Skip to content
OpenAdvisories

Archive

August 2019

Vulnerabilities first published in this month (UTC), newest first.

← July 2019 2019 / August September 2019 →
  1. 1162
  2. 2182
  3. 32
  4. 4 
  5. 560
  6. 664
  7. 776
  8. 859
  9. 954
  10. 104
  11. 113
  12. 1247
  13. 1368
  14. 14176
  15. 1556
  16. 1645
  17. 175
  18. 1817
  19. 1942
  20. 20197
  21. 21115
  22. 22111
  23. 2377
  24. 24 
  25. 252
  26. 26121
  27. 2762
  28. 2870
  29. 2997
  30. 3033
  31. 31 
All Critical High Medium Low Exploited only Public exploit

2,007 results · Feed

  • Unscored —
    CVE-2019-15491

    openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.

  • Unscored —
    CVE-2019-15490

    openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.

  • Medium 6.1
    CVE-2019-15488

    Cross-site Scripting in Ignite Realtime Openfire

    Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.

    org.igniterealtime.openfire:xmppserver Maven
  • Unscored —
    CVE-2019-15487

    DfE School Experience before v16333-GA has XSS via a teacher training URL.

  • Medium 6.1
    CVE-2019-15486

    Cross-site Scripting in django-js-reverse

    django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline.

    django-js-reverse django-js-reverse Ubuntu PyPI
  • Medium 6.1
    CVE-2019-15485

    Cross-site Scripting in Bolt

    Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.

    bolt/bolt bolt Azure Linux Packagist
  • Medium 6.1
    CVE-2019-15484

    Bolt Cross-site Scripting (XSS) via an image's alt or title field

    Bolt before 3.6.10 has XSS via an image's alt or title field.

    bolt/bolt bolt Azure Linux Packagist
  • Medium 6.1
    CVE-2019-15483

    Bolt Cross-site Scripting (XSS) via a title that is mishandled in the system log

    Bolt before 3.6.10 has XSS via a title that is mishandled in the system log.

    bolt/bolt bolt Azure Linux Packagist
  • Medium 6.1
    CVE-2019-15481

    Kimai v2 is vulnerable to Cross-Site Scripting (XSS)

    Kimai v2 before 1.1 has XSS via a timesheet description.

    kevinpapst/kimai2 Packagist
  • Unscored —
    CVE-2019-15480

    Domoticz 4.10717 has XSS via item.Name.

  • Medium 6.1
    CVE-2019-15477 Public exploit

    Cross-site Scripting in Jooby

    Jooby before 1.6.4 has XSS via the default error handler.

    org.jooby:jooby Maven
  • Unscored —
    CVE-2019-15476

    Former before 4.2.1 has XSS via a checkbox value.

  • Unscored —
    CVE-2019-15514 Public exploit

    The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that t…

  • Unscored —
    CVE-2019-15513

    An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) before 15.05.1 as used …

  • Unscored —
    CVE-2019-15507

    In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in cert…

  • Unscored —
    CVE-2019-15508

    In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain …

  • Unscored —
    CVE-2019-15505

    drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB …

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • Unscored —
    CVE-2019-15504

    drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traff…

    linux-hwe linux-azure linux-gcp linux Debian Ubuntu
  • Unscored —
    CVE-2019-15499

    CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute,…

  • Unscored —
    CVE-2019-15498

    cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS…

  • Critical 9.1
    GHSA-rch7-f4h5-x9rj

    Identity Spoofing in libp2p-secio

    Affected versions of `libp2p-secio` does not correctly verify that the `PeerId` of `DstPeer` matches the `PeerId` discovered in the crypto handshake, resulting in a high severity identity spoofing vulnerability. ## Recommendation Update to version 0.9.0 or la…

    libp2p-secio npm
  • Medium 6.5
    GHSA-65p8-3hm4-h9h8

    Denial of Service in rgb2hex

    All versions of `rgb2hex` are vulnerable to Regular Expression Denial of Service (ReDoS) when an attacker can pass in a specially crafted invalid color value. ## Recommendation Update to version 0.1.6 or later.

    rgb2hex npm
  • Unscored —
    CVE-2014-10393

    The cforms2 plugin before 10.5 for WordPress has XSS.

  • Unscored —
    CVE-2019-13139 Public exploit

    In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build"…

    docker.io Debian
  • Unscored —
    CVE-2015-9334

    The email-newsletter plugin through 20.15 for WordPress has SQL injection.

  • Unscored —
    CVE-2017-18578

    The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.

  • Unscored —
    CVE-2017-18579

    The corner-ad plugin before 1.0.8 for WordPress has XSS.

  • Unscored —
    CVE-2014-10382

    The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.

  • Unscored —
    CVE-2016-10928

    The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisio…

  • Unscored —
    CVE-2016-10929

    The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files…

  • Unscored —
    CVE-2018-20986

    The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by auth…

  • Unscored —
    CVE-2017-18585

    The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.

  • Unscored —
    CVE-2013-7483

    The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion.

  • Unscored —
    CVE-2019-15325

    In GalliumOS 3.0, CONFIG_SECURITY_YAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/…

  • Unscored —
    CVE-2019-15326

    The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.

  • Unscored —
    CVE-2019-15327

    The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.

  • Unscored —
    CVE-2019-15328

    The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.

  • Unscored —
    CVE-2019-15329

    The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.

  • Unscored —
    CVE-2014-10386

    The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.

  • Unscored —
    CVE-2018-20987

    The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.