CVEs published August 27, 2019
62 CVEs were published on August 27, 2019: 0 critical, 1 high.
- Published
- 62
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 61
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- org.opencms:opencms-core
- 4
- django-crm
- 1
High 1
Medium, low and unrated 61
- CVE-2019-15702In the TCP implementation (gnrc_tcp) in RIOT through 2019.07, the parser for TCP options does not terminate on all inputs, allowing a denial
- CVE-2019-15701components/Modals/HelpModal.jsx in BloodHound 2.2.0 allows remote attackers to execute arbitrary OS commands (by spawning a child process as
- CVE-2019-15700public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by
- CVE-2019-13263D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the sa
- CVE-2019-13264D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the sa
- CVE-2019-13265D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the sa
- CVE-2019-13266TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are
- CVE-2019-13267TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are
- CVE-2019-13268TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are
- CVE-2019-13269Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the sa
- CVE-2019-13270Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the sa
- CVE-2019-13271Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the sa
- CVE-2019-15698In Octopus Deploy 2019.7.3 through 2019.7.9, in certain circumstances, an authenticated user with VariableView permissions could view sensit
- CVE-2019-13273In Xymon through 4.3.28, a buffer overflow vulnerability exists in the csvinfo CGI script.
- CVE-2019-13274In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter.
- CVE-2019-13451In Xymon through 4.3.28, a buffer overflow vulnerability exists in history.c.
- CVE-2019-13452In Xymon through 4.3.28, a buffer overflow vulnerability exists in reportlog.c.
- CVE-2019-13455In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the alert acknowledgment CGI tool because of expansion
- CVE-2019-13484In Xymon through 4.3.28, a buffer overflow exists in the status-log viewer CGI because of expansion in appfeed.c.
- CVE-2019-13485In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the history viewer component via a long hostname or service p
- CVE-2019-13486In Xymon through 4.3.28, a stack-based buffer overflow exists in the status-log viewer component because of expansion in svcstatus.c.
- CVE-2019-14314A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress.
- CVE-2019-15650The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling
- CVE-2015-9348The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.
- CVE-2017-18592The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.
- CVE-2015-9352The wp-polls plugin before 2.72 for WordPress has SQL injection.
- CVE-2019-15660The wp-members plugin before 3.2.8 for WordPress has CSRF.
- CVE-2016-10936The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.
- CVE-2017-18591The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.
- CVE-2015-9350The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.
- CVE-2015-9351The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.
- CVE-2015-9349The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.
- CVE-2016-10935The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.
- CVE-2018-21006The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.
- CVE-2019-15659The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.
- CVE-2018-21005The bbp-move-topics plugin before 1.1.6 for WordPress has code injection.
- CVE-2017-18590The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.
- CVE-2015-9347The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.
- CVE-2014-10395The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.
- CVE-2015-9346The cp-polls plugin before 1.0.5 for WordPress has XSS.
- CVE-2016-10934The check-email plugin before 0.5.2 for WordPress has XSS.
- CVE-2019-15649The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload.
- CVE-2019-15648The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renam
- CVE-2019-15647The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.
- CVE-2018-21004The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection.
- CVE-2019-15646The rsvpmaker plugin before 6.2 for WordPress has SQL injection.
- CVE-2015-9345The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.
- CVE-2015-9344The link-log plugin before 2.1 for WordPress has SQL injection.
- CVE-2018-21003The buddyforms plugin before 2.2.8 for WordPress has SQL injection.
- CVE-2018-21002The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.
- CVE-2019-15645The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.
- CVE-2019-15644The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.
- CVE-2015-9343The wp-rollback plugin before 1.2.3 for WordPress has CSRF.
- CVE-2015-9342The wp-rollback plugin before 1.2.3 for WordPress has XSS.
- CVE-2019-15643The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.
- CVE-2018-21001The anycomment plugin before 0.0.33 for WordPress has XSS.
- CVE-2019-13237In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access serveorg.opencms:opencms-core
- CVE-2019-13236In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.org.opencms:opencms-core
- CVE-2019-13235In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.org.opencms:opencms-core
- CVE-2019-13234In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.org.opencms:opencms-core
- CVE-2019-15666An issue was discovered in the Linux kernel before 5.0.19.