Skip to content
OpenAdvisories

Archive

August 2019

Vulnerabilities first published in this month (UTC), newest first.

← July 2019 2019 / August September 2019 →
  1. 1162
  2. 2182
  3. 32
  4. 4 
  5. 560
  6. 664
  7. 776
  8. 859
  9. 954
  10. 104
  11. 113
  12. 1247
  13. 1368
  14. 14176
  15. 1556
  16. 1645
  17. 175
  18. 1817
  19. 1942
  20. 20197
  21. 21115
  22. 22111
  23. 2377
  24. 24 
  25. 252
  26. 26121
  27. 2762
  28. 2870
  29. 2997
  30. 3033
  31. 31 
All Critical High Medium Low Exploited only Public exploit

2,007 results · Feed

  • High 7.5
    CVE-2019-15630

    Mule modules contain Directory Traversal

    Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gatew…

    Salesforce Mulesoft Mulesoft API Gateway org.mule.runtime:mule Maven
  • Unscored —
    CVE-2019-12810

    A memory corruption vulnerability exists in the .PSD parsing functionality of ALSee v5.3 ~ v8.39. A specially crafted .…

    ESTSOFT ALSee
  • Unscored —
    CVE-2019-15842

    The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.

  • Unscored —
    CVE-2019-15841

    The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_i…

  • Unscored —
    CVE-2019-15840

    The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF.

  • Unscored —
    CVE-2019-15839

    The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.

  • Unscored —
    CVE-2019-15838

    The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789.

  • Unscored —
    CVE-2019-15837

    The webp-express plugin before 0.14.8 for WordPress has stored XSS.

  • Unscored —
    CVE-2019-15836

    The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS.

  • Unscored —
    CVE-2019-15835

    The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF.

  • Unscored —
    CVE-2019-15834

    The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.

  • Medium 5.3
    CVE-2019-2389

    Process termination via PID file manipulation

    Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Serv…

    MongoDB MongoDB Server
  • High 8.2
    CVE-2019-2390

    Code execution on Windows via OpenSSL engine injection

    An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Serve…

    MongoDB MongoDB Server
  • Unscored —
    CVE-2019-15026

    memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn_to_str in memcached.c.

    memcached memcached Debian Ubuntu
  • Unscored —
    CVE-2019-15833

    The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.

  • Unscored —
    CVE-2019-15832

    The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.

  • Unscored —
    CVE-2019-15831

    The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.

  • Unscored —
    CVE-2019-15830

    The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS.

  • Unscored —
    CVE-2019-15829

    The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.

  • Unscored —
    CVE-2019-15828

    The one-click-ssl plugin before 1.4.7 for WordPress has CSRF.

  • Unscored —
    CVE-2019-15827

    The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter.

  • Unscored —
    CVE-2019-15826

    The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.

  • Unscored —
    CVE-2019-15825

    The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.

  • Unscored —
    CVE-2019-15824

    The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.

  • Unscored —
    CVE-2019-15823

    The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.

  • Unscored —
    CVE-2019-15822

    The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal.

  • Unscored —
    CVE-2019-15821 EPSS 11%

    The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.

  • Unscored —
    CVE-2019-15820

    The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authenticati…

  • Unscored —
    CVE-2019-15819

    The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_functi…

  • Unscored —
    CVE-2019-15818

    The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication f…

  • Unscored —
    CVE-2019-15817

    The easy-property-listings plugin before 3.4 for WordPress has XSS.

  • Unscored —
    CVE-2019-15816

    The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_…

  • Unscored —
    CVE-2015-9380

    The photo-gallery plugin before 1.2.42 for WordPress has CSRF.

  • Unscored —
    CVE-2019-13526

    Datalogic AV7000 Linear barcode scanner all versions prior to 4.6.0.0 is vulnerable to authentication bypass, which may…

  • Unscored —
    CVE-2019-9697

    An information disclosure vulnerability in the Management Center (MC) REST API 2.0, 2.1, and 2.2 prior to 2.2.2.1 allow…

    Symantec Management Center (MC)
  • Unscored —
    CVE-2019-12753

    An information disclosure vulnerability in Symantec Reporter web UI 10.3 prior to 10.3.2.5 allows a malicious authentic…

    Symantec Symantec Reporter
  • Unscored —
    CVE-2019-5612

    In FreeBSD 12.0-STABLE before r351264, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r351265, 11.3-RELEASE b…

  • Unscored —
    CVE-2019-12754

    Symantec My VIP portal, previous version which has already been auto updated, was susceptible to a cross-site scripting…

    Symantec My VIP Portal
  • Unscored —
    CVE-2019-11658

    Information exposure in Micro Focus Content Manager, versions 9.1, 9.2 and 9.3. This vulnerability when configured to u…

    Micro Focus Content Manager
  • Unscored —
    CVE-2018-18371

    The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp…

    Symantec Symantec ProxySG Symantec Advanced Secure Gateway (ASG)