CVEs published August 28, 2019
70 CVEs were published on August 28, 2019: 1 critical, 5 high. 1 is now in CISA KEV.
- Published
- 70
- Critical
- 1
- High
- 5
- Medium
- 0
- Low
- 0
- Unrated
- 64
- Now in CISA KEV
- 1
- Fix available
- 10
Most affected products
- Cisco NX-OS Software
- 2
- Cisco Unified Computing System
- 2
- Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- 2
- Cisco IOS XE Software
- 1
- Fortinet FortiWeb
- 1
- Jenkins project Jenkins IBM Application Security on Cloud P…
- 1
- Jenkins project Jenkins Splunk Plugin · com.splunk.splunkin…
- 1
- os-vif
- 1
Critical 1
High 5
- CVE-2019-15752Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.ex
- CVE-2019-1964Cisco NX-OS Software IPv6 Denial of Service VulnerabilityCisco NX-OS Software
- CVE-2019-1965Cisco NX-OS Software Remote Management Memory Leak Denial of Service VulnerabilityCisco NX-OS Software
- CVE-2019-1962Cisco NX-OS Software Cisco Fabric Services over IP Denial of Service VulnerabilityCisco Unified Computing System
- CVE-2019-1963Cisco FXOS and NX-OS Software Authenticated Simple Network Management Protocol Denial of Service VulnerabilityCisco Unified Computing System
Medium, low and unrated 64
- CVE-2017-18594nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated b
- CVE-2019-10724There is a vulnerability with the Dolby DAX2 API system services in which a low-privileged user can terminate arbitrary processes that are r
- CVE-2019-9931Various Lexmark printers contain a denial of service vulnerability in the SNMP service that can be exploited to crash the device.
- CVE-2019-9933Various Lexmark products have a Buffer Overflow (issue 3 of 3).
- CVE-2019-9932Various Lexmark products have a Buffer Overflow (issue 2 of 3).
- CVE-2019-9930Various Lexmark products have an Integer Overflow.
- CVE-2019-10057Various Lexmark products have CSRF.
- CVE-2019-10059The legacy finger service (TCP port 79) is enabled by default on various older Lexmark devices.
- CVE-2019-15753In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatos-vif
- CVE-2019-10056An issue was discovered in Suricata 4.1.3.
- CVE-2019-10055An issue was discovered in Suricata 4.1.3.
- CVE-2019-10054An issue was discovered in Suricata 4.1.3.
- CVE-2019-10052An issue was discovered in Suricata 4.1.3.
- CVE-2019-10051An issue was discovered in Suricata 4.1.3.
- CVE-2019-14694A use-after-free flaw in the sandbox container implemented in cmdguard.sys in Comodo Antivirus 12.0.0.6870 can be triggered due to a race co
- CVE-2019-5590The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized cFortinet FortiWeb
- CVE-2019-15496MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack.
- CVE-2019-15230LibreNMS v1.54 has XSS in the Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template sections
- CVE-2019-15720CloudBerry Backup v6.1.2.34 allows local privilege escalation via a Pre or Post backup action.
- CVE-2019-10058Various Lexmark products have Incorrect Access Control.
- CVE-2019-9935Various Lexmark products have Incorrect Access Control (issue 2 of 2).
- CVE-2019-9934Various Lexmark products have Incorrect Access Control (issue 1 of 2).
- CVE-2019-13348In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in clearte
- CVE-2019-13189In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page.
- CVE-2019-10384Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2019-10390A sandbox bypass vulnerability in Jenkins Splunk Plugin 1.7.4 and earlier allowed attackers with Overall/Read permission to provide a GroovyJenkins project Jenkins Splunk Plugin · com.splunk.splunkin…
- CVE-2019-10391Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuratiJenkins project Jenkins IBM Application Security on Cloud P…
- CVE-2019-10383A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2015-9359The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2019-15716WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys i
- CVE-2015-9379iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9378iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9377iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9376iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9375Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9374Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9373PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9372Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9371Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9370Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9369Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9368Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9367Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9366Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9365Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-93642Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9363iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9362The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9361The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9360The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2019-15713The my-calendar plugin before 3.1.10 for WordPress has XSS.
- CVE-2019-15714cli/lib/main.js in Entropic before 2019-06-13 does not reject / and \ in command names, which might allow a directory traversal attack in un
- CVE-2015-9358The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().
- CVE-2015-9357The akismet plugin before 3.1.5 for WordPress has XSS.
- CVE-2015-9356The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460.
- CVE-2017-18593The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.
- CVE-2015-9355The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
- CVE-2012-6719The sharebar plugin before 1.2.2 for WordPress has SQL injection.
- CVE-2012-6718The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491.
- CVE-2011-5329The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562.
- CVE-2012-6717The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562.
- CVE-2015-9354The gigpress plugin before 2.3.11 for WordPress has XSS.
- CVE-2015-9353The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.
- CVE-2019-15294An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2).