve.now/CVE-2019-11601.md): Path traversal in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software (CVSS 9.1)
- [CVE-2019-13476](https://cve.now/CVE-2019-13476.md): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access (no CVSS)
- [CVE-2019-13477](https://cve.now/CVE-2019-13477.md): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password (no CVSS)
- [CVE-2019-13599](https://cve.now/CVE-2019-13599.md): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comp (no CVSS)
- [CVE-2019-14245](https://cve.now/CVE-2019-14245.md): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete databases (such as oa (no CVSS)
- [CVE-2019-14246](https://cve.now/CVE-2019-14246.md): In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to discover phpMyAdmin password (no CVSS)
- [CVE-2019-14257](https://cve.now/CVE-2019-14257.md): pyraw in Zenoss 2.5.3 allows local privilege escalation by modifying environment variables to redirect execution before privileges are dropp (no CVSS)
- [CVE-2019-14258](https://cve.now/CVE-2019-14258.md): The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988. (no CVSS)
- [CVE-2019-1938](https://cve.now/CVE-2019-1938.md): Cisco UCS Director and Cisco UCS Director Express for Big Data API Authentication Bypass Vulnerability (CVSS 9.8, Cisco Unified Computing System Director)
- [CVE-2019-1948](https://cve.now/CVE-2019-1948.md): Cisco Webex Meetings Mobile (iOS) SSL Certificate Validation Vulnerability (CVSS 5.9, Cisco WebEx Meetings for iOS)
- [CVE-2019-1974](https://cve.now/CVE-2019-1974.md): Cisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability (CVSS 9.8, Cisco Unified Computing System Director)
- [CVE-2019-1984](https://cve.now/CVE-2019-1984.md): Cisco Enterprise Network Functions Virtualization Infrastructure Software Arbitrary File Write Vulnerability (CVSS 6.5, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2019-15045](https://cve.now/CVE-2019-15045.md): AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. (no CVSS)
- [CVE-2019-1907](https://cve.now/CVE-2019-1907.md): Cisco Integrated Management Controller Substring Comparison Privilege Escalation Vulnerability (CVSS 8.8, Cisco Unified Computing System)
- [CVE-2019-1908](https://cve.now/CVE-2019-1908.md): Cisco Integrated Management Controller Information Disclosure Vulnerability (CVSS 7.5, Cisco Unified Computing System)
- [CVE-2019-1935](https://cve.now/CVE-2019-1935.md): Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability (CVSS 9.8, Cisco Unified Computing System Director)
- [CVE-2019-1936](https://cve.now/CVE-2019-1936.md): Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Command Injection Vulnerability (CVSS 7.2, Cisco Unified Computing System Director)
- [CVE-2019-1937](https://cve.now/CVE-2019-1937.md): Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability (CVSS 9.8, Cisco Unified Computing System Director)
- [CVE-2019-15074](https://cve.now/CVE-2019-15074.md): The Timeline feature in my\_view\_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing executio (no CVSS, mantisbt/mantisbt)
- [CVE-2016-10890](https://cve.now/CVE-2016-10890.md): The aryo-activity-log plugin before 2.3.2 for WordPress has XSS. (no CVSS)
- [CVE-2016-10891](https://cve.now/CVE-2016-10891.md): The aryo-activity-log plugin before 2.3.3 for WordPress has XSS. (no CVSS)
- [CVE-2019-1883](https://cve.now/CVE-2019-1883.md): Cisco Integrated Management Controller CLI Command Injection Vulnerability (CVSS 7.0, Cisco Unified Computing System E-Series Software)
- [CVE-2019-1885](https://cve.now/CVE-2019-1885.md): Cisco Integrated Management Controller Command Injection Vulnerability (CVSS 7.2, Cisco Unified Computing System)
- [CVE-2019-1896](https://cve.now/CVE-2019-1896.md): Cisco Integrated Management Controller CSR Generation Command Injection Vulnerability (CVSS 7.2, Cisco Unified Computing System E-Series Software)
- [CVE-2019-1900](https://cve.now/CVE-2019-1900.md): Cisco Integrated Management Controller Unauthenticated Denial of Service Vulnerability (CVSS 7.5, Cisco Unified Computing System)
- [CVE-2017-18516](https://cve.now/CVE-2017-18516.md): The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2017-18521](https://cve.now/CVE-2017-18521.md): The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n. (no CVSS)
- [CVE-2017-18525](https://cve.now/CVE-2017-18525.md): The megamenu plugin before 2.4 for WordPress has XSS. (no CVSS)
- [CVE-2018-20970](https://cve.now/CVE-2018-20970.md): The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2019-1863](https://cve.now/CVE-2019-1863.md): Cisco Integrated Management Controller Privilege Escalation Vulnerability (CVSS 6.5, Cisco Unified Computing System E-Series Software)
- [CVE-2019-1864](https://cve.now/CVE-2019-1864.md): Cisco Integrated Management Controller Command Injection Vulnerability (CVSS 8.8, Cisco Unified Computing System E-Series Software)
- [CVE-2019-1865](https://cve.now/CVE-2019-1865.md): Cisco Integrated Management Controller Command Injection Vulnerability (CVSS 8.8, Cisco Unified Computing System E-Series Software)
- [CVE-2019-1871](https://cve.now/CVE-2019-1871.md): Cisco Integrated Management Controller Buffer Overflow Vulnerability (CVSS 7.2, Cisco Unified Computing System)
- [CVE-2017-18535](https://cve.now/CVE-2017-18535.md): The smokesignal plugin before 1.2.7 for WordPress has XSS. (no CVSS)
- [CVE-2019-15127](https://cve.now/CVE-2019-15127.md): REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file. (no CVSS)
- [CVE-2018-20977](https://cve.now/CVE-2018-20977.md): The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page. (no CVSS)
- [CVE-2017-18559](https://cve.now/CVE-2017-18559.md): The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2014-10377](https://cve.now/CVE-2014-10377.md): The cforms2 plugin before 13.2 for WordPress has XSS in lib\_ajax.php. (no CVSS)
- [CVE-2019-1634](https://cve.now/CVE-2019-1634.md): Cisco Integrated Management Controller Command Injection Vulnerability (CVSS 7.2, Cisco Unified Computing System E-Series Software)
- [CVE-2019-1839](https://cve.now/CVE-2019-1839.md): Cisco Remote PHY Device Software Command Injection Vulnerability (CVSS 6.7, Cisco Remote PHY)
- [CVE-2019-1850](https://cve.now/CVE-2019-1850.md): Cisco Integrated Management Controller Command Injection Vulnerability (CVSS 7.2, Cisco Unified Computing System E-Series Software)
- [CVE-2012-6714](https://cve.now/CVE-2012-6714.md): The count-per-day plugin before 3.2.3 for WordPress has XSS via search words. (no CVSS)
- [CVE-2014-10378](https://cve.now/CVE-2014-10378.md): The duplicate-post plugin before 2.6 for WordPress has XSS. (no CVSS)
- [CVE-2014-10379](https://cve.now/CVE-2014-10379.md): The duplicate-post plugin before 2.6 for WordPress has SQL injection. (no CVSS)
- [CVE-2017-18561](https://cve.now/CVE-2017-18561.md): The embed-comment-images plugin before 0.6 for WordPress has XSS. (no CVSS)
- [CVE-2017-18562](https://cve.now/CVE-2017-18562.md): The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2019-12624](https://cve.now/CVE-2019-12624.md): Cisco IOS XE NGWC Legacy Wireless Device Manager GUI Cross-Site Request Forgery Vulnerability (CVSS 8.8, Cisco IOS XE Software)
- [CVE-2019-12626](https://cve.now/CVE-2019-12626.md): Cisco Unified Contact Center Express Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Unified Contact Center Express)
- [CVE-2019-12627](https://cve.now/CVE-2019-12627.md): Cisco Firepower Threat Defense Software Information Disclosure Vulnerability (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2019-12634](https://cve.now/CVE-2019-12634.md): Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Denial of Service Vulnerability (CVSS 8.6, Cisco Unified Computing System Director)
- [CVE-2019-12621](https://cve.now/CVE-2019-12621.md): Cisco HyperFlex Static SSL Key Vulnerability (CVSS 6.8, Cisco HyperFlex HX-Series)
- [CVE-2019-12622](https://cve.now/CVE-2019-12622.md): Cisco RoomOS Software Privilege Escalation Vulnerability (CVSS 4.1, Cisco TelePresence CE Software)
- [CVE-2019-12623](https://cve.now/CVE-2019-12623.md): Cisco Enterprise Network Functions Virtualization Infrastructure Software File Enumeration Vulnerability (CVSS 4.3, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2015-9327](https://cve.now/CVE-2015-9327.md): The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS. (no CVSS)
- [CVE-2016-10910](https://cve.now/CVE-2016-10910.md): The formbuilder plugin before 1.06 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2019-11551](https://cve.now/CVE-2019-11551.md): In Code42 Enterprise and Crashplan for Small Business through Client version 6.9.1, an attacker can craft a restore request to restore a fil (no CVSS)
- [CVE-2012-6715](https://cve.now/CVE-2012-6715.md): The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header. (no CVSS)
- [CVE-2016-10911](https://cve.now/CVE-2016-10911.md): The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2015-9328](https://cve.now/CVE-2015-9328.md): The profile-builder plugin before 2.2.5 for WordPress has XSS. (no CVSS)
- [CVE-2014-10380](https://cve.now/CVE-2014-10380.md): The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms. (no CVSS)
- [CVE-2017-18563](https://cve.now/CVE-2017-18563.md): The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen. (no CVSS)
- [CVE-2017-18564](https://cve.now/CVE-2017-18564.md): The sender plugin before 1.2.1 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2016-10912](https://cve.now/CVE-2016-10912.md): The universal-analytics plugin before 1.3.1 for WordPress has XSS. (no CVSS)
- [CVE-2019-15295](https://cve.now/CVE-2019-15295.md): An Untrusted Search Path vulnerability in the ServiceInstance.dll library versions 1.0.15.119 and lower, as used in Bitdefender Antivirus Fr (no CVSS)
- [CVE-2019-11897](https://cve.now/CVE-2019-11897.md): Server-side request forgery in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software (CVSS 8.6, Bosch IoT Gateway Software · ProSyst mBS SDK)
- [CVE-2019-5032](https://cve.now/CVE-2019-5032.md): An exploitable out-of-bounds read vulnerability exists in the LabelSst record parser of Aspose Aspose.Cells 19.1.0 library. (CVSS 9.8, Aspose)
- [CVE-2019-5041](https://cve.now/CVE-2019-5041.md): An exploitable Stack Based Buffer Overflow vulnerability exists in the EnumMetaInfo function of Aspose Aspose.Words library, version 18.11.0 (CVSS 9.8, Aspose)
- [CVE-2019-5033](https://cve.now/CVE-2019-5033.md): An exploitable out-of-bounds read vulnerability exists in the Number record parser of Aspose Aspose.Cells 19.1.0 library. (CVSS 9.8, Aspose)
- [CVE-2019-3634](https://cve.now/CVE-2019-3634.md): Buffer overflow in DLP Endpoint for Windows (CVSS 4.4, McAfee Data Loss Prevention (DLPe) for Windows)
- [CVE-2019-3633](https://cve.now/CVE-2019-3633.md): Buffer overflow in DLP Endpoint for Windows (CVSS 4.4, McAfee Data Loss Prevention (DLPe) for Windows)
- [CVE-2017-18560](https://cve.now/CVE-2017-18560.md): The content-audit plugin before 1.9.2 for WordPress has XSS. (no CVSS)
- [CVE-2017-18558](https://cve.now/CVE-2017-18558.md): The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2017-18557](https://cve.now/CVE-2017-18557.md): The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2017-18556](https://cve.now/CVE-2017-18556.md): The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2017-18555](https://cve.now/CVE-2017-18555.md): The booking-sms plugin before 1.1.0 for WordPress has XSS. (no CVSS)
- [CVE-2017-18554](https://cve.now/CVE-2017-18554.md): The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event. (no CVSS)
- [CVE-2017-18553](https://cve.now/CVE-2017-18553.md): The ad-buttons plugin before 2.3.2 for WordPress has XSS. (no CVSS)
- [CVE-2016-10903](https://cve.now/CVE-2016-10903.md): The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF. (no CVSS)
- [CVE-2016-10902](https://cve.now/CVE-2016-10902.md): The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools. (no CVSS)
- [CVE-2016-10909](https://cve.now/CVE-2016-10909.md): The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection. (no CVSS)
- [CVE-2016-10901](https://cve.now/CVE-2016-10901.md): The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools. (no CVSS)
- [CVE-2016-10908](https://cve.now/CVE-2016-10908.md): The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS. (no CVSS)
- [CVE-2016-10900](https://cve.now/CVE-2016-10900.md): The uji-countdown plugin before 2.0.7 for WordPress has XSS. (no CVSS)
- [CVE-2019-15112](https://cve.now/CVE-2019-15112.md): The wp-slimstat plugin before 4.8.1 for WordPress has XSS. (no CVSS)
- [CVE-2017-18565](https://cve.now/CVE-2017-18565.md): The updater plugin before 1.35 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2019-15111](https://cve.now/CVE-2019-15111.md): The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue. (no CVSS)
- [CVE-2019-15110](https://cve.now/CVE-2019-15110.md): The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS. (no CVSS)
- [CVE-2017-18540](https://cve.now/CVE-2017-18540.md): The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes. (no CVSS)
- [CVE-2017-18539](https://cve.now/CVE-2017-18539.md): The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes. (no CVSS)
- [CVE-2017-18538](https://cve.now/CVE-2017-18538.md): The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes. (no CVSS)
- [CVE-2017-18537](https://cve.now/CVE-2017-18537.md): The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2016-10898](https://cve.now/CVE-2016-10898.md): The total-security plugin before 3.4.1 for WordPress has XSS. (no CVSS)
- [CVE-2016-10899](https://cve.now/CVE-2016-10899.md): The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability. (no CVSS)
- [CVE-2019-15109](https://cve.now/CVE-2019-15109.md): The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe\_paged URL parameter. (no CVSS)
- [CVE-2015-9321](https://cve.now/CVE-2015-9321.md): The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add\_query\_arg. (no CVSS)
- [CVE-2017-18534](https://cve.now/CVE-2017-18534.md): The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters. (no CVSS)
- [CVE-2016-10897](https://cve.now/CVE-2016-10897.md): The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2017-18536](https://cve.now/CVE-2017-18536.md): The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS. (no CVSS)
- [CVE-2016-10896](https://cve.now/CVE-2016-10896.md): The seo-redirection plugin before 4.3 for WordPress has stored XSS. (no CVSS)
- [CVE-2019-15296](https://cve.now/CVE-2019-15296.md): An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. (no CVSS)
- [CVE-2019-15293](https://cve.now/CVE-2019-15293.md): An issue was discovered in ACDSee Photo Studio Standard 22.1 Build 1159. (no CVSS)
- [CVE-2019-15292](https://cve.now/CVE-2019-15292.md): An issue was discovered in the Linux kernel before 5.0.9. (no CVSS)
- [CVE-2019-12746](https://cve.now/CVE-2019-12746.md): An issue was discovered in Open Ticket Request System (OTRS) Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. (no CVSS)
- [CVE-2019-13458](https://cve.now/CVE-2019-13458.md): An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x throu (CVSS 2.7)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-08-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.