CVEs published August 23, 2019
75 CVEs were published on August 23, 2019: 1 critical, 1 high.
- Published
- 75
- Critical
- 1
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 73
- Now in CISA KEV
- 0
- Fix available
- 29
Most affected products
- Atlassian Jira
- 10
- bolt/bolt
- 3
- Palo Alto Networks PAN-OS
- 3
- Autodesk Design Review
- 2
- floragunn Search Guard Kibana Plugin
- 2
- Little Snitch
- 2
- Apache Santuario - XML Security for Java · org.apache.santu…
- 1
- Atlassian Universal Plugin Manager
- 1
- Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…
- 1
- cesnet/simplesamlphp-module-proxystatistics
- 1
Critical 1
High 1
Medium, low and unrated 73
- CVE-2016-6154The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
- CVE-2019-15092The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, displ
- CVE-2019-12400In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a sApache Santuario - XML Security for Java · org.apache.santu…
- CVE-2019-5594An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin Fortinet FortiNAC
- CVE-2019-6695Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker tFortinet FortiManager
- CVE-2018-13367An information exposure vulnerability in FortiOS 6.2.3, 6.2.0 and below may allow an unauthenticated attacker to gain platform information sFortinet FortiOS
- CVE-2019-6698Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge oFortinet FortiRecorder
- CVE-2019-5592Multiple padding oracle vulnerabilities (Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length) in the CBC padding implementation of FortiOS IPS engFortinet IPS Engine
- CVE-2019-7364DLL preloading vulnerability in versions 2017, 2018, 2019, and 2020 of Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD ArchiAutodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…
- CVE-2019-7363Use-after-free vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018.Autodesk Design Review
- CVE-2019-7362DLL preloading vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018.Autodesk Design Review
- CVE-2019-15536The Acclaim block plugin before 2019-06-26 for Moodle allows SQL Injection via delete_records.
- CVE-2019-15537The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php.cesnet/simplesamlphp-module-proxystatistics
- CVE-2019-15535Tasking Manager before 3.4.0 allows SQL Injection via custom SQL.
- CVE-2019-1583Escalation of privilege vulnerability in the Palo Alto Networks Twistlock console 19.07.358 and earlier allows a Twistlock user with OperatoPalo Alto Networks Twistlock
- CVE-2019-1582Memory corruption in PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow an administrative user to cause arbitrary memory corrPalo Alto Networks PAN-OS
- CVE-2019-1580Memory corruption in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allowPalo Alto Networks PAN-OS
- CVE-2019-13013Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool.Little Snitch
- CVE-2019-13014Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool.Little Snitch
- CVE-2019-10750deeply is vulnerable to Prototype Pollution in versions before 3.1.0.deeply
- CVE-2019-10747set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1.set-value
- CVE-2019-10746mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0.mixin-deep
- CVE-2019-10751All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary fileHTTPIE
- CVE-2019-15526An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05.
- CVE-2019-15527An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05.
- CVE-2019-15528An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05.
- CVE-2019-15529An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05.
- CVE-2019-15530An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05.
- CVE-2019-15531GNU Libextractor through 1.9 has a heap-based buffer over-read in the function EXTRACTOR_dvi_extract_method in plugins/dvi_extractor.c.
- CVE-2019-15525There is Missing SSL Certificate Validation in the pw3270 terminal emulator before version 5.1.
- CVE-2019-15520comelz Quark before 2019-03-26 allows directory traversal to locations outside of the project directory.
- CVE-2019-15517jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal.
- CVE-2019-15518Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler.
- CVE-2019-15519Power-Response before 2019-02-02 allows directory traversal (up to the application's main directory) via a plugin.
- CVE-2019-15516Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply removes one ../ substring.
- CVE-2019-8447The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site rAtlassian Jira
- CVE-2019-8446The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorAtlassian Jira
- CVE-2019-8445Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worAtlassian Jira
- CVE-2019-8444The wikirenderer component in Jira before version 7.13.6, and from version 8.0.0 before version 8.3.2 allows remote attackers to inject arbiAtlassian Jira
- CVE-2019-14999The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before version 3.0.3 and from vAtlassian Universal Plugin Manager
- CVE-2019-11589The ChangeSharedFilterOwner resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before vAtlassian Jira
- CVE-2019-11588The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from versionAtlassian Jira
- CVE-2019-11587Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version Atlassian Jira
- CVE-2019-11586The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before versioAtlassian Jira
- CVE-2019-11585The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2Atlassian Jira
- CVE-2019-11584The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross sAtlassian Jira
- CVE-2019-13422Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially floragunn Search Guard Kibana Plugin
- CVE-2019-13423Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kfloragunn Search Guard Kibana Plugin
- CVE-2019-13421Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configufloragunn Search Guard
- CVE-2019-15482selectize-plugin-a11y before 1.1.0 has XSS via the msg field.selectize-plugin-a11y
- CVE-2019-15494openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.
- CVE-2019-15493openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.
- CVE-2019-15492openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.
- CVE-2019-15491openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.
- CVE-2019-15490openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.
- CVE-2019-15488Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.org.igniterealtime.openfire:xmppserver
- CVE-2019-15487DfE School Experience before v16333-GA has XSS via a teacher training URL.
- CVE-2019-15486django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline.django-js-reverse
- CVE-2019-15485Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.bolt/bolt
- CVE-2019-15484Bolt before 3.6.10 has XSS via an image's alt or title field.bolt/bolt
- CVE-2019-15483Bolt before 3.6.10 has XSS via a title that is mishandled in the system log.bolt/bolt
- CVE-2019-15481Kimai v2 before 1.1 has XSS via a timesheet description.kevinpapst/kimai2
- CVE-2019-15480Domoticz 4.10717 has XSS via item.Name.
- CVE-2019-15477Jooby before 1.6.4 has XSS via the default error handler.org.jooby:jooby
- CVE-2019-15476Former before 4.2.1 has XSS via a checkbox value.
- CVE-2019-15514The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is No
- CVE-2019-15513An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) before 15.05.1 as used on Motorola CX2L MWR0
- CVE-2019-15507In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-c
- CVE-2019-15508In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintV
- CVE-2019-15505drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB device traffic (which
- CVE-2019-15504drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traffic (which may be remo
- CVE-2019-15499CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with
- CVE-2019-15498cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --outpu