CVEs published August 29, 2019
97 CVEs were published on August 29, 2019: 2 critical, 4 high. 1 is now in CISA KEV.
- Published
- 97
- Critical
- 2
- High
- 4
- Medium
- 14
- Low
- 0
- Unrated
- 77
- Now in CISA KEV
- 1
- Fix available
- 11
Most affected products
- AndroVideo Advan VD-1 firmware
- 5
- FreeBSD
- 5
- Kubernetes
- 3
- ASUS HG100 firmware
- 2
- Cisco NX-OS Software
- 2
- IBM Cloud Automation Manager
- 2
- Symantec Advanced Secure Gateway · Symantec ProxySG
- 2
- Zephyr shell
- 2
- Apache Software Foundation Apache Commons Compress · org… +1
- 1
- ASUS SmartHome Android app · ASUS SmartHome ios app
- 1
Critical 2
High 4
- CVE-2019-1966Cisco Unified Computing System Fabric Interconnect root Privilege Escalation VulnerabilityCisco Unified Computing System
- CVE-2019-1967Cisco NX-OS Software Network Time Protocol Denial of Service VulnerabilityCisco NX-OS Software
- CVE-2019-13608Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
- CVE-2019-11060HG100 contains an Uncontrolled Resource Consumption vulnerabilityASUS HG100 firmware
Medium, low and unrated 91
- CVE-2019-13526Datalogic AV7000 Linear barcode scanner all versions prior to 4.6.0.0 is vulnerable to authentication bypass, which may allow an attacker toDatalogic AV7000 Linear barcode scanner
- CVE-2019-9697An information disclosure vulnerability in the Management Center (MC) REST API 2.0, 2.1, and 2.2 prior to 2.2.2.1 allows a malicious authentSymantec Management Center
- CVE-2019-12753An information disclosure vulnerability in Symantec Reporter web UI 10.3 prior to 10.3.2.5 allows a malicious authenticated administrator usSymantec Reporter
- CVE-2019-5612In FreeBSD 12.0-STABLE before r351264, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r351265, 11.3-RELEASE before 11.3-RELEASE-p3FreeBSD
- CVE-2019-12754Symantec My VIP portal, previous version which has already been auto updated, was susceptible to a cross-site scripting (XSS) exploit, whichSymantec My VIP Portal
- CVE-2019-11658Information exposure in Micro Focus Content Manager, versions 9.1, 9.2 and 9.3.Micro Focus Content Manager
- CVE-2018-18371The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browSymantec Advanced Secure Gateway · Symantec ProxySG
- CVE-2018-18370The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browSymantec Advanced Secure Gateway · Symantec ProxySG
- CVE-2019-5609In FreeBSD 12.0-STABLE before r350619, 12.0-RELEASE before 12.0-RELEASE-p9, 11.3-STABLE before r350619, 11.3-RELEASE before 11.3-RELEASE-p2,FreeBSD
- CVE-2019-5608In FreeBSD 12.0-STABLE before r350648, 12.0-RELEASE before 12.0-RELEASE-p9, 11.3-STABLE before r350650, 11.3-RELEASE before 11.3-RELEASE-p2,FreeBSD
- CVE-2019-1968Cisco NX-OS Software NX-API Denial of Service VulnerabilityCisco NX-OS Software 6.0(2)A4
- CVE-2019-1969Cisco NX-OS Software SNMP Access Control List Configuration Name Bypass VulnerabilityCisco NX-OS Software
- CVE-2019-1977Cisco Nexus 9000 Series Fabric Switches ACI Mode Border Leaf Endpoint Learning VulnerabilityCisco Nexus 9000 Series Fabric Switches in ACI
- CVE-2019-5611In FreeBSD 12.0-STABLE before r350828, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r350829, 11.3-RELEASE before 11.3-RELEASE-p3FreeBSD
- CVE-2019-5610In FreeBSD 12.0-STABLE before r350637, 12.0-RELEASE before 12.0-RELEASE-p9, 11.3-STABLE before r350638, 11.3-RELEASE before 11.3-RELEASE-p2,FreeBSD
- CVE-2018-15511Cross-site scripting (XSS) vulnerability in the 'Notification template' feature of totemomail 6.0.0 build 570 allows remote attackers to inj
- CVE-2018-15510Cross-site scripting (XSS) vulnerability in the 'Certificate' feature of totemomail 6.0.0 build 570 allows remote attackers to inject arbitr
- CVE-2018-15513Log viewer in totemomail 6.0.0 build 570 allows access to sessionIDs of high privileged users by leveraging access to a read-only auditor ro
- CVE-2018-15512Cross-site scripting (XSS) vulnerability in the 'Authorisation Service' feature of totemomail 6.0.0 build 570 allows remote attackers to inj
- CVE-2019-6113Directory traversal vulnerability on ONKYO TX-NR686 1030-5000-1040-0010 A/V Receiver devices allows remote attackers to read arbitrary files
- CVE-2019-8461Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH location on a clean imCheck Point Endpoint Security Initial Client for Windows
- CVE-2019-11364An OS Command Injection vulnerability in Snare Central before 7.4.5 allows remote authenticated attackers to inject arbitrary OS commands vi
- CVE-2019-11363A SQL injection vulnerability in Snare Central before 7.4.5 allows remote authenticated attackers to execute arbitrary SQL commands via the
- CVE-2019-11396An issue was discovered in Avira Free Security Suite 10.
- CVE-2019-15811In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.
- CVE-2019-14970A vulnerability in mkv::event_thread_t in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer overflow
- CVE-2019-14777The Control function of demux/mkv/mkv.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free.
- CVE-2019-14778The mkv::virtual_segment_c::seek method of demux/mkv/virtual_segment.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free.
- CVE-2019-14776A heap-based buffer over-read exists in DemuxInit() in demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 via a crafted .mkv file.
- CVE-2019-14533The Control function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 has a use-after-free.
- CVE-2019-14534In VideoLAN VLC media player 3.0.7.1, there is a NULL pointer dereference at the function SeekPercent of demux/asf/asf.c that will lead to a
- CVE-2019-14979cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amo
- CVE-2019-14978/payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuanti
- CVE-2019-14535A divide-by-zero error exists in the SeekIndex function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1.
- CVE-2019-14498A divide-by-zero error exists in the Control function of demux/caf.c in VideoLAN VLC media player 3.0.7.1.
- CVE-2019-14438A heap-based buffer over-read in xiph_PackHeaders() in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 allows remote attackers to
- CVE-2019-15807In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails.
- CVE-2019-14437The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly.
- CVE-2019-15805CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative inter
- CVE-2019-15806CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative inter
- CVE-2019-15717Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP.
- CVE-2019-15502The TeamSpeak client before 3.3.2 allows remote servers to trigger a crash via the 0xe2 0x81 0xa8 0xe2 0x81 0xa7 byte sequence, aka Unicode
- CVE-2019-4536IBM i 7.4 users who have done a Restore User Profile (RSTUSRPRF) on a system which has been configured with Db2 Mirror for i might have userIBM i
- CVE-2019-4133IBM Cloud Automation Manager 3.1.2 could allow a malicious user on the client side (with access to client computer) to run a custom script.IBM Cloud Automation Manager
- CVE-2019-4132IBM Cloud Automation Manager 3.1.2 could allow a user to be impropertly redirected and obtain sensitive information rather than receive a 40IBM Cloud Automation Manager
- CVE-2019-7307Apport contains a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xmlUbuntu apport
- CVE-2019-11476Integer overflow in whoopsie results in out-of-bounds heap writeUbuntu Whoopsie
- CVE-2019-3394There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting.Atlassian Confluence Server
- CVE-2019-11500In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings.
- CVE-2019-15745The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the
- CVE-2019-15785FontForge 20190813 through 20190820 has a buffer overflow in PrefsUI_LoadPrefs in prefs.c.
- CVE-2019-15786ROBOTIS Dynamixel SDK through 3.7.11 has a buffer overflow via a large rxpacket.
- CVE-2019-15771The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
- CVE-2019-15778The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS.
- CVE-2019-15779The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete.
- CVE-2019-15781The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.
- CVE-2019-15784Secure Reliable Transport (SRT) through 1.3.4 has a CSndUList array overflow if there are many SRT connections.
- CVE-2019-15788Clara Genomics Analysis before 0.2.0 has an integer overflow for cudapoa memory management in allocate_block.cpp.
- CVE-2019-14943An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4.
- CVE-2019-15780The formidable plugin before 4.02.01 for WordPress has unsafe deserialization.
- CVE-2019-15777The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.
- CVE-2019-15776The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a C
- CVE-2019-15774The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
- CVE-2019-15775The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
- CVE-2019-15773The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
- CVE-2019-15772The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
- CVE-2019-15770The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks.
- CVE-2019-15769The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.
- CVE-2018-21007The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads.
- CVE-2019-15787libZetta.rs through 0.1.2 has an integer overflow in the zpool parser (for error stats) that leads to a panic.
- CVE-2019-15783Lute-Tab before 2019-08-23 has a buffer overflow in pdf_print.cc.
- CVE-2019-15782WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name.webtorrent
- CVE-2019-15767In GNU Chess 6.2.5, there is a stack-based buffer overflow in the cmd_load function in frontend/cmd.cc via a crafted chess position in an EP
- CVE-2019-15758An issue was discovered in Binaryen 1.38.32.
- CVE-2019-15759An issue was discovered in Binaryen 1.38.32.
- CVE-2019-5530Windows binaries generated with InstallBuilder versions earlier than 19.7.0 are vulnerable to tampering even if they contain a valid AuthentInstallBuilder
- CVE-2017-14201The shell DNS command can cause unpredictable results due to misuse of stack variables.Zephyr shell
- CVE-2017-14202The shell implementation does not protect against buffer overruns resulting in unpredictable behavior.Zephyr shell
- CVE-2019-11250Kubernetes client-go logs authorization headers at debug verbosity levelsKubernetes · k8s.io/client-go +1
- CVE-2019-15757libMirage 3.2.2 in CDemu has a NULL pointer dereference in the NRG parser in parser.c.
- CVE-2019-11249kubectl cp allows symlink directory traversalKubernetes
- CVE-2019-11248Kubernetes kubelet exposes /debug/pprof info on healthz portKubernetes
- CVE-2019-11247Kubernetes kube-apiserver allows access to custom resources via wrong scopeKubernetes · k8s.io/apiextensions-apiserver
- CVE-2019-11246kubectl cp allows symlink directory traversalKubernetes
- CVE-2019-11245kubelet-started container uid changes to root after first restart or if image is already pulled to the nodeKubernetes · k8s.io/kubernetes/cmd/kubelet +1
- CVE-2019-13407Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgiAndroVideo Advan VD-1 firmware
- CVE-2019-13406Advan VD-1 has a vulnerability that allows remote arbitrary APK installationAndroVideo Advan VD-1 firmware
- CVE-2019-13405Advan VD-1 allows a remote user to enable Android Debug Bridge without any authenticationAndroVideo Advan VD-1 firmware
- CVE-2019-11064A vulnerability of remote credential disclosure was discovered in Advan VD-1AndroVideo Advan VD-1 firmware
- CVE-2019-13408Advan VD-1 allows users to download arbitrary filesAndroVideo Advan VD-1 firmware
- CVE-2019-12402The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with speciApache Software Foundation Apache Commons Compress · org… +1