# CVEs published 2019-08-22

111 CVEs were published on August 22, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2014-10393](https://cve.now/CVE-2014-10393.md): The cforms2 plugin before 10.5 for WordPress has XSS. (no CVSS)
- [CVE-2019-13139](https://cve.now/CVE-2019-13139.md): In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be abl (no CVSS)
- [CVE-2015-9334](https://cve.now/CVE-2015-9334.md): The email-newsletter plugin through 20.15 for WordPress has SQL injection. (no CVSS)
- [CVE-2017-18578](https://cve.now/CVE-2017-18578.md): The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS. (no CVSS)
- [CVE-2017-18579](https://cve.now/CVE-2017-18579.md): The corner-ad plugin before 1.0.8 for WordPress has XSS. (no CVSS)
- [CVE-2014-10382](https://cve.now/CVE-2014-10382.md): The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment. (no CVSS)
- [CVE-2016-10928](https://cve.now/CVE-2016-10928.md): The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users. (no CVSS)
- [CVE-2016-10929](https://cve.now/CVE-2016-10929.md): The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in. (no CVSS)
- [CVE-2018-20986](https://cve.now/CVE-2018-20986.md): The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors. (no CVSS)
- [CVE-2017-18585](https://cve.now/CVE-2017-18585.md): The posts-in-page plugin before 1.3.0 for WordPress has ic\_add\_posts template='../ directory traversal. (no CVSS)
- [CVE-2013-7483](https://cve.now/CVE-2013-7483.md): The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion. (no CVSS)
- [CVE-2019-15325](https://cve.now/CVE-2019-15325.md): In GalliumOS 3.0, CONFIG\_SECURITY\_YAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/ptrace\_scope to 1, wh (no CVSS)
- [CVE-2019-15326](https://cve.now/CVE-2019-15326.md): The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal. (no CVSS)
- [CVE-2019-15327](https://cve.now/CVE-2019-15327.md): The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data. (no CVSS)
- [CVE-2019-15328](https://cve.now/CVE-2019-15328.md): The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS. (no CVSS)
- [CVE-2019-15329](https://cve.now/CVE-2019-15329.md): The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF. (no CVSS)
- [CVE-2014-10386](https://cve.now/CVE-2014-10386.md): The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections. (no CVSS)
- [CVE-2018-20987](https://cve.now/CVE-2018-20987.md): The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection. (no CVSS)
- [CVE-2015-9338](https://cve.now/CVE-2015-9338.md): The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files. (no CVSS)
- [CVE-2015-9339](https://cve.now/CVE-2015-9339.md): The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files. (no CVSS)
- [CVE-2015-9340](https://cve.now/CVE-2015-9340.md): The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, (no CVSS)
- [CVE-2015-9341](https://cve.now/CVE-2015-9341.md): The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files. (no CVSS)
- [CVE-2019-15330](https://cve.now/CVE-2019-15330.md): The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading. (no CVSS)
- [CVE-2019-15331](https://cve.now/CVE-2019-15331.md): The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection. (no CVSS)
- [CVE-2016-10930](https://cve.now/CVE-2016-10930.md): The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number. (no CVSS)
- [CVE-2019-15060](https://cve.now/CVE-2019-15060.md): The traceroute function on the TP-Link TL-WR840N v4 router with firmware through 0.9.1 3.16 is vulnerable to remote code execution via a cra (no CVSS)
- [CVE-2014-10387](https://cve.now/CVE-2014-10387.md): The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection. (no CVSS)
- [CVE-2014-10388](https://cve.now/CVE-2014-10388.md): The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure. (no CVSS)
- [CVE-2014-10389](https://cve.now/CVE-2014-10389.md): The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication. (no CVSS)
- [CVE-2014-10390](https://cve.now/CVE-2014-10390.md): The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal. (no CVSS)
- [CVE-2014-10391](https://cve.now/CVE-2014-10391.md): The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection. (no CVSS)
- [CVE-2018-20988](https://cve.now/CVE-2018-20988.md): The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation. (no CVSS)
- [CVE-2014-10392](https://cve.now/CVE-2014-10392.md): The cforms2 plugin before 10.2 for WordPress has XSS. (no CVSS)
- [CVE-2017-18586](https://cve.now/CVE-2017-18586.md): The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths. (no CVSS)
- [CVE-2014-10394](https://cve.now/CVE-2014-10394.md): The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header. (no CVSS)
- [CVE-2019-12386](https://cve.now/CVE-2019-12386.md): An issue was discovered in Ampache through 3.9.1. (no CVSS)
- [CVE-2019-12385](https://cve.now/CVE-2019-12385.md): An issue was discovered in Ampache through 3.9.1. (no CVSS)
- [CVE-2019-14469](https://cve.now/CVE-2019-14469.md): In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS. (no CVSS)
- [CVE-2019-7617](https://cve.now/CVE-2019-7617.md): When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker (no CVSS, Elastic APM agent for Python · elastic-apm)
- [CVE-2019-14751](https://cve.now/CVE-2019-14751.md): NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) i (no CVSS, nltk)
- [CVE-2019-9155](https://cve.now/CVE-2019-9155.md): A cryptographic issue in OpenPGP.js \<=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryptio (no CVSS, openpgp)
- [CVE-2019-9154](https://cve.now/CVE-2019-9154.md): Improper Verification of a Cryptographic Signature in OpenPGP.js \<=4.1.2 allows an attacker to pass off unsigned data as signed. (no CVSS, openpgp)
- [CVE-2019-9153](https://cve.now/CVE-2019-9153.md): Improper Verification of a Cryptographic Signature in OpenPGP.js \<=4.1.2 allows an attacker to forge signed messages by replacing its signat (no CVSS, openpgp)
- [CVE-2019-11031](https://cve.now/CVE-2019-11031.md): Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the auto-update feature of IDVRUpdateService2 in DVRServer.exe. (no CVSS)
- [CVE-2019-11030](https://cve.now/CVE-2019-11030.md): Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailSer (no CVSS)
- [CVE-2019-11029](https://cve.now/CVE-2019-11029.md): Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, leading to Directory (no CVSS)
- [CVE-2019-11013](https://cve.now/CVE-2019-11013.md): Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. (no CVSS)
- [CVE-2018-18573](https://cve.now/CVE-2018-18573.md): osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. (no CVSS)
- [CVE-2018-18572](https://cve.now/CVE-2018-18572.md): osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. (no CVSS)
- [CVE-2019-5635](https://cve.now/CVE-2019-5635.md): Hickory Smart Lock Cleartext Password (CVSS 6.5, Belwith Products Hickory Smart Ethernet Bridge)
- [CVE-2019-5634](https://cve.now/CVE-2019-5634.md): Hickory Smart Lock Insecure Logging on Android (CVSS 6.5, Belwith Products Hickory Smart)
- [CVE-2019-5633](https://cve.now/CVE-2019-5633.md): Hickory Smart Lock Insecure Storage on iOS (CVSS 6.5, Belwith Products Hickory Smart)
- [CVE-2019-5632](https://cve.now/CVE-2019-5632.md): Hickory Smart Lock Insecure Storage on Android (CVSS 6.5, Belwith Products Hickory Smart)
- [CVE-2017-18584](https://cve.now/CVE-2017-18584.md): The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action. (no CVSS)
- [CVE-2017-18583](https://cve.now/CVE-2017-18583.md): The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection. (no CVSS)
- [CVE-2015-9337](https://cve.now/CVE-2015-9337.md): The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX. (no CVSS)
- [CVE-2019-15324](https://cve.now/CVE-2019-15324.md): The ad-inserter plugin before 2.4.22 for WordPress has remote code execution. (no CVSS)
- [CVE-2019-15323](https://cve.now/CVE-2019-15323.md): The ad-inserter plugin before 2.4.20 for WordPress has path traversal. (no CVSS)
- [CVE-2017-18582](https://cve.now/CVE-2017-18582.md): The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2017-18581](https://cve.now/CVE-2017-18581.md): The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list. (no CVSS)
- [CVE-2018-20985](https://cve.now/CVE-2018-20985.md): The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec. (no CVSS)
- [CVE-2017-18580](https://cve.now/CVE-2017-18580.md): The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode. (no CVSS)
- [CVE-2019-15322](https://cve.now/CVE-2019-15322.md): The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion. (no CVSS)
- [CVE-2018-20984](https://cve.now/CVE-2018-20984.md): The patreon-connect plugin before 1.2.2 for WordPress has Object Injection. (no CVSS)
- [CVE-2019-15321](https://cve.now/CVE-2019-15321.md): The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled. (no CVSS)
- [CVE-2019-15320](https://cve.now/CVE-2019-15320.md): The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled. (no CVSS)
- [CVE-2019-15319](https://cve.now/CVE-2019-15319.md): The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce. (no CVSS)
- [CVE-2016-10927](https://cve.now/CVE-2016-10927.md): The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php. (no CVSS)
- [CVE-2016-10926](https://cve.now/CVE-2016-10926.md): The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php. (no CVSS)
- [CVE-2014-10385](https://cve.now/CVE-2014-10385.md): The memphis-documents-library plugin before 3.0 for WordPress has XSS via $\_REQUEST. (no CVSS)
- [CVE-2014-10384](https://cve.now/CVE-2014-10384.md): The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion. (no CVSS)
- [CVE-2014-10383](https://cve.now/CVE-2014-10383.md): The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion. (no CVSS)
- [CVE-2018-20983](https://cve.now/CVE-2018-20983.md): The wp-retina-2x plugin before 5.2.3 for WordPress has XSS. (no CVSS)
- [CVE-2008-7321](https://cve.now/CVE-2008-7321.md): The tubepress plugin before 1.6.5 for WordPress has XSS. (no CVSS)
- [CVE-2013-7482](https://cve.now/CVE-2013-7482.md): The reflex-gallery plugin before 1.4.3 for WordPress has XSS. (no CVSS)
- [CVE-2016-10925](https://cve.now/CVE-2016-10925.md): The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs. (no CVSS)
- [CVE-2017-18577](https://cve.now/CVE-2017-18577.md): The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add\_query\_arg. (no CVSS)
- [CVE-2016-10924](https://cve.now/CVE-2016-10924.md): The ebook-download plugin before 1.2 for WordPress has directory traversal. (no CVSS)
- [CVE-2017-18576](https://cve.now/CVE-2017-18576.md): The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation. (no CVSS)
- [CVE-2016-10923](https://cve.now/CVE-2016-10923.md): The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation. (no CVSS)
- [CVE-2016-10922](https://cve.now/CVE-2016-10922.md): The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation. (no CVSS)
- [CVE-2017-18575](https://cve.now/CVE-2017-18575.md): The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues. (no CVSS)
- [CVE-2018-20982](https://cve.now/CVE-2018-20982.md): The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin subme (no CVSS)
- [CVE-2013-7481](https://cve.now/CVE-2013-7481.md): The contact-form-plugin plugin before 3.3.5 for WordPress has XSS. (no CVSS)
- [CVE-2019-15318](https://cve.now/CVE-2019-15318.md): The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field. (no CVSS)
- [CVE-2017-18574](https://cve.now/CVE-2017-18574.md): The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder. (no CVSS)
- [CVE-2018-20981](https://cve.now/CVE-2018-20981.md): The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data req (no CVSS)
- [CVE-2009-5158](https://cve.now/CVE-2009-5158.md): The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text. (no CVSS)
- [CVE-2018-20980](https://cve.now/CVE-2018-20980.md): The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering. (no CVSS)
- [CVE-2018-20979](https://cve.now/CVE-2018-20979.md): The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability\_type mishandling in register\_post\_type. (no CVSS)
- [CVE-2017-18573](https://cve.now/CVE-2017-18573.md): The simple-login-log plugin before 1.1.2 for WordPress has SQL injection. (no CVSS)
- [CVE-2016-10921](https://cve.now/CVE-2016-10921.md): The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection. (no CVSS)
- [CVE-2016-10920](https://cve.now/CVE-2016-10920.md): The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS. (no CVSS)
- [CVE-2017-18572](https://cve.now/CVE-2017-18572.md): The gnucommerce plugin before 1.4.2 for WordPress has XSS. (no CVSS)
- [CVE-2012-6716](https://cve.now/CVE-2012-6716.md): The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links. (no CVSS)
- [CVE-2013-7480](https://cve.now/CVE-2013-7480.md): The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas. (no CVSS)
- [CVE-2013-7479](https://cve.now/CVE-2013-7479.md): The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field. (no CVSS)
- [CVE-2013-7478](https://cve.now/CVE-2013-7478.md): The events-manager plugin before 5.5 for WordPress has XSS via EM\_Ticket::get\_post. (no CVSS)
- [CVE-2019-14511](https://cve.now/CVE-2019-14511.md): Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered (no CVSS)
- [CVE-2013-7477](https://cve.now/CVE-2013-7477.md): The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form. (no CVSS)
- [CVE-2016-10919](https://cve.now/CVE-2016-10919.md): The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add\_siteurl method, a different vulnerabilit (no CVSS)
- [CVE-2016-10918](https://cve.now/CVE-2016-10918.md): The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF. (no CVSS)
- [CVE-2019-15317](https://cve.now/CVE-2019-15317.md): The give plugin before 2.4.7 for WordPress has XSS via a donor name. (no CVSS)
- [CVE-2015-9336](https://cve.now/CVE-2015-9336.md): The clean-login plugin before 1.5.1 for WordPress has reflected XSS. (no CVSS)
- [CVE-2017-18571](https://cve.now/CVE-2017-18571.md): The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-201 (no CVSS)
- [CVE-2016-10917](https://cve.now/CVE-2016-10917.md): The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CV (no CVSS)
- [CVE-2015-9335](https://cve.now/CVE-2015-9335.md): The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling. (no CVSS)
- [CVE-2019-15314](https://cve.now/CVE-2019-15314.md): tiki/tiki-upload\_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download (no CVSS)
- [CVE-2015-9333](https://cve.now/CVE-2015-9333.md): The cforms2 plugin before 14.6.10 for WordPress has SQL injection. (no CVSS)
- [CVE-2017-18570](https://cve.now/CVE-2017-18570.md): The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries. (no CVSS)
- [CVE-2016-10916](https://cve.now/CVE-2016-10916.md): The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-08-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.