# CVEs published 2019-08-27

62 CVEs were published on August 27, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2019-15702](https://cve.now/CVE-2019-15702.md): In the TCP implementation (gnrc\_tcp) in RIOT through 2019.07, the parser for TCP options does not terminate on all inputs, allowing a denial (no CVSS)
- [CVE-2019-15701](https://cve.now/CVE-2019-15701.md): components/Modals/HelpModal.jsx in BloodHound 2.2.0 allows remote attackers to execute arbitrary OS commands (by spawning a child process as (no CVSS)
- [CVE-2019-15700](https://cve.now/CVE-2019-15700.md): public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by (no CVSS)
- [CVE-2019-13263](https://cve.now/CVE-2019-13263.md): D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the sa (no CVSS)
- [CVE-2019-13264](https://cve.now/CVE-2019-13264.md): D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the sa (no CVSS)
- [CVE-2019-13265](https://cve.now/CVE-2019-13265.md): D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the sa (no CVSS)
- [CVE-2019-13266](https://cve.now/CVE-2019-13266.md): TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are (no CVSS)
- [CVE-2019-13267](https://cve.now/CVE-2019-13267.md): TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are (no CVSS)
- [CVE-2019-13268](https://cve.now/CVE-2019-13268.md): TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are (no CVSS)
- [CVE-2019-13269](https://cve.now/CVE-2019-13269.md): Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the sa (no CVSS)
- [CVE-2019-13270](https://cve.now/CVE-2019-13270.md): Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the sa (no CVSS)
- [CVE-2019-13271](https://cve.now/CVE-2019-13271.md): Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the sa (no CVSS)
- [CVE-2019-15698](https://cve.now/CVE-2019-15698.md): In Octopus Deploy 2019.7.3 through 2019.7.9, in certain circumstances, an authenticated user with VariableView permissions could view sensit (no CVSS)
- [CVE-2019-13273](https://cve.now/CVE-2019-13273.md): In Xymon through 4.3.28, a buffer overflow vulnerability exists in the csvinfo CGI script. (no CVSS)
- [CVE-2019-13274](https://cve.now/CVE-2019-13274.md): In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter. (no CVSS)
- [CVE-2019-13451](https://cve.now/CVE-2019-13451.md): In Xymon through 4.3.28, a buffer overflow vulnerability exists in history.c. (no CVSS)
- [CVE-2019-13452](https://cve.now/CVE-2019-13452.md): In Xymon through 4.3.28, a buffer overflow vulnerability exists in reportlog.c. (no CVSS)
- [CVE-2019-13455](https://cve.now/CVE-2019-13455.md): In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the alert acknowledgment CGI tool because of   expansion (no CVSS)
- [CVE-2019-13484](https://cve.now/CVE-2019-13484.md): In Xymon through 4.3.28, a buffer overflow exists in the status-log viewer CGI because of   expansion in appfeed.c. (no CVSS)
- [CVE-2019-13485](https://cve.now/CVE-2019-13485.md): In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the history viewer component via a long hostname or service p (no CVSS)
- [CVE-2019-13486](https://cve.now/CVE-2019-13486.md): In Xymon through 4.3.28, a stack-based buffer overflow exists in the status-log viewer component because of   expansion in svcstatus.c. (no CVSS)
- [CVE-2019-14314](https://cve.now/CVE-2019-14314.md): A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. (no CVSS)
- [CVE-2019-11457](https://cve.now/CVE-2019-11457.md): Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-pass (CVSS 8.8, django-crm)
- [CVE-2019-15650](https://cve.now/CVE-2019-15650.md): The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling (no CVSS)
- [CVE-2015-9348](https://cve.now/CVE-2015-9348.md): The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs. (no CVSS)
- [CVE-2017-18592](https://cve.now/CVE-2017-18592.md): The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp\_upload directory for file uploads. (no CVSS)
- [CVE-2015-9352](https://cve.now/CVE-2015-9352.md): The wp-polls plugin before 2.72 for WordPress has SQL injection. (no CVSS)
- [CVE-2019-15660](https://cve.now/CVE-2019-15660.md): The wp-members plugin before 3.2.8 for WordPress has CSRF. (no CVSS)
- [CVE-2016-10936](https://cve.now/CVE-2016-10936.md): The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option. (no CVSS)
- [CVE-2017-18591](https://cve.now/CVE-2017-18591.md): The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php. (no CVSS)
- [CVE-2015-9350](https://cve.now/CVE-2015-9350.md): The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button. (no CVSS)
- [CVE-2015-9351](https://cve.now/CVE-2015-9351.md): The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button. (no CVSS)
- [CVE-2015-9349](https://cve.now/CVE-2015-9349.md): The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser. (no CVSS)
- [CVE-2016-10935](https://cve.now/CVE-2016-10935.md): The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation. (no CVSS)
- [CVE-2018-21006](https://cve.now/CVE-2018-21006.md): The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF. (no CVSS)
- [CVE-2019-15659](https://cve.now/CVE-2019-15659.md): The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969. (no CVSS)
- [CVE-2018-21005](https://cve.now/CVE-2018-21005.md): The bbp-move-topics plugin before 1.1.6 for WordPress has code injection. (no CVSS)
- [CVE-2017-18590](https://cve.now/CVE-2017-18590.md): The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues. (no CVSS)
- [CVE-2015-9347](https://cve.now/CVE-2015-9347.md): The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors. (no CVSS)
- [CVE-2014-10395](https://cve.now/CVE-2014-10395.md): The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list. (no CVSS)
- [CVE-2015-9346](https://cve.now/CVE-2015-9346.md): The cp-polls plugin before 1.0.5 for WordPress has XSS. (no CVSS)
- [CVE-2016-10934](https://cve.now/CVE-2016-10934.md): The check-email plugin before 0.5.2 for WordPress has XSS. (no CVSS)
- [CVE-2019-15649](https://cve.now/CVE-2019-15649.md): The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload. (no CVSS)
- [CVE-2019-15648](https://cve.now/CVE-2019-15648.md): The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renam (no CVSS)
- [CVE-2019-15647](https://cve.now/CVE-2019-15647.md): The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk\_action\_listener remote code execution. (no CVSS)
- [CVE-2018-21004](https://cve.now/CVE-2018-21004.md): The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection. (no CVSS)
- [CVE-2019-15646](https://cve.now/CVE-2019-15646.md): The rsvpmaker plugin before 6.2 for WordPress has SQL injection. (no CVSS)
- [CVE-2015-9345](https://cve.now/CVE-2015-9345.md): The link-log plugin before 2.0 for WordPress has HTTP Response Splitting. (no CVSS)
- [CVE-2015-9344](https://cve.now/CVE-2015-9344.md): The link-log plugin before 2.1 for WordPress has SQL injection. (no CVSS)
- [CVE-2018-21003](https://cve.now/CVE-2018-21003.md): The buddyforms plugin before 2.2.8 for WordPress has SQL injection. (no CVSS)
- [CVE-2018-21002](https://cve.now/CVE-2018-21002.md): The js-support-ticket plugin before 2.0.6 for WordPress has CSRF. (no CVSS)
- [CVE-2019-15645](https://cve.now/CVE-2019-15645.md): The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF. (no CVSS)
- [CVE-2019-15644](https://cve.now/CVE-2019-15644.md): The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS. (no CVSS)
- [CVE-2015-9343](https://cve.now/CVE-2015-9343.md): The wp-rollback plugin before 1.2.3 for WordPress has CSRF. (no CVSS)
- [CVE-2015-9342](https://cve.now/CVE-2015-9342.md): The wp-rollback plugin before 1.2.3 for WordPress has XSS. (no CVSS)
- [CVE-2019-15643](https://cve.now/CVE-2019-15643.md): The ultimate-faqs plugin before 1.8.22 for WordPress has XSS. (no CVSS)
- [CVE-2018-21001](https://cve.now/CVE-2018-21001.md): The anycomment plugin before 0.0.33 for WordPress has XSS. (no CVSS)
- [CVE-2019-13237](https://cve.now/CVE-2019-13237.md): In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access serve (no CVSS, org.opencms:opencms-core)
- [CVE-2019-13236](https://cve.now/CVE-2019-13236.md): In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface. (no CVSS, org.opencms:opencms-core)
- [CVE-2019-13235](https://cve.now/CVE-2019-13235.md): In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form. (no CVSS, org.opencms:opencms-core)
- [CVE-2019-13234](https://cve.now/CVE-2019-13234.md): In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine. (no CVSS, org.opencms:opencms-core)
- [CVE-2019-15666](https://cve.now/CVE-2019-15666.md): An issue was discovered in the Linux kernel before 5.0.19. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-08-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.