# CVEs published 2019-08-30

33 CVEs were published on August 30, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2019-15630](https://cve.now/CVE-2019-15630.md): Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before Augu (no CVSS, Salesforce Mulesoft · org.mule.runtime:mule)
- [CVE-2019-12810](https://cve.now/CVE-2019-12810.md): A memory corruption vulnerability exists in the .PSD parsing functionality of ALSee v5.3 ~ v8.39. (no CVSS, ESTSOFT ALSee)
- [CVE-2019-15842](https://cve.now/CVE-2019-15842.md): The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS. (no CVSS)
- [CVE-2019-15841](https://cve.now/CVE-2019-15841.md): The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax\_woo\_infobanner\_post\_click, ajax\_woo\_infobanner\_post\_xout, (no CVSS)
- [CVE-2019-15840](https://cve.now/CVE-2019-15840.md): The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF. (no CVSS)
- [CVE-2019-15839](https://cve.now/CVE-2019-15839.md): The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion. (no CVSS)
- [CVE-2019-15838](https://cve.now/CVE-2019-15838.md): The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789. (no CVSS)
- [CVE-2019-15837](https://cve.now/CVE-2019-15837.md): The webp-express plugin before 0.14.8 for WordPress has stored XSS. (no CVSS)
- [CVE-2019-15836](https://cve.now/CVE-2019-15836.md): The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS. (no CVSS)
- [CVE-2019-15835](https://cve.now/CVE-2019-15835.md): The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF. (no CVSS)
- [CVE-2019-15834](https://cve.now/CVE-2019-15834.md): The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF. (no CVSS)
- [CVE-2019-2389](https://cve.now/CVE-2019-2389.md): Process termination via PID file manipulation (CVSS 5.3, MongoDB Server)
- [CVE-2019-2390](https://cve.now/CVE-2019-2390.md): Code execution on Windows via OpenSSL engine injection (CVSS 8.2, MongoDB Server)
- [CVE-2019-15026](https://cve.now/CVE-2019-15026.md): memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn\_to\_str in memcached.c. (no CVSS)
- [CVE-2019-15833](https://cve.now/CVE-2019-15833.md): The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS. (no CVSS)
- [CVE-2019-15832](https://cve.now/CVE-2019-15832.md): The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF. (no CVSS)
- [CVE-2019-15831](https://cve.now/CVE-2019-15831.md): The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page. (no CVSS)
- [CVE-2019-15830](https://cve.now/CVE-2019-15830.md): The icegram plugin before 1.10.29 for WordPress has ig\_cat\_list XSS. (no CVSS)
- [CVE-2019-15829](https://cve.now/CVE-2019-15829.md): The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS. (no CVSS)
- [CVE-2019-15828](https://cve.now/CVE-2019-15828.md): The one-click-ssl plugin before 1.4.7 for WordPress has CSRF. (no CVSS)
- [CVE-2019-15827](https://cve.now/CVE-2019-15827.md): The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter. (no CVSS)
- [CVE-2019-15826](https://cve.now/CVE-2019-15826.md): The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field. (no CVSS)
- [CVE-2019-15825](https://cve.now/CVE-2019-15825.md): The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass. (no CVSS)
- [CVE-2019-15824](https://cve.now/CVE-2019-15824.md): The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass. (no CVSS)
- [CVE-2019-15823](https://cve.now/CVE-2019-15823.md): The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass. (no CVSS)
- [CVE-2019-15822](https://cve.now/CVE-2019-15822.md): The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal. (no CVSS)
- [CVE-2019-15821](https://cve.now/CVE-2019-15821.md): The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data. (no CVSS)
- [CVE-2019-15820](https://cve.now/CVE-2019-15820.md): The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi\_save\_settings authentication. (no CVSS)
- [CVE-2019-15819](https://cve.now/CVE-2019-15819.md): The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd\_rst\_import\_settings\_php\_function authentication. (no CVSS)
- [CVE-2019-15818](https://cve.now/CVE-2019-15818.md): The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301expo (no CVSS)
- [CVE-2019-15817](https://cve.now/CVE-2019-15817.md): The easy-property-listings plugin before 3.4 for WordPress has XSS. (no CVSS)
- [CVE-2019-15816](https://cve.now/CVE-2019-15816.md): The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save\_settings\_page and other save\_ (no CVSS)
- [CVE-2015-9380](https://cve.now/CVE-2015-9380.md): The photo-gallery plugin before 1.2.42 for WordPress has CSRF. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-08-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.