Skip to content
OpenAdvisories

Archive

August 2019

Vulnerabilities first published in this month (UTC), newest first.

← July 2019 2019 / August September 2019 →
  1. 1162
  2. 2182
  3. 32
  4. 4 
  5. 560
  6. 664
  7. 776
  8. 859
  9. 954
  10. 104
  11. 113
  12. 1247
  13. 1368
  14. 14176
  15. 1556
  16. 1645
  17. 175
  18. 1817
  19. 1942
  20. 20197
  21. 21115
  22. 22111
  23. 2377
  24. 24 
  25. 252
  26. 26121
  27. 2762
  28. 2870
  29. 2997
  30. 3033
  31. 31 
All Critical High Medium Low Exploited only Public exploit

2,007 results · Feed

  • Unscored —
    CVE-2015-9338

    The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.

  • Unscored —
    CVE-2015-9339

    The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.

  • Unscored —
    CVE-2015-9340

    The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php…

  • Unscored —
    CVE-2015-9341

    The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.

  • Unscored —
    CVE-2019-15330

    The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.

  • Unscored —
    CVE-2019-15331

    The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection.

  • Unscored —
    CVE-2016-10930

    The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via…

  • Unscored —
    CVE-2019-15060

    The traceroute function on the TP-Link TL-WR840N v4 router with firmware through 0.9.1 3.16 is vulnerable to remote cod…

  • Unscored —
    CVE-2014-10387

    The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection.

  • Unscored —
    CVE-2014-10388

    The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure.

  • Unscored —
    CVE-2014-10389

    The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication.

  • Unscored —
    CVE-2014-10390

    The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal.

  • Unscored —
    CVE-2014-10391

    The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection.

  • Unscored —
    CVE-2018-20988

    The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation.

  • Unscored —
    CVE-2014-10392

    The cforms2 plugin before 10.2 for WordPress has XSS.

  • Unscored —
    CVE-2017-18586

    The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.

  • Unscored —
    CVE-2014-10394

    The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header.

  • Unscored —
    CVE-2019-12386

    An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" fun…

    ampache Ubuntu
  • Unscored —
    CVE-2019-12385

    An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to…

    ampache Ubuntu
  • Unscored —
    CVE-2019-14469

    In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS.

  • High 7.2
    CVE-2019-7617

    Elastic APM agent for Python client CGI proxy redirection flaw

    When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choo…

    Elastic Elastic APM agent for Python elastic-apm PyPI
  • High 7.5
    CVE-2019-14751 Public exploit

    NLTK Vulnerable To Path Traversal

    NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.

    nltk nltk nltk Debian Ubuntu PyPI
  • Medium 5.9
    CVE-2019-9155

    Invalid Curve Attack in openpgp

    A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.

    openpgp npm
  • High 7.5
    CVE-2019-9154

    Improper Key Verification in openpgp

    Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed.

    openpgp npm
  • High 7.5
    CVE-2019-9153 Public exploit

    Message Signature Bypass in openpgp

    Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature.

    openpgp npm
  • Unscored —
    CVE-2019-11031

    Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the auto-update feature of IDVRUpdateService2 in DVRServer.e…

  • Unscored —
    CVE-2019-11030

    Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common…

  • Unscored —
    CVE-2019-11029

    Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, …

  • Unscored —
    CVE-2019-11013 Public exploit Scanner template EPSS 26%

    Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allo…

  • Unscored —
    CVE-2018-18573

    osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated ad…

  • Unscored —
    CVE-2018-18572

    osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter,…

  • Medium 6.5
    CVE-2019-5635

    Hickory Smart Lock Cleartext Password

    A cleartext transmission of sensitive information vulnerability is present in Hickory Smart Ethernet Bridge from Belwith Products, LLC. Captured data reveals that the Hickory Smart Ethernet Bridge device communicates over the network to an MQTT broker without…

    Belwith Products Hickory Smart Ethernet Bridge
  • Medium 6.5
    CVE-2019-5634

    Hickory Smart Lock Insecure Logging on Android

    An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communications to the internet API services and direct connections to the lock via Bluetooth Low Energy (BLE) f…

    Belwith Products Hickory Smart
  • Medium 6.5
    CVE-2019-5632

    Hickory Smart Lock Insecure Storage on Android

    An insecure storage of sensitive information vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. The application's database was found to contain information that could be used to control the lock devices remotely. …

    Belwith Products Hickory Smart
  • Medium 6.5
    CVE-2019-5633

    Hickory Smart Lock Insecure Storage on iOS

    An insecure storage of sensitive information vulnerability is present in Hickory Smart for iOS mobile devices from Belwith Products, LLC. The application's database was found to contain information that could be used to control the lock devices remotely. This…

    Belwith Products Hickory Smart
  • Unscored —
    CVE-2017-18584

    The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.

  • Unscored —
    CVE-2017-18583

    The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.

  • Unscored —
    CVE-2015-9337

    The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via A…

  • Unscored —
    CVE-2019-15324

    The ad-inserter plugin before 2.4.22 for WordPress has remote code execution.

  • Unscored —
    CVE-2019-15323

    The ad-inserter plugin before 2.4.20 for WordPress has path traversal.