# CVEs published 2019-08-28

70 CVEs were published on August 28, 2019: 1 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-18594](https://cve.now/CVE-2017-18594.md): nse\_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated b (no CVSS)
- [CVE-2019-10724](https://cve.now/CVE-2019-10724.md): There is a vulnerability with the Dolby DAX2 API system services in which a low-privileged user can terminate arbitrary processes that are r (no CVSS)
- [CVE-2019-9931](https://cve.now/CVE-2019-9931.md): Various Lexmark printers contain a denial of service vulnerability in the SNMP service that can be exploited to crash the device. (no CVSS)
- [CVE-2019-9933](https://cve.now/CVE-2019-9933.md): Various Lexmark products have a Buffer Overflow (issue 3 of 3). (no CVSS)
- [CVE-2019-9932](https://cve.now/CVE-2019-9932.md): Various Lexmark products have a Buffer Overflow (issue 2 of 3). (no CVSS)
- [CVE-2019-9930](https://cve.now/CVE-2019-9930.md): Various Lexmark products have an Integer Overflow. (no CVSS)
- [CVE-2019-10057](https://cve.now/CVE-2019-10057.md): Various Lexmark products have CSRF. (no CVSS)
- [CVE-2019-10059](https://cve.now/CVE-2019-10059.md): The legacy finger service (TCP port 79) is enabled by default on various older Lexmark devices. (no CVSS)
- [CVE-2019-15753](https://cve.now/CVE-2019-15753.md): In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligat (no CVSS, os-vif)
- [CVE-2019-15752](https://cve.now/CVE-2019-15752.md): Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.ex (CVSS 7.8, KEV)
- [CVE-2019-10056](https://cve.now/CVE-2019-10056.md): An issue was discovered in Suricata 4.1.3. (no CVSS)
- [CVE-2019-10055](https://cve.now/CVE-2019-10055.md): An issue was discovered in Suricata 4.1.3. (no CVSS)
- [CVE-2019-10054](https://cve.now/CVE-2019-10054.md): An issue was discovered in Suricata 4.1.3. (no CVSS)
- [CVE-2019-10052](https://cve.now/CVE-2019-10052.md): An issue was discovered in Suricata 4.1.3. (no CVSS)
- [CVE-2019-10051](https://cve.now/CVE-2019-10051.md): An issue was discovered in Suricata 4.1.3. (no CVSS)
- [CVE-2019-14694](https://cve.now/CVE-2019-14694.md): A use-after-free flaw in the sandbox container implemented in cmdguard.sys in Comodo Antivirus 12.0.0.6870 can be triggered due to a race co (no CVSS)
- [CVE-2019-1964](https://cve.now/CVE-2019-1964.md): Cisco NX-OS Software IPv6 Denial of Service Vulnerability (CVSS 8.6, Cisco NX-OS Software)
- [CVE-2019-1965](https://cve.now/CVE-2019-1965.md): Cisco NX-OS Software Remote Management Memory Leak Denial of Service Vulnerability (CVSS 7.7, Cisco NX-OS Software)
- [CVE-2019-1962](https://cve.now/CVE-2019-1962.md): Cisco NX-OS Software Cisco Fabric Services over IP Denial of Service Vulnerability (CVSS 8.6, Cisco Unified Computing System)
- [CVE-2019-1963](https://cve.now/CVE-2019-1963.md): Cisco FXOS and NX-OS Software Authenticated Simple Network Management Protocol Denial of Service Vulnerability (CVSS 7.7, Cisco Unified Computing System)
- [CVE-2019-12643](https://cve.now/CVE-2019-12643.md): Cisco REST API Container for IOS XE Software Authentication Bypass Vulnerability (CVSS 10.0, Cisco IOS XE Software)
- [CVE-2019-5590](https://cve.now/CVE-2019-5590.md): The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized c (no CVSS, Fortinet FortiWeb)
- [CVE-2019-15496](https://cve.now/CVE-2019-15496.md): MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. (no CVSS)
- [CVE-2019-15230](https://cve.now/CVE-2019-15230.md): LibreNMS v1.54 has XSS in the Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template sections (no CVSS)
- [CVE-2019-15720](https://cve.now/CVE-2019-15720.md): CloudBerry Backup v6.1.2.34 allows local privilege escalation via a Pre or Post backup action. (no CVSS)
- [CVE-2019-10058](https://cve.now/CVE-2019-10058.md): Various Lexmark products have Incorrect Access Control. (no CVSS)
- [CVE-2019-9935](https://cve.now/CVE-2019-9935.md): Various Lexmark products have Incorrect Access Control (issue 2 of 2). (no CVSS)
- [CVE-2019-9934](https://cve.now/CVE-2019-9934.md): Various Lexmark products have Incorrect Access Control (issue 1 of 2). (no CVSS)
- [CVE-2019-13348](https://cve.now/CVE-2019-13348.md): In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in clearte (no CVSS)
- [CVE-2019-13189](https://cve.now/CVE-2019-13189.md): In Knowage through 6.1.1, there is XSS via the start\_url or user\_id field to the ChangePwdServlet page. (no CVSS)
- [CVE-2019-10384](https://cve.now/CVE-2019-10384.md): Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CS (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2019-10390](https://cve.now/CVE-2019-10390.md): A sandbox bypass vulnerability in Jenkins Splunk Plugin 1.7.4 and earlier allowed attackers with Overall/Read permission to provide a Groovy (no CVSS, Jenkins project Jenkins Splunk Plugin · com.splunk.splunkin…)
- [CVE-2019-10391](https://cve.now/CVE-2019-10391.md): Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configurati (no CVSS, Jenkins project Jenkins IBM Application Security on Cloud P…)
- [CVE-2019-10383](https://cve.now/CVE-2019-10383.md): A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2015-9359](https://cve.now/CVE-2015-9359.md): The Jetpack plugin before 3.4.3 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2019-15716](https://cve.now/CVE-2019-15716.md): WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys i (no CVSS)
- [CVE-2015-9379](https://cve.now/CVE-2015-9379.md): iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9378](https://cve.now/CVE-2015-9378.md): iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9377](https://cve.now/CVE-2015-9377.md): iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9376](https://cve.now/CVE-2015-9376.md): iThemes Mobile before 1.2.8 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9375](https://cve.now/CVE-2015-9375.md): Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9374](https://cve.now/CVE-2015-9374.md): Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9373](https://cve.now/CVE-2015-9373.md): PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9372](https://cve.now/CVE-2015-9372.md): Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9371](https://cve.now/CVE-2015-9371.md): Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9370](https://cve.now/CVE-2015-9370.md): Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9369](https://cve.now/CVE-2015-9369.md): Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9368](https://cve.now/CVE-2015-9368.md): Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9367](https://cve.now/CVE-2015-9367.md): Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9366](https://cve.now/CVE-2015-9366.md): Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9365](https://cve.now/CVE-2015-9365.md): Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9364](https://cve.now/CVE-2015-9364.md): 2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9363](https://cve.now/CVE-2015-9363.md): iThemes Exchange before 1.12.0 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9362](https://cve.now/CVE-2015-9362.md): The Post Connector plugin before 1.0.4 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9361](https://cve.now/CVE-2015-9361.md): The Related Posts plugin before 1.8.2 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9360](https://cve.now/CVE-2015-9360.md): The updraftplus plugin before 1.9.64 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2019-15713](https://cve.now/CVE-2019-15713.md): The my-calendar plugin before 3.1.10 for WordPress has XSS. (no CVSS)
- [CVE-2019-15714](https://cve.now/CVE-2019-15714.md): cli/lib/main.js in Entropic before 2019-06-13 does not reject / and \\ in command names, which might allow a directory traversal attack in un (no CVSS)
- [CVE-2015-9358](https://cve.now/CVE-2015-9358.md): The feedwordpress plugin before 2015.0514 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(). (no CVSS)
- [CVE-2015-9357](https://cve.now/CVE-2015-9357.md): The akismet plugin before 3.1.5 for WordPress has XSS. (no CVSS)
- [CVE-2015-9356](https://cve.now/CVE-2015-9356.md): The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add\_query\_arg() and remove\_query\_arg(), a different issue than CVE-2014-9460. (no CVSS)
- [CVE-2017-18593](https://cve.now/CVE-2017-18593.md): The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file. (no CVSS)
- [CVE-2015-9355](https://cve.now/CVE-2015-9355.md): The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area. (no CVSS)
- [CVE-2012-6719](https://cve.now/CVE-2012-6719.md): The sharebar plugin before 1.2.2 for WordPress has SQL injection. (no CVSS)
- [CVE-2012-6718](https://cve.now/CVE-2012-6718.md): The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491. (no CVSS)
- [CVE-2011-5329](https://cve.now/CVE-2011-5329.md): The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562. (no CVSS)
- [CVE-2012-6717](https://cve.now/CVE-2012-6717.md): The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562. (no CVSS)
- [CVE-2015-9354](https://cve.now/CVE-2015-9354.md): The gigpress plugin before 2.3.11 for WordPress has XSS. (no CVSS)
- [CVE-2015-9353](https://cve.now/CVE-2015-9353.md): The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066. (no CVSS)
- [CVE-2019-15294](https://cve.now/CVE-2019-15294.md): An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-08-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.