CVEs published August 22, 2019
111 CVEs were published on August 22, 2019: 0 critical, 0 high.
- Published
- 111
- Critical
- 0
- High
- 0
- Medium
- 4
- Low
- 0
- Unrated
- 107
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Belwith Products Hickory Smart
- 3
- openpgp
- 3
- Belwith Products Hickory Smart Ethernet Bridge
- 1
- Elastic APM agent for Python · elastic-apm
- 1
- nltk
- 1
Medium, low and unrated 111
- CVE-2014-10393The cforms2 plugin before 10.5 for WordPress has XSS.
- CVE-2019-13139In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be abl
- CVE-2015-9334The email-newsletter plugin through 20.15 for WordPress has SQL injection.
- CVE-2017-18578The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.
- CVE-2017-18579The corner-ad plugin before 1.0.8 for WordPress has XSS.
- CVE-2014-10382The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.
- CVE-2016-10928The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.
- CVE-2016-10929The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.
- CVE-2018-20986The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.
- CVE-2017-18585The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.
- CVE-2013-7483The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion.
- CVE-2019-15325In GalliumOS 3.0, CONFIG_SECURITY_YAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/ptrace_scope to 1, wh
- CVE-2019-15326The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.
- CVE-2019-15327The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.
- CVE-2019-15328The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.
- CVE-2019-15329The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.
- CVE-2014-10386The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.
- CVE-2018-20987The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.
- CVE-2015-9338The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.
- CVE-2015-9339The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.
- CVE-2015-9340The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm,
- CVE-2015-9341The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.
- CVE-2019-15330The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.
- CVE-2019-15331The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection.
- CVE-2016-10930The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.
- CVE-2019-15060The traceroute function on the TP-Link TL-WR840N v4 router with firmware through 0.9.1 3.16 is vulnerable to remote code execution via a cra
- CVE-2014-10387The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection.
- CVE-2014-10388The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure.
- CVE-2014-10389The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication.
- CVE-2014-10390The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal.
- CVE-2014-10391The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection.
- CVE-2018-20988The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation.
- CVE-2014-10392The cforms2 plugin before 10.2 for WordPress has XSS.
- CVE-2017-18586The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.
- CVE-2014-10394The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header.
- CVE-2019-12386An issue was discovered in Ampache through 3.9.1.
- CVE-2019-12385An issue was discovered in Ampache through 3.9.1.
- CVE-2019-14469In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS.
- CVE-2019-7617When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attackerElastic APM agent for Python · elastic-apm
- CVE-2019-14751NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) inltk
- CVE-2019-9155A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryptioopenpgp
- CVE-2019-9154Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed.openpgp
- CVE-2019-9153Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatopenpgp
- CVE-2019-11031Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the auto-update feature of IDVRUpdateService2 in DVRServer.exe.
- CVE-2019-11030Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailSer
- CVE-2019-11029Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, leading to Directory
- CVE-2019-11013Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability.
- CVE-2018-18573osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page.
- CVE-2018-18572osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page.
- CVE-2019-5635Hickory Smart Lock Cleartext PasswordBelwith Products Hickory Smart Ethernet Bridge
- CVE-2019-5634Hickory Smart Lock Insecure Logging on AndroidBelwith Products Hickory Smart
- CVE-2019-5633Hickory Smart Lock Insecure Storage on iOSBelwith Products Hickory Smart
- CVE-2019-5632Hickory Smart Lock Insecure Storage on AndroidBelwith Products Hickory Smart
- CVE-2017-18584The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.
- CVE-2017-18583The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.
- CVE-2015-9337The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.
- CVE-2019-15324The ad-inserter plugin before 2.4.22 for WordPress has remote code execution.
- CVE-2019-15323The ad-inserter plugin before 2.4.20 for WordPress has path traversal.
- CVE-2017-18582The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.
- CVE-2017-18581The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.
- CVE-2018-20985The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec.
- CVE-2017-18580The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.
- CVE-2019-15322The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.
- CVE-2018-20984The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.
- CVE-2019-15321The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.
- CVE-2019-15320The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.
- CVE-2019-15319The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.
- CVE-2016-10927The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.
- CVE-2016-10926The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.
- CVE-2014-10385The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.
- CVE-2014-10384The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.
- CVE-2014-10383The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.
- CVE-2018-20983The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.
- CVE-2008-7321The tubepress plugin before 1.6.5 for WordPress has XSS.
- CVE-2013-7482The reflex-gallery plugin before 1.4.3 for WordPress has XSS.
- CVE-2016-10925The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.
- CVE-2017-18577The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.
- CVE-2016-10924The ebook-download plugin before 1.2 for WordPress has directory traversal.
- CVE-2017-18576The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.
- CVE-2016-10923The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.
- CVE-2016-10922The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.
- CVE-2017-18575The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.
- CVE-2018-20982The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin subme
- CVE-2013-7481The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.
- CVE-2019-15318The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.
- CVE-2017-18574The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
- CVE-2018-20981The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data req
- CVE-2009-5158The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.
- CVE-2018-20980The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.
- CVE-2018-20979The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type.
- CVE-2017-18573The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
- CVE-2016-10921The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.
- CVE-2016-10920The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.
- CVE-2017-18572The gnucommerce plugin before 1.4.2 for WordPress has XSS.
- CVE-2012-6716The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.
- CVE-2013-7480The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.
- CVE-2013-7479The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
- CVE-2013-7478The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.
- CVE-2019-14511Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered
- CVE-2013-7477The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.
- CVE-2016-10919The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerabilit
- CVE-2016-10918The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.
- CVE-2019-15317The give plugin before 2.4.7 for WordPress has XSS via a donor name.
- CVE-2015-9336The clean-login plugin before 1.5.1 for WordPress has reflected XSS.
- CVE-2017-18571The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-201
- CVE-2016-10917The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CV
- CVE-2015-9335The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling.
- CVE-2019-15314tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download
- CVE-2015-9333The cforms2 plugin before 14.6.10 for WordPress has SQL injection.
- CVE-2017-18570The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.
- CVE-2016-10916The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.