Vulnerability Summary for the Week of August 19, 2019

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.

Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

High: vulnerabilities with a CVSS base score of 7.0–10.0
Medium: vulnerabilities with a CVSS base score of 4.0–6.9
Low: vulnerabilities with a CVSS base score of 0.0–3.9

Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis.

The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.

High Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .	2019-08-20	7.5	CVE-2019-7965 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8003 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution .	2019-08-20	7.5	CVE-2019-8006 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8009 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .	2019-08-20	7.5	CVE-2019-8015 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8016 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution .	2019-08-20	7.5	CVE-2019-8017 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8022 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8023 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8024 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8025 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8026 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8028 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8029 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8030 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8031 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8036 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .	2019-08-20	7.5	CVE-2019-8041 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8042 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a double free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8044 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution .	2019-08-20	7.5	CVE-2019-8045 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8046 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8047 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a buffer error vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8048 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	10.0	CVE-2019-8049 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8050 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8055 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution .	2019-08-20	10.0	CVE-2019-8060 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8061 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8098 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	7.5	CVE-2019-8100 CONFIRM
adobe -- creative_cloud	Creative Cloud Desktop Application versions 4.6.1 and earlier have an insecure inherited permissions vulnerability. Successful exploitation could lead to privilege escalation.	2019-08-16	10.0	CVE-2019-7958 CONFIRM
adobe -- creative_cloud	Creative Cloud Desktop Application versions 4.6.1 and earlier have a using components with known vulnerabilities vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-16	10.0	CVE-2019-7959 CONFIRM
bestwebsoft -- visitors_online	The visitors-online plugin before 0.4 for WordPress has SQL injection.	2019-08-16	7.5	CVE-2015-9325 MISC
codepeople -- booking_calendar_contact_form	The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.	2019-08-21	7.5	CVE-2016-10909 MISC
duplicate_post_project -- duplicate_post	The duplicate-post plugin before 2.6 for WordPress has SQL injection.	2019-08-21	7.5	CVE-2014-10379 MISC
google -- android	In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368.	2019-08-20	9.3	CVE-2019-2126 CONFIRM
google -- android	In AudioInputDescriptor::setClientActive of AudioInputDescriptor.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-124899895.	2019-08-20	7.2	CVE-2019-2127 CONFIRM
google -- android	In ACELP_4t64_fx of c4t64fx.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132647222.	2019-08-20	7.2	CVE-2019-2128 CONFIRM
ibm -- datapower_gateway	IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through 9.1.0.2, and 9.1.1 through 9.1.2 could allow a local attacker to execute arbitrary commands on the system, caused by a command injection vulnerability. IBM X-Force ID: 16188.	2019-08-20	7.2	CVE-2019-4294 XF CONFIRM CONFIRM
ibm -- emptoris_spend_analysis	IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 164064.	2019-08-20	7.5	CVE-2019-4481 XF CONFIRM
ibm -- emptoris_spend_analysis	IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 164067.	2019-08-20	7.5	CVE-2019-4483 XF CONFIRM
ibm -- informix_dynamic_server	IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in onmode. IBM X-Force ID: 144430.	2019-08-20	7.2	CVE-2018-1630 CONFIRM XF
ibm -- informix_dynamic_server	IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in oninit mongohash. IBM X-Force ID: 144431.	2019-08-20	7.2	CVE-2018-1631 CONFIRM XF
olimometer_project -- olimometer	The olimometer plugin before 2.57 for WordPress has SQL injection.	2019-08-16	7.5	CVE-2016-10904 MISC
soflyy -- wp_all_import	The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.	2019-08-20	7.5	CVE-2015-9330 MISC
tribulant -- newsletters	The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.	2019-08-22	7.5	CVE-2018-20987 MISC MISC
wp_front_end_profile_project -- wp_front_end_profile	The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.	2019-08-21	7.5	CVE-2019-15111 MISC
wpbusinessintelligence -- wp_business_intelligence	The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.	2019-08-16	7.5	CVE-2015-9326 MISC

Medium Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
activity_log_project -- activity_log	The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.	2019-08-21	4.3	CVE-2016-10890 MISC
activity_log_project -- activity_log	The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.	2019-08-21	4.3	CVE-2016-10891 MISC
ad_buttons_project -- ad_buttons	The ad-buttons plugin before 2.3.2 for WordPress has XSS.	2019-08-21	4.3	CVE-2017-18553 MISC
add_from_server_project -- add_from_server	The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.	2019-08-20	6.8	CVE-2016-10914 MISC
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .	2019-08-20	5.0	CVE-2019-8002 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8004 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8005 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .	2019-08-20	5.0	CVE-2019-8007 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .	2019-08-20	6.8	CVE-2019-8008 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8010 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8011 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8012 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	6.8	CVE-2019-8013 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .	2019-08-20	6.8	CVE-2019-8014 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .	2019-08-20	5.0	CVE-2019-8018 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .	2019-08-20	6.8	CVE-2019-8019 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8020 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8021 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	6.8	CVE-2019-8027 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .	2019-08-20	5.0	CVE-2019-8032 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	6.8	CVE-2019-8033 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	6.8	CVE-2019-8034 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .	2019-08-20	4.3	CVE-2019-8035 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .	2019-08-20	4.3	CVE-2019-8037 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	6.8	CVE-2019-8038 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	6.8	CVE-2019-8039 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	4.3	CVE-2019-8040 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8043 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	4.3	CVE-2019-8051 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	4.3	CVE-2019-8052 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	4.3	CVE-2019-8053 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	4.3	CVE-2019-8054 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	4.3	CVE-2019-8056 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	6.8	CVE-2019-8057 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.	2019-08-20	4.3	CVE-2019-8058 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .	2019-08-20	4.3	CVE-2019-8059 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8077 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8094 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8095 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8096 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an internal ip disclosure vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8097 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an integer overflow vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8099 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions , 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an integer overflow vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8101 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8102 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8103 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8104 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8105 CONFIRM
adobe -- acrobat_dc	Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.	2019-08-20	5.0	CVE-2019-8106 CONFIRM
adobe -- creative_cloud	Creative Cloud Desktop Application versions 4.6.1 and earlier have a security bypass vulnerability. Successful exploitation could lead to denial of service.	2019-08-16	5.0	CVE-2019-7957 CONFIRM
adobe -- creative_cloud	Creative Cloud Desktop Application 4.6.1 and earlier versions have an insecure transmission of sensitive data vulnerability. Successful exploitation could lead to information leakage.	2019-08-16	5.0	CVE-2019-8063 CONFIRM
analytics_tracker_project -- analytics_tracker	The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.	2019-08-21	4.3	CVE-2017-18554 MISC
bestwebsoft -- error_log_viewer	The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.	2019-08-21	4.3	CVE-2017-18562 MISC
bestwebsoft -- google_analytics	The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.	2019-08-21	4.3	CVE-2017-18556 MISC
bestwebsoft -- google_maps	The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.	2019-08-21	4.3	CVE-2017-18557 MISC
bestwebsoft -- linkedin	The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.	2019-08-21	4.3	CVE-2017-18516 MISC
bestwebsoft -- pagination	The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.	2019-08-20	4.3	CVE-2017-18527 MISC
bestwebsoft -- pdf_&_print	The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.	2019-08-20	4.3	CVE-2017-18528 MISC
bestwebsoft -- pdf_&_print	The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.	2019-08-21	4.3	CVE-2018-20970 MISC
bestwebsoft -- pinterest	The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.	2019-08-20	4.3	CVE-2017-18517 MISC
bestwebsoft -- promobar	The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.	2019-08-20	4.3	CVE-2017-18529 MISC
bestwebsoft -- rating	The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.	2019-08-20	4.3	CVE-2017-18530 MISC
bestwebsoft -- realty	The realty plugin before 1.1.0 for WordPress has multiple XSS issues.	2019-08-20	4.3	CVE-2017-18532 MISC
bestwebsoft -- sender	The sender plugin before 1.2.1 for WordPress has multiple XSS issues.	2019-08-21	4.3	CVE-2017-18564 MISC
bestwebsoft -- smtp	The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.	2019-08-20	4.3	CVE-2017-18518 MISC
bestwebsoft -- testimonials	The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.	2019-08-21	4.3	CVE-2017-18558 MISC
bestwebsoft -- updater	The updater plugin before 1.35 for WordPress has multiple XSS issues.	2019-08-21	4.3	CVE-2017-18565 MISC
bestwebsoft -- user_role	The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.	2019-08-20	4.3	CVE-2017-18566 MISC
bestwebsoft -- visitors_online	The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.	2019-08-21	4.3	CVE-2017-18537 MISC
clogica -- seo_redirection	The seo-redirection plugin before 4.3 for WordPress has stored XSS.	2019-08-21	4.3	CVE-2016-10896 MISC
codection -- import_users_from_csv_with_meta	The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.	2019-08-22	5.0	CVE-2019-15326 MISC MISC
codection -- import_users_from_csv_with_meta	The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.	2019-08-22	4.3	CVE-2019-15327 MISC
codection -- import_users_from_csv_with_meta	The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.	2019-08-22	4.3	CVE-2019-15328 MISC MISC
codection -- import_users_from_csv_with_meta	The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.	2019-08-22	6.8	CVE-2019-15329 MISC MISC
codepeople -- booking_calendar_contact_form	The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.	2019-08-21	4.3	CVE-2016-10908 MISC
content_audit_project -- content_audit	The content-audit plugin before 1.9.2 for WordPress has XSS.	2019-08-21	4.3	CVE-2017-18560 MISC
count_per_day_project -- count_per_day	The count-per-day plugin before 3.2.3 for WordPress has XSS via search words.	2019-08-21	4.3	CVE-2012-6714 MISC
cozmoslabs -- profile_builder	The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.	2019-08-21	4.3	CVE-2014-10380 MISC
cozmoslabs -- profile_builder	The profile-builder plugin before 2.2.5 for WordPress has XSS.	2019-08-21	4.3	CVE-2015-9328 MISC
cozmoslabs -- profile_builder	The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.	2019-08-21	4.3	CVE-2016-10911 MISC
crafty_social_buttons_project -- crafty_social_buttons	The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.	2019-08-22	4.3	CVE-2017-18578 MISC
deepsoft -- weblibrarian	The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.	2019-08-21	4.3	CVE-2017-18538 MISC
deepsoft -- weblibrarian	The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.	2019-08-21	4.3	CVE-2017-18539 MISC
deepsoft -- weblibrarian	The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.	2019-08-21	4.3	CVE-2017-18540 MISC
djvulibre_project -- djvulibre	In DjVuLibre 3.5.27, DjVmDir.cpp in the DJVU reader component allows attackers to cause a denial-of-service (application crash in GStringRep::strdup in libdjvu/GString.cpp caused by a heap-based buffer over-read) by crafting a DJVU file.	2019-08-18	4.3	CVE-2019-15142 MISC MISC
djvulibre_project -- djvulibre	In DjVuLibre 3.5.27, the bitmap reader component allows attackers to cause a denial-of-service error (resource exhaustion caused by a GBitmap::read_rle_raw infinite loop) by crafting a corrupted image file, related to libdjvu/DjVmDir.cpp and libdjvu/GBitmap.cpp.	2019-08-18	4.3	CVE-2019-15143 MISC MISC
djvulibre_project -- djvulibre	In DjVuLibre 3.5.27, the sorting functionality (aka GArrayTemplate<TYPE>::sort) allows attackers to cause a denial-of-service (application crash due to an Uncontrolled Recursion) by crafting a PBM image file that is mishandled in libdjvu/GContainer.h.	2019-08-18	4.3	CVE-2019-15144 MISC MISC
djvulibre_project -- djvulibre	DjVuLibre 3.5.27 allows attackers to cause a denial-of-service attack (application crash via an out-of-bounds read) by crafting a corrupted JB2 image file that is mishandled in JB2Dict::JB2Codec::get_direct_context in libdjvu/JB2Image.h because of a missing zero-bytes check in libdjvu/GBitmap.h.	2019-08-18	4.3	CVE-2019-15145 MISC MISC
duplicate_post_project -- duplicate_post	The duplicate-post plugin before 2.6 for WordPress has XSS.	2019-08-21	4.3	CVE-2014-10378 MISC
fabrix -- total_security	The total-security plugin before 3.4.1 for WordPress has XSS.	2019-08-21	4.3	CVE-2016-10898 MISC
fabrix -- total_security	The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.	2019-08-21	5.0	CVE-2016-10899 MISC
football_pool_project -- football_pool	The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.	2019-08-20	4.3	CVE-2017-18524 MISC
formbuilder_project -- formbuilder	The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.	2019-08-21	4.3	CVE-2016-10910 MISC
fullworks -- stop_user_enumeration	The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.	2019-08-21	4.3	CVE-2017-18536 MISC
getawesomesupport -- awesome_support	The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.	2019-08-20	4.3	CVE-2015-9317 MISC
getawesomesupport -- awesome_support	The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.	2019-08-20	5.0	CVE-2015-9318 MISC
godaddy -- godaddy_email_marketing	The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.	2019-08-21	6.8	CVE-2016-10903 MISC
google -- android	In ActivityManagerService.attachApplication of ActivityManagerService, there is a possible race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-131105245.	2019-08-20	6.9	CVE-2019-2121 CONFIRM
google -- android	In LockTaskController.lockKeyguardIfNeeded of the LockTaskController.java, there was a difference in the handling of the default case between the WindowManager and the Settings. This could lead to a local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127605586.	2019-08-20	6.9	CVE-2019-2122 CONFIRM
google -- android	In ChangeDefaultDialerDialog.java, there is a possible escalation of privilege due to an overlay attack. This could lead to local escalation of privilege, granting privileges to a local app without the user's informed consent, with no additional privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132275252.	2019-08-20	4.4	CVE-2019-2125 CONFIRM
google -- android	In extract3GPPGlobalDescriptions of TextDescriptions.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-124781927.	2019-08-20	4.3	CVE-2019-2129 CONFIRM
google -- android	In the endCall() function of TelecomManager.java, there is a possible Denial of Service due to a missing permission check. This could lead to local denial of access to Emergency Services with User execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-132438333.	2019-08-20	4.9	CVE-2019-2137 CONFIRM
gopro -- gpmf-parser	GoPro GPMF-parser 1.2.2 has a heap-based buffer over-read (4 bytes) in GPMF_Next in GPMF_parser.c.	2019-08-18	4.3	CVE-2019-15146 MISC MISC
gopro -- gpmf-parser	GoPro GPMF-parser 1.2.2 has an out-of-bounds read and SEGV in GPMF_Next in GPMF_parser.c.	2019-08-18	4.3	CVE-2019-15147 MISC MISC
gopro -- gpmf-parser	GoPro GPMF-parser 1.2.2 has an out-of-bounds write in OpenMP4Source in demo/GPMF_mp4reader.c.	2019-08-18	4.3	CVE-2019-15148 MISC MISC
gowebsolutions -- wp_customer_reviews	The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.	2019-08-21	4.3	CVE-2016-10901 MISC
gowebsolutions -- wp_customer_reviews	The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.	2019-08-21	6.8	CVE-2016-10902 MISC
ibericode -- mailchimp	The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.	2019-08-22	4.3	CVE-2017-18577 MISC
ibm -- api_connect	IBM API Connect 2018.1 through 2018.4.1.6 developer portal could allow an unauthorized user to cause a denial of service via an unprotected API. IBM X-Force ID: 162263.	2019-08-20	5.0	CVE-2019-4402 XF CONFIRM
ibm -- api_connect	IBM API Connect 2018.1 through 2018.4.1.6 may inadvertently leak sensitive details about internal servers and network via API swagger. IBM X-force ID: 162947.	2019-08-20	5.0	CVE-2019-4437 CONFIRM XF
ibm -- api_connect	IBM API Connect 5.0.0.0 through 5.0.8.6 developer portal could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 163681.	2019-08-20	5.0	CVE-2019-4460 XF CONFIRM
ibm -- emptoris_sourcing	IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164068.	2019-08-20	4.0	CVE-2019-4484 XF CONFIRM
ibm -- intelligent_operations_center	IBM Intelligent Operations Center V5.1.0 through V5.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162737.	2019-08-20	6.4	CVE-2019-4419 XF CONFIRM
ibm -- security_guardium_big_data_intelligence	IBM Security Guardium Big Data Intelligence 4.0 (SonarG) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161036.	2019-08-20	5.0	CVE-2019-4310 XF CONFIRM
ibm -- security_guardium_big_data_intelligence	IBM Security Guardium Big Data Intelligence 4.0 (SonarG) does not properly restrict the size or amount of resources that are requested or influenced by an actor. This weakness can be used to consume more resources than intended. IBM X-Force ID: 161417.	2019-08-20	5.0	CVE-2019-4338 XF CONFIRM
ibm -- storediq	IBM StoredIQ 7.6.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158700.	2019-08-20	4.3	CVE-2019-4167 CONFIRM XF
imagemagick -- imagemagick	WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.	2019-08-18	4.3	CVE-2019-15141 MISC MISC
ivycat -- posts_in_page	The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.	2019-08-22	5.5	CVE-2017-18585 MISC MISC
joomunited -- wp_latest_posts	The wp-latest-posts plugin before 3.7.5 for WordPress has XSS.	2019-08-20	4.3	CVE-2016-10913 MISC
kbrw -- sweet_xml	The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD.	2019-08-19	5.0	CVE-2019-15160 MISC MISC
linux -- linux_kernel	An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and read_rindex_entry.	2019-08-18	6.1	CVE-2016-10905 MISC
linux -- linux_kernel	An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the functions arc_emac_tx and arc_emac_tx_clean.	2019-08-18	4.4	CVE-2016-10906 MISC
linux -- linux_kernel	An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4.8.6. There is an out of bounds write in the function ad5755_parse_dt.	2019-08-18	4.6	CVE-2016-10907 MISC MISC
linux -- linux_kernel	An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated.	2019-08-18	4.6	CVE-2017-18551 MISC MISC
linux -- linux_kernel	An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rds_recv_track_latency.	2019-08-18	4.6	CVE-2017-18552 MISC
linux -- linux_kernel	An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A use after free exists, related to xfs_fs_fill_super failure.	2019-08-18	4.6	CVE-2018-20976 MISC
linux -- linux_kernel	An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/v4l2-core/v4l2-dev.c driver because drivers/media/radio/radio-raremono.c does not properly allocate memory.	2019-08-19	4.9	CVE-2019-15211 MLIST MISC MISC MISC
linux -- linux_kernel	An issue was discovered in the Linux kernel before 5.1.8. There is a double-free caused by a malicious USB device in the drivers/usb/misc/rio500.c driver.	2019-08-19	4.9	CVE-2019-15212 MLIST MISC MISC MISC
linux -- linux_kernel	An issue was discovered in the Linux kernel before 5.2.3. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/dvb-usb/dvb-usb-init.c driver.	2019-08-19	4.9	CVE-2019-15213 MLIST MISC MISC MISC
linux -- linux_kernel	An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because card disconnection causes certain data structures to be deleted too early. This is related to sound/core/init.c and sound/core/info.c.	2019-08-19	4.7	CVE-2019-15214 MLIST MISC MISC MISC MISC
linux -- linux_kernel	An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/cpia2/cpia2_usb.c driver.	2019-08-19	4.9	CVE-2019-15215 MLIST MISC MISC MISC
linux -- linux_kernel	An issue was discovered in the Linux kernel before 5.0.14. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/yurex.c driver.	2019-08-19	4.9	CVE-2019-15216 MLIST MLIST MLIST MLIST MLIST MISC MISC MISC
linux -- linux_kernel	An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver.	2019-08-19	4.9	CVE-2019-15217 MLIST MLIST MLIST MLIST MLIST MISC MISC MISC
linux -- linux_kernel	An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/siano/smsusb.c driver.	2019-08-19	4.9	CVE-2019-15218 MLIST MLIST MLIST MLIST MLIST MISC MISC MISC
linux -- linux_kernel	An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/sisusbvga/sisusb.c driver.	2019-08-19	4.9	CVE-2019-15219 MLIST MLIST MLIST MLIST MLIST MISC MISC MISC
linux -- linux_kernel	An issue was discovered in the Linux kernel before 5.2.1. There is a use-after-free caused by a malicious USB device in the drivers/net/wireless/intersil/p54/p54usb.c driver.	2019-08-19	4.9	CVE-2019-15220 MLIST MISC MISC MISC
linux -- linux_kernel	An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/pcm.c driver.	2019-08-19	4.9	CVE-2019-15221 MLIST MISC MISC MISC
linux -- linux_kernel	An issue was discovered in the Linux kernel before 5.2.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/helper.c (motu_microbookii) driver.	2019-08-19	4.9	CVE-2019-15222 MLIST MISC MISC MISC
linux -- linux_kernel	An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/driver.c driver.	2019-08-19	4.9	CVE-2019-15223 MLIST MISC MISC MISC
linux -- linux_kernel	An issue was discovered in the Linux kernel through 5.2.9. There is a NULL pointer dereference caused by a malicious USB device in the ath6kl_usb_alloc_urb_from_pipe function in the drivers/net/wireless/ath/ath6kl/usb.c driver.	2019-08-20	4.9	CVE-2019-15290 MLIST MLIST MISC
linux -- linux_kernel	An issue was discovered in the Linux kernel through 5.2.9. There is a NULL pointer dereference caused by a malicious USB device in the flexcop_usb_probe function in the drivers/media/usb/b2c2/flexcop-usb.c driver.	2019-08-20	4.9	CVE-2019-15291 MLIST MLIST MISC
marvinlabs -- wp_customer_area	The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.	2019-08-20	4.3	CVE-2017-18519 MISC
matchboxdesigngroup -- universal_analytics	The universal-analytics plugin before 1.3.1 for WordPress has XSS.	2019-08-21	4.3	CVE-2016-10912 MISC
mediaburst -- booking_calendar	The booking-sms plugin before 1.1.0 for WordPress has XSS.	2019-08-21	4.3	CVE-2017-18555 MISC
megamenu -- max_mega_menu	The megamenu plugin before 2.4 for WordPress has XSS.	2019-08-21	4.3	CVE-2017-18525 MISC
mythemeshop -- my_wp_translate	The my-wp-translate plugin before 1.0.4 for WordPress has XSS.	2019-08-20	4.3	CVE-2017-18568 MISC
mythemeshop -- my_wp_translate	The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.	2019-08-20	6.8	CVE-2017-18569 MISC
ncrafts -- formcraft	The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.	2019-08-16	6.8	CVE-2019-15114 MISC
nps_project -- nps	lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.	2019-08-16	5.8	CVE-2019-15119 MISC MISC
open-emr -- openemr	In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.	2019-08-20	4.3	CVE-2019-3963 MISC
open-emr -- openemr	In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.	2019-08-20	4.3	CVE-2019-3964 MISC
open-emr -- openemr	In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.	2019-08-20	4.3	CVE-2019-3965 MISC
optiontree_project -- optiontree	The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.	2019-08-20	4.3	CVE-2015-9320 MISC MISC
optiontree_project -- optiontree	The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.	2019-08-20	4.3	CVE-2016-10895 MISC
raygun -- raygun4wp	The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.	2019-08-20	4.3	CVE-2017-18531 MISC
schine.games -- mw-oauth2client	In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function.	2019-08-19	6.8	CVE-2019-15150 MISC FULLDISC MLIST CONFIRM CONFIRM BUGTRAQ
smokesignal_project -- smokesignal	The smokesignal plugin before 1.2.7 for WordPress has XSS.	2019-08-21	4.3	CVE-2017-18535 MISC
soflyy -- wp_all_import	The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.	2019-08-20	4.3	CVE-2015-9329 MISC
soflyy -- wp_all_import	The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.	2019-08-20	5.0	CVE-2015-9331 MISC
soflyy -- wp_all_import	The wp-all-import plugin before 3.4.6 for WordPress has XSS.	2019-08-20	4.3	CVE-2017-18567 MISC
soflyy -- wp_all_import	The wp-all-import plugin before 3.4.7 for WordPress has XSS.	2019-08-20	4.3	CVE-2018-20978 MISC
supsystic -- popup	The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.	2019-08-20	6.8	CVE-2016-10915 MISC
swimordiesoftware -- rsvp	The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.	2019-08-21	4.3	CVE-2017-18563 MISC
wordpress_uninstall_project -- wordpress_uninstall	The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.	2019-08-20	5.8	CVE-2015-9332 MISC
wp-kama -- democracy_poll	The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.	2019-08-20	4.3	CVE-2017-18520 MISC MISC
wp-kama -- democracy_poll	The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.	2019-08-21	6.8	CVE-2017-18521 MISC MISC
wp-slimstat -- slimstat_analytics	The wp-slimstat plugin before 4.8.1 for WordPress has XSS.	2019-08-21	4.3	CVE-2019-15112 MISC MISC
wp_front_end_profile_project -- wp_front_end_profile	The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.	2019-08-21	4.3	CVE-2019-15110 MISC
wpmanage -- uji_countdown	The uji-countdown plugin before 2.0.7 for WordPress has XSS.	2019-08-21	4.3	CVE-2016-10900 MISC
xakuro -- xo_security	The xo-security plugin before 1.5.3 for WordPress has XSS.	2019-08-16	4.3	CVE-2017-18541 MISC
yofla -- 360_product_rotation	The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS.	2019-08-20	4.3	CVE-2019-15082 MISC MISC

Low Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
ibm -- business_automation_workflow	IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive information from another user by inserting links that would be clicked on by unsuspecting users. IBM X-Force ID: 162771.	2019-08-20	3.5	CVE-2019-4425 XF CONFIRM
ibm -- cloud_private	IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158146.	2019-08-20	3.5	CVE-2019-4120 CONFIRM XF
ibm -- emptoris_spend_analysis	IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 164066.	2019-08-20	3.5	CVE-2019-4482 XF CONFIRM
ibm -- intelligent_operations_center	IBM Intelligent Operations Center V5.1.0 through V5.2.0 could disclose detailed error messages, revealing sensitive information that could aid in further attacks against the system. IBM X-Force ID: 162738.	2019-08-20	2.1	CVE-2019-4420 XF CONFIRM
linux -- linux_kernel	An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_send_raw_srb does not initialize the reply structure.	2019-08-18	2.1	CVE-2017-18549 MISC
linux -- linux_kernel	An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_get_hba_info does not initialize the hbainfo structure.	2019-08-18	2.1	CVE-2017-18550 MISC
open-xchange -- open-xchange_appsuite	OX App Suite 7.10.0 to 7.10.2 allows XSS.	2019-08-20	3.5	CVE-2019-11522 MISC
vanderbilt -- redcap	REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file.	2019-08-21	3.5	CVE-2019-15127 CONFIRM

Severity Not Yet Assigned

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
acdsee -- photo_studio_standard	An issue was discovered in ACDSee Photo Studio Standard 22.1 Build 1159. There is a User Mode Write AV starting at IDE_ACDStd!IEP_ShowPlugInDialog+0x000000000023d060.	2019-08-21	not yet calculated	CVE-2019-15293 MISC
adplub -- adplug	AdPlug 2.3.1 has a double free in the Cu6mPlayer class in u6m.h.	2019-08-18	not yet calculated	CVE-2019-15151 MISC
ampache -- ampache	An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known by the attacker.	2019-08-22	not yet calculated	CVE-2019-12386 MISC
ampache -- ampache	An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/search.class.php searches (even guest users) can dump any data contained in the database (sessions, hashed passwords, etc.). This may lead to a full compromise of admin accounts, when combined with the weak password generator algorithm used in the lostpassword functionality.	2019-08-22	not yet calculated	CVE-2019-12385 MISC
apache -- commons_beanutils	In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.	2019-08-20	not yet calculated	CVE-2019-10086 MLIST MLIST
apache -- santuario_xml_security_for_java	In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.	2019-08-23	not yet calculated	CVE-2019-12400 CONFIRM
aspose -- aspose.cells	An exploitable out-of-bounds read vulnerability exists in the LabelSst record parser of Aspose Aspose.Cells 19.1.0 library. A specially crafted XLS file can cause an out-of-bounds read, resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.	2019-08-21	not yet calculated	CVE-2019-5032 MISC
aspose -- aspose.cells	An exploitable out-of-bounds read vulnerability exists in the Number record parser of Aspose Aspose.Cells 19.1.0 library. A specially crafted XLS file can cause an out-of-bounds read, resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.	2019-08-21	not yet calculated	CVE-2019-5033 MISC
aspose -- aspose.words	An exploitable Stack Based Buffer Overflow vulnerability exists in the EnumMetaInfo function of Aspose Aspose.Words library, version 18.11.0.0. A specially crafted doc file can cause a stack-based buffer overflow, resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger this vulnerability.	2019-08-21	not yet calculated	CVE-2019-5041 MISC
assign-deep -- assign-deep	assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.	2019-08-20	not yet calculated	CVE-2019-10745 CONFIRM
asymmetric-infosec -- power-response	Power-Response before 2019-02-02 allows directory traversal (up to the application's main directory) via a plugin.	2019-08-23	not yet calculated	CVE-2019-15519 MISC
atlassian -- confluence	The Live:Text Box macro in the Old Street Live Input Macros app before 2.11 for Confluence has XSS, leading to theft of the Administrator Session Cookie.	2019-08-20	not yet calculated	CVE-2019-15233 MISC MISC
atlassian -- jira	The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the priority icon url of an issue priority.	2019-08-23	not yet calculated	CVE-2019-11584 MISC
atlassian -- jira	The wikirenderer component in Jira before version 7.13.6, and from version 8.0.0 before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in image attribute specification.	2019-08-23	not yet calculated	CVE-2019-8444 MISC
atlassian -- jira	The ChangeSharedFilterOwner resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to attack users, in some cases be able to obtain a user's Cross-site request forgery (CSRF) token, via a open redirect vulnerability.	2019-08-23	not yet calculated	CVE-2019-11589 MISC
atlassian -- jira	The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site request forgery (CSRF) vulnerability.	2019-08-23	not yet calculated	CVE-2019-8447 MISC
atlassian -- jira	Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worklog time information via a missing permissions check.	2019-08-23	not yet calculated	CVE-2019-8445 MISC
atlassian -- jira	The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check.	2019-08-23	not yet calculated	CVE-2019-8446 MISC
atlassian -- jira	The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to create new resolutions via a Cross-site request forgery (CSRF) vulnerability.	2019-08-23	not yet calculated	CVE-2019-11586 MISC
atlassian -- jira	The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to trigger garbage collection via a Cross-site request forgery (CSRF) vulnerability.	2019-08-23	not yet calculated	CVE-2019-11588 MISC
atlassian -- jira	Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allow remote attackers to modify various settings via Cross-site request forgery (CSRF).	2019-08-23	not yet calculated	CVE-2019-11587 MISC
atlassian -- jira	The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect.	2019-08-23	not yet calculated	CVE-2019-11585 MISC
atlassian -- universal_plugin_manager	The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before version 3.0.3 and from version 4.0.0 before version 4.0.3 allows remote attackers to uninstall plugins using a Cross-Site Request Forgery (CSRF) vulnerability on an authenticated administrator.	2019-08-23	not yet calculated	CVE-2019-14999 MISC
autodesk -- design_review	DLL preloading vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a user into opening a malicious DWF file that may leverage a DLL preloading vulnerability, which may result in code execution.	2019-08-23	not yet calculated	CVE-2019-7362 CONFIRM
autodesk -- design_review	Use-after-free vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a user into opening a malicious DWF file that may leverage a use-after-free vulnerability, which may result in code execution.	2019-08-23	not yet calculated	CVE-2019-7363 CONFIRM
autodesk -- multiple_products	DLL preloading vulnerability in versions 2017, 2018, 2019, and 2020 of Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D and version 2017 of AutoCAD P&ID. An attacker may trick a user into opening a malicious DWG file that may leverage a DLL preloading vulnerability in AutoCAD which may result in code execution.	2019-08-23	not yet calculated	CVE-2019-7364 CONFIRM
belwith_products -- hickory_smart_ethernet_bridge	A cleartext transmission of sensitive information vulnerability is present in Hickory Smart Ethernet Bridge from Belwith Products, LLC. Captured data reveals that the Hickory Smart Ethernet Bridge device communicates over the network to an MQTT broker without using encryption. This exposed the default username and password used to authenticate to the MQTT broker. This issue affects Hickory Smart Ethernet Bridge, model number H077646. The firmware does not appear to contain versioning information.	2019-08-22	not yet calculated	CVE-2019-5635 MISC MISC
belwith_products -- hickory_smart_for_android	An insecure storage of sensitive information vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. The application's database was found to contain information that could be used to control the lock devices remotely. This issue affects Hickory Smart for Android, version 01.01.43 and prior versions.	2019-08-22	not yet calculated	CVE-2019-5632 MISC MISC
belwith_products -- hickory_smart_for_android	An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communications to the internet API services and direct connections to the lock via Bluetooth Low Energy (BLE) from the mobile application are logged in a debug log on the Android device at HickorySmartLog/Logs/SRDeviceLog.txt. This information was found stored in the Android device's default USB or SDcard storage paths and is accessible without rooting the device. This issue affects Hickory Smart for Android, version 01.01.43 and prior versions.	2019-08-22	not yet calculated	CVE-2019-5634 MISC MISC
belwith_products -- hickory_smart_for_ios	An insecure storage of sensitive information vulnerability is present in Hickory Smart for iOS mobile devices from Belwith Products, LLC. The application's database was found to contain information that could be used to control the lock devices remotely. This issue affects Hickory Smart for iOS, version 01.01.07 and prior versions.	2019-08-22	not yet calculated	CVE-2019-5633 MISC MISC
bitdefender -- bitdefender_free_antivirus_2020	An Untrusted Search Path vulnerability in the ServiceInstance.dll library versions 1.0.15.119 and lower, as used in Bitdefender Antivirus Free 2020 versions prior to 1.0.15.138, allows an attacker to load an arbitrary DLL file from the search path.	2019-08-21	not yet calculated	CVE-2019-15295 CONFIRM
bolt -- bolt	Bolt before 3.6.10 has XSS via an image's alt or title field.	2019-08-23	not yet calculated	CVE-2019-15484 MISC MISC
bolt -- bolt	Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.	2019-08-23	not yet calculated	CVE-2019-15485 MISC MISC
bolt -- bolt	Bolt before 3.6.10 has XSS via a title that is mishandled in the system log.	2019-08-23	not yet calculated	CVE-2019-15483 MISC MISC
bosch -- prosyst_mbs_sdk_and_bosch_iot_gateway_software	A directory traversal vulnerability in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location.	2019-08-21	not yet calculated	CVE-2019-11601 CONFIRM
bosch -- prosyst_mbs_sdk_and_bosch_iot_gateway_software	A HTTP Traversal Attack in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.0.2 allows remote attackers to read files outside the http root.	2019-08-21	not yet calculated	CVE-2019-11603 CONFIRM
bosch -- prosyst_mbs_sdk_and_bosch_iot_gateway_software	Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to gather information about the file system structure.	2019-08-21	not yet calculated	CVE-2019-11602 CONFIRM
bosch -- prosyst_mbs_sdk_and_bosch_iot_gateway_software	A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. In addition, this could potentially allow an attacker to read sensitive zip files from the local server.	2019-08-21	not yet calculated	CVE-2019-11897 CONFIRM
cesnet -- proxystatistics-simplesamlphp-module	The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php.	2019-08-23	not yet calculated	CVE-2019-15537 MISC MISC
cisco -- enterprise_network_functions_infrastructure_software	A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform file enumeration on an affected system. The vulnerability is due to the web server responding with different error codes for existing and non-existing files. An attacker could exploit this vulnerability by sending GET requests for different file names. A successful exploit could allow the attacker to enumerate files residing on the system.	2019-08-21	not yet calculated	CVE-2019-12623 CISCO
cisco -- enterprise_network_functions_virtualization_infrastructure_software	A vulnerability in Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with administrator privileges to overwrite files on the underlying operating system (OS) of an affected device. The vulnerability is due to improper input validation in an NFVIS file-system command. An attacker could exploit this vulnerability by using crafted variables during the execution of an affected command. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying OS.	2019-08-21	not yet calculated	CVE-2019-1984 CISCO
cisco -- firepower_threat_defense_software	A vulnerability in the application policy configuration of the Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data. The vulnerability is due to insufficient application identification. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain unauthorized read access to sensitive data.	2019-08-21	not yet calculated	CVE-2019-12627 CISCO
cisco -- hyperflex_software	A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack. The vulnerability is due to insufficient key management. An attacker could exploit this vulnerability by obtaining a specific encryption key for the cluster. A successful exploit could allow the attacker to perform a man-in-the-middle attack against other nodes in the cluster.	2019-08-21	not yet calculated	CVE-2019-12621 CISCO
cisco -- integrated_management_controller	A vulnerability in the Intelligent Platform Management Interface (IPMI) implementation of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to view sensitive system information. The vulnerability is due to insufficient security restrictions imposed by the affected software. A successful exploit could allow the attacker to view sensitive information that belongs to other users. The attacker could then use this information to conduct additional attacks.	2019-08-21	not yet calculated	CVE-2019-1908 CISCO
cisco -- integrated_management_controller	A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. An attacker would need to have valid administrator credentials on the device. The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker with elevated privileges could exploit this vulnerability by sending crafted commands to the administrative web management interface of the affected software. A successful exploit could allow the attacker to inject and execute arbitrary, system-level commands with root privileges on an affected device.	2019-08-21	not yet calculated	CVE-2019-1850 CISCO
cisco -- integrated_management_controller	A vulnerability in the command-line interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands that could allow them to obtain root privileges. The vulnerability is due to insufficient validation of user-supplied input on the command-line interface. An attacker could exploit this vulnerability by authenticating with read-only privileges via the CLI of an affected device and submitting crafted input to the affected commands. A successful exploit could allow an attacker to execute arbitrary commands on the device with root privileges.	2019-08-21	not yet calculated	CVE-2019-1883 CISCO
cisco -- integrated_management_controller	A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to set sensitive configuration values and gain elevated privileges. The vulnerability is due to improper handling of substring comparison operations that are performed by the affected software. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow the attacker with read-only privileges to gain administrator privileges.	2019-08-21	not yet calculated	CVE-2019-1907 CISCO
cisco -- integrated_management_controller	A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to cause the web server process to crash, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient validation of user-supplied input on the web interface. An attacker could exploit this vulnerability by submitting a crafted HTTP request to certain endpoints of the affected software. A successful exploit could allow an attacker to cause the web server to crash. Physical access to the device may be required for a restart.	2019-08-21	not yet calculated	CVE-2019-1900 CISCO
cisco -- integrated_management_controller	A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject arbitrary commands and obtain root privileges. The vulnerability is due to insufficient validation of user-supplied input in the Certificate Signing Request (CSR) function of the web-based management interface. An attacker could exploit this vulnerability by submitting a crafted CSR in the web-based management interface. A successful exploit could allow an attacker with administrator privileges to execute arbitrary commands on the device with full root privileges.	2019-08-21	not yet calculated	CVE-2019-1896 CISCO
cisco -- integrated_management_controller	A vulnerability in the Redfish protocol of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject and execute arbitrary commands with root privileges on an affected device. The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker could exploit this vulnerability by sending crafted authenticated commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to inject and execute arbitrary commands on an affected device with root privileges.	2019-08-21	not yet calculated	CVE-2019-1885 CISCO
cisco -- integrated_management_controller	A vulnerability in the Intelligent Platform Management Interface (IPMI) of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on the underlying operating system (OS). The vulnerability is due to insufficient input validation of user-supplied commands. An attacker who has administrator privileges and access to the network where the IPMI resides could exploit this vulnerability by submitting crafted input to the affected commands. A successful exploit could allow the attacker to gain root privileges on the affected device.	2019-08-21	not yet calculated	CVE-2019-1634 CISCO
cisco -- integrated_management_controller	A vulnerability in the Import Cisco IMC configuration utility of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition and implement arbitrary commands with root privileges on an affected device. The vulnerability is due to improper bounds checking by the import-config process. An attacker could exploit this vulnerability by sending malicious packets to an affected device. When the packets are processed, an exploitable buffer overflow condition may occur. A successful exploit could allow the attacker to implement arbitrary code on the affected device with elevated privileges.	2019-08-21	not yet calculated	CVE-2019-1871 CISCO
cisco -- integrated_management_controller	A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. The vulnerability is due to insufficient validation of command input by the affected software. An attacker could exploit this vulnerability by sending malicious commands to the web-based management interface of the affected software. A successful exploit could allow the attacker, with read-only privileges, to inject and execute arbitrary, system-level commands with root privileges on an affected device.	2019-08-21	not yet calculated	CVE-2019-1864 CISCO
cisco -- integrated_management_controller	A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to make unauthorized changes to the system configuration. The vulnerability is due to insufficient authorization enforcement. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow a user with read-only privileges to change critical system configurations using administrator privileges.	2019-08-21	not yet calculated	CVE-2019-1863 CISCO
cisco -- integrated_management_controller	A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker could exploit this vulnerability by invoking an interface monitoring mechanism with a crafted argument on the affected software. A successful exploit could allow the attacker to inject and execute arbitrary, system-level commands with root privileges on an affected device.	2019-08-21	not yet calculated	CVE-2019-1865 CISCO
cisco -- ios_xe_new_generation_wireless_controller	A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller (NGWC) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected device by using a web browser and with the privileges of the user.	2019-08-21	not yet calculated	CVE-2019-12624 CISCO
cisco -- multiple_products	A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing user authentication. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to use the acquired session token to gain full administrator access to the affected device.	2019-08-21	not yet calculated	CVE-2019-1937 CISCO
cisco -- multiple_products	A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User account (scpuser), which has default user credentials. The vulnerability is due to the presence of a documented default account with an undocumented default password and incorrect permission settings for that account. Changing the default password for this account is not enforced during the installation of the product. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the scpuser account. This includes full read and write access to the system's database.	2019-08-21	not yet calculated	CVE-2019-1935 CISCO
cisco -- multiple_products	A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an authenticated, remote attacker to execute arbitrary commands on the underlying Linux shell as the root user. Exploitation of this vulnerability requires privileged access to an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by logging in to the web-based management interface with administrator privileges and then sending a malicious request to a certain part of the interface.	2019-08-21	not yet calculated	CVE-2019-1936 CISCO
cisco -- multiple_products	A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to a missing authentication check in an API call. An attacker who can send a request to an affected system could cause all currently authenticated users to be logged off. Repeated exploitation could cause the inability to maintain a session in the web-based management portal.	2019-08-21	not yet calculated	CVE-2019-12634 CISCO
cisco -- multiple_products	A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass user authentication and gain access as an administrative user. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to gain full administrative access to the affected device.	2019-08-21	not yet calculated	CVE-2019-1974 CISCO
cisco -- remote_phy_device_software	A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability occurs because the affected software improperly sanitizes user-supplied input. An attacker who has valid administrator access to an affected device could exploit this vulnerability by supplying various CLI commands with crafted arguments. A successful exploit could allow the attacker to run arbitrary commands as the root user, allowing complete compromise of the system.	2019-08-21	not yet calculated	CVE-2019-1839 CISCO
cisco -- roomos_software	A vulnerability in Cisco RoomOS Software could allow an authenticated, local attacker to write files to the underlying filesystem with root privileges. The vulnerability is due to insufficient permission restrictions on a specific process. An attacker could exploit this vulnerability by logging in to an affected device with remote support credentials and initiating the specific process on the device and sending crafted data to that process. A successful exploit could allow the attacker to write files to the underlying file system with root privileges.	2019-08-21	not yet calculated	CVE-2019-12622 CISCO
cisco -- ucs_director_and_ucs_director_express_for_big_data	A vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The vulnerability is due to improper authentication request handling. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an unprivileged attacker to access and execute arbitrary actions through certain APIs.	2019-08-21	not yet calculated	CVE-2019-1938 CISCO
cisco -- unified_contact_center_express	A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker needs valid administrator credentials.	2019-08-21	not yet calculated	CVE-2019-12626 CISCO
cisco -- webex_meetings_mobile	A vulnerability in Cisco Webex Meetings Mobile (iOS) could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data by using an invalid Secure Sockets Layer (SSL) certificate. The vulnerability is due to insufficient SSL certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted SSL certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software.	2019-08-21	not yet calculated	CVE-2019-1948 CISCO
code42_software -- code42_enterprise_and_crashplan_for_small_business	In Code42 Enterprise and Crashplan for Small Business through Client version 6.9.1, an attacker can craft a restore request to restore a file through the Code42 app to a location they do not have privileges to write.	2019-08-21	not yet calculated	CVE-2019-11551 CONFIRM
codimd -- codimd	CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL.	2019-08-23	not yet calculated	CVE-2019-15499 MISC
comelz -- quark	comelz Quark before 2019-03-26 allows directory traversal to locations outside of the project directory.	2019-08-23	not yet calculated	CVE-2019-15520 MISC
control_web_panel -- centos_control_web_panel	In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page.	2019-08-21	not yet calculated	CVE-2019-13476 MISC
control_web_panel -- centos_control_web_panel	In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comparing response times.	2019-08-21	not yet calculated	CVE-2019-13599 MISC
control_web_panel -- centos_control_web_panel	In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete databases (such as oauthv2) from the server via an attacker account.	2019-08-21	not yet calculated	CVE-2019-14245 MISC MISC
control_web_panel -- centos_control_web_panel	In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the root account.	2019-08-21	not yet calculated	CVE-2019-13477 MISC
control_web_panel -- centos_control_web_panel	In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to discover phpMyAdmin passwords (of any user in /etc/passwd) via an attacker account.	2019-08-21	not yet calculated	CVE-2019-14246 MISC MISC
cuberite -- cuberite	Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply removes one ../ substring.	2019-08-23	not yet calculated	CVE-2019-15516 MISC
d-link -- dir-823g_devices	An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Type field to SetWanSettings, a related issue to CVE-2019-13482.	2019-08-23	not yet calculated	CVE-2019-15526 MISC
d-link -- dir-823g_devices	An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the MaxIdTime field to SetWanSettings.	2019-08-23	not yet calculated	CVE-2019-15527 MISC
d-link -- dir-823g_devices	An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Interface field to SetStaticRouteSettings.	2019-08-23	not yet calculated	CVE-2019-15528 MISC
d-link -- dir-823g_devices	An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the LoginPassword field to Login.	2019-08-23	not yet calculated	CVE-2019-15530 MISC
d-link -- dir-823g_devices	An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Username field to Login.	2019-08-23	not yet calculated	CVE-2019-15529 MISC
daylight_studio -- fuel_cms	FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page.	2019-08-19	not yet calculated	CVE-2019-15229 MISC MISC
daylight_studio -- fuel_cms	FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors.	2019-08-19	not yet calculated	CVE-2019-15228 MISC MISC
deeply -- deeply	deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using using a _proto_ payload.	2019-08-23	not yet calculated	CVE-2019-10750 MISC
dell -- multiple_powerconnect_models	Dell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a plain-text password storage vulnerability. TACACS\Radius credentials are stored in plain text in the system settings menu. An authenticated malicious user with access to the system settings menu may obtain the exposed password to use it in further attacks.	2019-08-20	not yet calculated	CVE-2019-3753 CONFIRM
dfe-digital -- schools-experience	DfE School Experience before v16333-GA has XSS via a teacher training URL.	2019-08-23	not yet calculated	CVE-2019-15487 MISC MISC
django-js-reverse -- django-js-reverse	django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline.	2019-08-23	not yet calculated	CVE-2019-15486 MISC MISC
docker -- docker	In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in command injection into the underlying "git clone" command, leading to code execution in the context of the user executing the "docker build" command. This occurs because git ref can be misinterpreted as a flag.	2019-08-22	not yet calculated	CVE-2019-13139 MISC MISC MISC
domoticz -- domoticz	Domoticz 4.10717 has XSS via item.Name.	2019-08-23	not yet calculated	CVE-2019-15480 MISC MISC
elastic -- apm_agent_for_python	When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing.	2019-08-22	not yet calculated	CVE-2019-7617 MISC MISC
envoy -- envoy	In Envoy through 1.11.1, users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. A remote attacker may send a request with a very long URI to result in a denial of service (memory consumption). This is a related issue to CVE-2019-14993.	2019-08-19	not yet calculated	CVE-2019-15225 MISC
eprosima -- fast_rtps	The Access Control plugin in eProsima Fast RTPS through 1.9.0 allows fnmatch pattern matches with topic name strings (instead of the permission expressions themselves), which can lead to unintended connections between participants in a Data Distribution Service (DDS) network.	2019-08-18	not yet calculated	CVE-2019-15137 MISC MISC
eprosima -- fast_rtps	The Access Control plugin in eProsima Fast RTPS through 1.9.0 does not check partition permissions from remote participant connections, which can lead to policy bypass for a secure Data Distribution Service (DDS) partition.	2019-08-18	not yet calculated	CVE-2019-15136 MISC MISC
extenua -- silvershield	extenua SilverSHielD 6.x fails to secure its ProgramData folder, leading to a Local Privilege Escalation to SYSTEM. The attacker must replace SilverShield.config.sqlite with a version containing an additional user account, and then use SSH and port forwarding to reach a 127.0.0.1 service.	2019-08-17	not yet calculated	CVE-2019-13069 MISC MISC
faad2 -- faad2	An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faad_resetbits function in libfaad/bits.c is affected by a buffer overflow vulnerability. The number of bits to be read is determined by ld->buffer_size - words4, cast to uint32. If ld->buffer_size - words4 is negative, a buffer overflow is later performed via getdword_n(&ld->start[words], ld->bytes_left).	2019-08-21	not yet calculated	CVE-2019-15296 MISC
facebook -- fizz	A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resulting in memory exhaustion. This issue affects versions v2019.01.28.00 and above of fizz, until v2019.08.05.00.	2019-08-20	not yet calculated	CVE-2019-11924 MISC MISC CONFIRM
fat_free_crm -- fat_free_crm	Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.	2019-08-20	not yet calculated	CVE-2018-20975 CONFIRM CONFIRM CONFIRM
flightpath -- flightpath	FlightPath 4.8.3 has XSS in the Content, Edit urgent message, and Users sections of the Admin Console. This could lead to cookie stealing and other malicious actions.	2019-08-20	not yet calculated	CVE-2019-15227 MISC
floragunn -- search_guard	Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database.	2019-08-23	not yet calculated	CVE-2019-13421 CONFIRM MISC MISC
floragunn -- search_guard	Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user when providing wrong credentials when all of the following conditions a-c are true: a) Kibana is configured to use Single-Sign-On as authentication method, one of Kerberos, JWT, Proxy, Client certificate. b) The kibanaserver user is configured to use HTTP Basic as the authentication method. c) Search Guard is configured to use an SSO authentication domain and HTTP Basic at the same time	2019-08-23	not yet calculated	CVE-2019-13423 CONFIRM MISC
floragunn -- search_guard	Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the user to a potentially malicious site upon Kibana login.	2019-08-23	not yet calculated	CVE-2019-13422 CONFIRM MISC
forcepoint -- next_generation_firewall	Forcepoint Next Generation Firewall (Forcepoint NGFW) 6.4.x before 6.4.7, 6.5.x before 6.5.4, and 6.6.x before 6.6.2 has a serious authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services protected by the NGFW Engine. The vulnerability affects the following NGFW features when the LDAP authentication method is used as the backend authentication: IPsec VPN, SSL VPN or Browser-based user authentication. The vulnerability does not apply when any other backend authentication is used. The RADIUS authentication method is not vulnerable, for example.	2019-08-20	not yet calculated	CVE-2019-6143 CONFIRM
formers -- former	Former before 4.2.1 has XSS via a checkbox value.	2019-08-23	not yet calculated	CVE-2019-15476 MISC MISC
fortinet -- fortinac	An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.	2019-08-23	not yet calculated	CVE-2019-5594 CONFIRM
fortinet -- fortios	An information exposure vulnerability in FortiOS 6.2.0 and below may allow an unauthenticated attacker to gain platform information such as version, models, via parsing a JavaScript file through admin webUI.	2019-08-23	not yet calculated	CVE-2018-13367 CONFIRM
fortinet -- fortios_vm_and_fortimanager_vm	Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.	2019-08-23	not yet calculated	CVE-2019-6695 CONFIRM
fortinet -- fortirecorder	Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge of the aforementioned credentials and network access to FortiCameras to take control of those, provided they are managed by a FortiRecorder device.	2019-08-23	not yet calculated	CVE-2019-6698 CONFIRM
fortinet -- ips_engine	Multiple padding oracle vulnerabilities (Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length) in the CBC padding implementation of FortiOS IPS engine version 5.000 to 5.006, 4.000 to 4.036, 4.200 to 4.219, 3.547 and below, when configured with SSL Deep Inspection policies and with the IPS sensor enabled, may allow an attacker to decipher TLS connections going through the FortiGate via monitoring the traffic in a Man-in-the-middle position.	2019-08-23	not yet calculated	CVE-2019-5592 CONFIRM
fuji_electric -- alpha5_smart_loader	Multiple buffer overflow issues have been identified in Alpha5 Smart Loader: All versions prior to 4.2. An attacker could use specially crafted project files to overflow the buffer and execute code under the privileges of the application.	2019-08-20	not yet calculated	CVE-2019-13520 MISC
galliumos -- galliumos	In GalliumOS 3.0, CONFIG_SECURITY_YAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/ptrace_scope to 1, which might increase risk because of the appearance that a protection mechanism is present when actually it is not.	2019-08-22	not yet calculated	CVE-2019-15325 MISC MISC
giflib -- giflib	In GIFLIB before 2019-02-16, a malformed GIF file triggers a divide-by-zero exception in the decoder function DGifSlurp in dgif_lib.c if the height field of the ImageSize data structure is equal to zero.	2019-08-17	not yet calculated	CVE-2019-15133 MISC UBUNTU
gnu -- libextractor	GNU Libextractor through 1.9 has a heap-based buffer over-read in the function EXTRACTOR_dvi_extract_method in plugins/dvi_extractor.c.	2019-08-23	not yet calculated	CVE-2019-15531 MISC
google -- android	In phFriNfc_ExtnsTransceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132083376.	2019-08-20	not yet calculated	CVE-2019-2134 CONFIRM
google -- android	In CompilationJob::FinalizeJob of compiler.cc, there is a possible remote code execution due to type confusion. This could lead to escalation of privilege from a malicious proxy configuration with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132073833.	2019-08-20	not yet calculated	CVE-2019-2130 CONFIRM
google -- android	In Status::readFromParcel of Status.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132650049.	2019-08-20	not yet calculated	CVE-2019-2136 CONFIRM
google -- android	In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-125900276.	2019-08-20	not yet calculated	CVE-2019-2135 CONFIRM
google -- android	In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132082342.	2019-08-20	not yet calculated	CVE-2019-2133 CONFIRM
google -- android	It is possible to overlay the VPN dialog by a malicious application. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-130568701.	2019-08-20	not yet calculated	CVE-2019-2132 CONFIRM
google -- android	In OatFileAssistant::GenerateOatFile of oat_file_assistant.cc, there is a possible file corruption issue due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-130821293.	2019-08-20	not yet calculated	CVE-2019-2120 CONFIRM
google -- android	An application with overlay permission can display overlays on top of settings UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-119115683.	2019-08-20	not yet calculated	CVE-2019-2131 CONFIRM
google -- nest_cam_iq_indoor	An exploitable information disclosure vulnerability exists in the Weave Legacy Pairing functionality of Nest Cam IQ Indoor version 4620002. A set of specially crafted weave packets can cause an out of bounds read, resulting in information disclosure. An attacker can send packets to trigger this vulnerability.	2019-08-20	not yet calculated	CVE-2019-5034 MISC
google -- nest_cam_iq_indoor	An exploitable denial-of-service vulnerability exists in the Weave certificate loading functionality of Nest Cam IQ Indoor camera, version 4620002. A specially crafted weave packet can cause an integer overflow and an out-of-bounds read on unmapped memory to occur, resulting in a denial of service. An attacker can send a specially crafted packet to trigger.	2019-08-20	not yet calculated	CVE-2019-5037 MISC
google -- nest_cam_iq_indoor	An exploitable denial-of-service vulnerability exists in the Weave error reporting functionality of the Nest Cam IQ Indoor, version 4620002. A specially crafted weave packets can cause an arbitrary Weave Exchange Session to close, resulting in a denial of service. An attacker can send a specially crafted packet to trigger this vulnerability.	2019-08-20	not yet calculated	CVE-2019-5036 MISC
google -- nest_cam_iq_indoor	An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of specially crafted weave packets can brute force a pairing code, resulting in greater Weave access and potentially full device control. An attacker can send specially crafted packets to trigger this vulnerability.	2019-08-20	not yet calculated	CVE-2019-5035 MISC
google -- nest_labs_openweave-core	An exploitable command execution vulnerability exists in the ASN1 certificate writing functionality of Openweave-core version 4.0.2. A specially crafted weave certificate can trigger a heap-based buffer overflow, resulting in code execution. An attacker can craft a weave certificate to trigger this vulnerability.	2019-08-20	not yet calculated	CVE-2019-5039 MISC
google -- nest_labs_openweave-core	An exploitable command execution vulnerability exists in the print-tlv command of Weave tool. A specially crafted weave TLV can trigger a stack-based buffer overflow, resulting in code execution. An attacker can trigger this vulnerability by convincing the user to open a specially crafted Weave command.	2019-08-20	not yet calculated	CVE-2019-5038 MISC
google -- nest_labs_openweave-core_and_nest_cam_iq_indoor	An exploitable information disclosure vulnerability exists in the Weave MessageLayer parsing of Openweave-core version 4.0.2 and Nest Cam IQ Indoor version 4620002. A specially crafted weave packet can cause an integer overflow to occur, resulting in PacketBuffer data reuse. An attacker can send a packet to trigger this vulnerability.	2019-08-20	not yet calculated	CVE-2019-5040 MISC
hot -- tasking-manager	Tasking Manager before 3.4.0 allows SQL Injection via custom SQL.	2019-08-23	not yet calculated	CVE-2019-15535 MISC MISC
httpie -- httpie	All versions of the HTTPie package are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.	2019-08-23	not yet calculated	CVE-2019-10751 MISC
humanica -- humatrix	The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to upload any file type to a candidate's profile picture folder via a crafted recruitment_online/personalData/act_personaltab.cfm multiple-part POST request with a predictable WRC01_USERID parameter. Moreover, the attacker can upload executable content (e.g., asp or aspx) for executing OS commands on the server.	2019-08-18	not yet calculated	CVE-2019-15130 MISC
humanica -- humatrix	The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to access all candidates' files in the photo folder on the website by specifying a "user id" parameter and file name, such as in a recruitment_online/upload/user/[user_id]/photo/[file_name] URI.	2019-08-18	not yet calculated	CVE-2019-15129 MISC
ibm -- cloud_private	IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158116.	2019-08-20	not yet calculated	CVE-2019-4117 CONFIRM XF
ibm -- emptoris_sourcing	IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164069.	2019-08-20	not yet calculated	CVE-2019-4485 XF CONFIRM
ibm -- informix_dynamic_server_enterprise_edition	IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local privileged Informix user to load a malicious shared library and gain root access privileges. IBM X-Force ID: 159941.	2019-08-20	not yet calculated	CVE-2019-4253 CONFIRM XF
ibm -- informix_dynamic_server_enterprise_edition	Stack-based buffer overflow in oninit in IBM Informix Dynamic Server Enterprise Edition 12.1 allows an authenticated user to execute predefined code with root privileges, such as escalating to a root shell. IBM X-Force ID: 144441.	2019-08-20	not yet calculated	CVE-2018-1636 CONFIRM XF
ibm -- informix_dynamic_server_enterprise_edition	IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in onsrvapd. IBM X-Force ID: 144434.	2019-08-20	not yet calculated	CVE-2018-1633 CONFIRM XF
ibm -- informix_dynamic_server_enterprise_edition	IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in .infxdirs. IBM X-Force ID: 144432.	2019-08-20	not yet calculated	CVE-2018-1632 CONFIRM XF
ibm -- informix_dynamic_server_enterprise_edition	Stack-based buffer overflow in oninit in IBM Informix Dynamic Server Enterprise Edition 12.1 allows an authenticated user to execute predefined code with root privileges, such as escalating to a root shell. IBM X-Force ID: 144439.	2019-08-20	not yet calculated	CVE-2018-1635 CONFIRM XF
ibm -- informix_dynamic_server_enterprise_edition	IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user to load malicious libraries and gain root privileges. IBM X-Force ID: 149426.	2019-08-20	not yet calculated	CVE-2018-1796 CONFIRM XF
ibm -- informix_dynamic_server_enterprise_edition	IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in infos.DBSERVERNAME. IBM X-Force ID: 144437.	2019-08-20	not yet calculated	CVE-2018-1634 CONFIRM XF
ibm -- infosphere_business_automation_workflow	IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162770.	2019-08-20	not yet calculated	CVE-2019-4424 XF CONFIRM
ibm -- infosphere_global_name_management	IBM InfoSphere Global Name Management 5.0 and 6.0 and IBM InfoSphere Identity Insight 8.1 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162890.	2019-08-20	not yet calculated	CVE-2019-4433 XF CONFIRM CONFIRM
ibm -- mq	IBM MQ 9.1.0.0, 9.1.0.1, 9.1.1, and 9.1.0.2 is vulnerable to a denial of service due to a local user being able to fill up the disk space of the underlying filesystem using the error logging service. IBM X-Force ID: 156398.	2019-08-20	not yet calculated	CVE-2019-4049 XF CONFIRM
ibm -- multiple_products	IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-Force ID: 161034.	2019-08-20	not yet calculated	CVE-2019-4308 XF CONFIRM
ibm -- security_guardium_big_data_intelligence	IBM Security Guardium Big Data Intelligence 4.0 (SonarG) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 161419.	2019-08-20	not yet calculated	CVE-2019-4340 XF CONFIRM
ignite_realtime -- openfire	Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.	2019-08-23	not yet calculated	CVE-2019-15488 MISC MISC
imagemagick -- imagemagick	coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that is mishandled in ReadImage in MagickCore/constitute.c.	2019-08-18	not yet calculated	CVE-2019-15140 MISC MISC
imagemagick -- imagemagick	The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than CVE-2019-11472.	2019-08-18	not yet calculated	CVE-2019-15139 MISC MISC
intel -- authenticate	Improper permissions in the software installer for Intel(R) Authenticate before 3.8 may allow an authenticated user to potentially enable escalation of privilege via local access.	2019-08-19	not yet calculated	CVE-2019-11143 CONFIRM
intel -- computing_improvement_program	Insufficient access control in hardware abstraction in SEMA driver for Intel(R) Computing Improvement Program before version 2.4.0.04733 may allow an authenticated user to potentially enable escalation of privilege, denial of service or information disclosure via local access.	2019-08-19	not yet calculated	CVE-2019-11162 CONFIRM
intel -- driver_and_support_assistant	Improper file verification in Intel? Driver & Support Assistant before 19.7.30.2 may allow an authenticated user to potentially enable escalation of privilege via local access.	2019-08-19	not yet calculated	CVE-2019-11145 CONFIRM
intel -- driver_and_support_assistant	Improper file verification in Intel? Driver & Support Assistant before 19.7.30.2 may allow an authenticated user to potentially enable escalation of privilege via local access.	2019-08-19	not yet calculated	CVE-2019-11146 CONFIRM
intel -- nuc	Insufficient session validation in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.	2019-08-19	not yet calculated	CVE-2019-11140 CONFIRM
intel -- processor_identification_utility_for_windows	Insufficient access control in a hardware abstraction driver for Intel(R) Processor Identification Utility for Windows before version 6.1.0731 may allow an authenticated user to potentially enable escalation of privilege, denial of service or information disclosure via local access.	2019-08-19	not yet calculated	CVE-2019-11163 CONFIRM
intel -- raid_web_console_2	Authentication bypass in the web console for Intel(R) Raid Web Console 2 all versions may allow an unauthenticated attacker to potentially enable disclosure of information via network access.	2019-08-19	not yet calculated	CVE-2019-0173 CONFIRM
intel -- remote_displays_sdk	Improper permissions in the installer for Intel(R) Remote Displays SDK before version 2.0.1 R2 may allow an authenticated user to potentially enable escalation of privilege via local access.	2019-08-19	not yet calculated	CVE-2019-11148 CONFIRM
it-novum -- openitcockpit	openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.	2019-08-23	not yet calculated	CVE-2019-15491 MISC
it-novum -- openitcockpit	openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.	2019-08-23	not yet calculated	CVE-2019-15490 MISC
it-novum -- openitcockpit	openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.	2019-08-23	not yet calculated	CVE-2019-15493 MISC
it-novum -- openitcockpit	openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.	2019-08-23	not yet calculated	CVE-2019-15494 MISC
it-novum -- openitcockpit	openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.	2019-08-23	not yet calculated	CVE-2019-15492 MISC
jc21 -- ngnix_proxy_manager	jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal.	2019-08-23	not yet calculated	CVE-2019-15517 MISC MISC
johnson_controls -- metasys	Metasys? ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP).	2019-08-20	not yet calculated	CVE-2019-7594 CONFIRM MISC
johnson_controls -- metasys	Metasys? ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP).	2019-08-20	not yet calculated	CVE-2019-7593 CONFIRM MISC
jooby_project -- jooby	Jooby before 1.6.4 has XSS via the default error handler.	2019-08-23	not yet calculated	CVE-2019-15477 MISC
kbpublisher -- kbpublisher	KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entry_id[0] parameter, the admin/index.php?module=log id parameter, or an index.php?View=print&id[]= request.	2019-08-21	not yet calculated	CVE-2019-10687 MISC MISC
kimai -- kimai	Kimai v2 before 1.1 has XSS via a timesheet description.	2019-08-23	not yet calculated	CVE-2019-15481 MISC MISC
lenovo -- multiple_products	An information leakage vulnerability in Iomega and LenovoEMC NAS products could allow disclosure of some device details such as Share names through the device API when Personal Cloud is enabled. This does not allow read, write, delete, or any other access to the underlying file systems and their contents.	2019-08-19	not yet calculated	CVE-2019-6178 MISC
lenovo -- multiple_products	A stored cross-site scripting (XSS) vulnerability exists in various firmware versions of the legacy IBM System x IMM (IMM v1) embedded Baseboard Management Controller (BMC). This vulnerability could allow an unauthenticated user to cause JavaScript code to be stored in the IMM log which may then be executed in the user's web browser when IMM log records containing the JavaScript code are viewed. The JavaScript code is not executed on IMM itself. The later IMM2 (IMM v2) is not affected.	2019-08-19	not yet calculated	CVE-2019-6159 CONFIRM
lenovo -- solution_center	A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to non-standard locations, potentially leading to privilege escalation. Lenovo ended support for Lenovo Solution Center and recommended that customers migrate to Lenovo Vantage or Lenovo Diagnostics in April 2018.	2019-08-21	not yet calculated	CVE-2019-6177 CONFIRM
lenovo -- yoga_700-11isk_and_700-14isk	A DLL search path vulnerability was reported in PaperDisplay Hotkey Service version 1.2.0.8 that could allow privilege escalation. Lenovo has ended support for PaperDisplay Hotkey software as the Night light feature introduced in Windows 10 Build 1703 provides similar features.	2019-08-19	not yet calculated	CVE-2019-6165 CONFIRM
lenovo --thinkpad	A vulnerability was reported in various BIOS versions of older ThinkPad systems that could allow a user with administrative privileges or physical access the ability to update the Embedded Controller with unsigned firmware.	2019-08-19	not yet calculated	CVE-2019-6171 CONFIRM
linux -- linux_kernel	drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traffic (which may be remote via usbip or usbredir).	2019-08-23	not yet calculated	CVE-2019-15504 MISC
linux -- linux_kernel	An issue was discovered in the Linux kernel before 5.0.9. There is a use-after-free in atalk_proc_exit, related to net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and net/appletalk/sysctl_net_atalk.c.	2019-08-21	not yet calculated	CVE-2019-15292 MISC MISC
linux -- linux_kernel	In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation. NOTE: this affects (for example) Linux distributions that use 4.9.x longterm kernels before 4.9.190 or 4.14.x longterm kernels before 4.14.139.	2019-08-20	not yet calculated	CVE-2019-15239 MISC MISC MISC MISC MISC
linux -- linux_kernel	drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB device traffic (which may be remote via usbip or usbredir).	2019-08-23	not yet calculated	CVE-2019-15505 MISC MISC MISC
live_networks -- live555	Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors.	2019-08-19	not yet calculated	CVE-2019-15232 MISC
mantisbt -- mantisbt	The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the issue, whenever My View Page is displayed.	2019-08-21	not yet calculated	CVE-2019-15074 CONFIRM MISC
mcafee -- data_loss_prevention	Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via an encrypted message sent to DLPe which when decrypted results in DLPe reading unallocated memory.	2019-08-21	not yet calculated	CVE-2019-3634 CONFIRM
mcafee -- data_loss_prevention	Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via a carefully constructed message sent to DLPe which bypasses DLPe internal checks and results in DLPe reading unallocated memory.	2019-08-21	not yet calculated	CVE-2019-3633 CONFIRM
micro_focus -- verastream_host_integrator	Path traversal vulnerability in Micro Focus Verastream Host Integrator (VHI), versions 7.7 SP2 and earlier, The vulnerability allows remote unauthenticated attackers to read arbitrary files.	2019-08-23	not yet calculated	CVE-2019-11654 CONFIRM
mirasys -- vms	Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, leading to Directory Traversal. An attacker could use ..\ with this method to iterate over lists of interesting system files and download them without previous authentication. This includes SAM-database backups, Web.config files, etc. and might cause a serious impact on confidentiality.	2019-08-22	not yet calculated	CVE-2019-11029 MISC
mirasys -- vms	Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailService in SMServer.exe. This method triggers insecure deserialization within the .NET garbage collector, in which a gadget (contained in a serialized object) may be executed with SYSTEM privileges. The attacker must properly encrypt the object; however, the hardcoded keys are available.	2019-08-22	not yet calculated	CVE-2019-11030 MISC
mirasys -- vms	Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the auto-update feature of IDVRUpdateService2 in DVRServer.exe. An attacker can upload files with a Setup-Files action, and then execute these files with SYSTEM privileges.	2019-08-22	not yet calculated	CVE-2019-11031 MISC
mixin-deep -- mixin-deep	mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.	2019-08-23	not yet calculated	CVE-2019-10746 MISC
moodle -- moodle	The Acclaim block plugin before 2019-06-26 for Moodle allows SQL Injection via delete_records.	2019-08-23	not yet calculated	CVE-2019-15536 MISC
motorola -- cx2l_mwr04l_and_c1_mwr03_devices	An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) as used on Motorola CX2L MWR04L 1.01 and C1 MWR03 1.01 devices. /tmp/.uci/network locking is mishandled after reception of a long SetWanSettings command, leading to a device hang.	2019-08-23	not yet calculated	CVE-2019-15513 MISC
newgen -- omniflow_intelligent_business_process_suite	Newgen OmniFlow Intelligent Business Process Suite (iBPS) 7.0 has an "improper server side validation" vulnerability where client-side validations are tampered, and inappropriate information is stored on the server side and fetched from the server every time the user visits the D, creating business confusion. In the worst case, all available resources are consumed while processing the data, resulting in unavailability of the service to legitimate users. This occurs because non-editable parameters can be modified by manually editing a disabled form field within the developer options.	2019-08-21	not yet calculated	CVE-2018-17791 MISC
nltk_project -- nltk_downloader	NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.	2019-08-22	not yet calculated	CVE-2019-14751 MISC CONFIRM CONFIRM MISC
object_management_group -- dds_security	The handshake protocol in Object Management Group (OMG) DDS Security 1.1 sends cleartext information about all of the capabilities of a participant (including capabilities inapplicable to the current session), which makes it easier for attackers to discover potentially sensitive reachability information on a Data Distribution Service (DDS) network.	2019-08-18	not yet calculated	CVE-2019-15135 MISC MISC
objective_development_software -- little_snitch	Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool. However, the operating system may have made a copy of the privileged helper which is not removed or updated immediately. Computers may therefore still be vulnerable after upgrading to 4.4.0. Version 4.4.1 fixes this issue by removing the operating system's copy during the upgrade.	2019-08-23	not yet calculated	CVE-2019-13014 MISC
objective_development_software -- little_snitch	Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. The privileged helper tool implements an XPC interface which is available to any process and allows directory listings and copying files as root.	2019-08-23	not yet calculated	CVE-2019-13013 MISC
octopus_deploy -- octopus_server	In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-characters circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 2019.7.7. The fix was back-ported to LTS 2019.6.7 as well as LTS 2019.3.8.	2019-08-23	not yet calculated	CVE-2019-15507 MISC
octopus_deploy -- octopus_tentacle_and_octopus_server	In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 5.0.1. The fix was back-ported to 4.0.7.	2019-08-23	not yet calculated	CVE-2019-15508 MISC
openemr -- openemr	In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system.	2019-08-20	not yet calculated	CVE-2019-3967 MISC
openemr -- openemr	In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form.	2019-08-20	not yet calculated	CVE-2019-3968 MISC
openemr -- openemr	In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.	2019-08-20	not yet calculated	CVE-2019-3966 MISC
openpgp.js -- openpgp.js	Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed.	2019-08-22	not yet calculated	CVE-2019-9154 MISC CONFIRM CONFIRM CONFIRM MISC MISC
openpgp.js -- openpgp.js	A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.	2019-08-22	not yet calculated	CVE-2019-9155 MISC CONFIRM CONFIRM CONFIRM MISC MISC
openpgp.js -- openpgp.js	Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature.	2019-08-22	not yet calculated	CVE-2019-9153 MISC CONFIRM CONFIRM CONFIRM MISC MISC
oscommerce -- oscommerce	osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated administrators can upload new '.htaccess' files (e.g., omitting .php) and subsequently achieve arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.	2019-08-22	not yet calculated	CVE-2018-18573 CONFIRM
oscommerce -- oscommerce	osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter, script files with certain PHP-related extensions (such as .phtml and .php5) didn't execute in the application. But this filter didn't prevent the '.pht' extension. Thus, remote authenticated administrators can upload '.pht' files for arbitrary PHP code execution via a /catalog/admin/categories.php?cPath=&action=new_product URI.	2019-08-22	not yet calculated	CVE-2018-18572 CONFIRM
otrs -- otrs_and_otrs_community_edition	An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS notification tags in templates in order to disclose hashed user passwords.	2019-08-21	not yet calculated	CVE-2019-13458 CONFIRM CONFIRM MISC
otrs -- otrs_community_edition	An issue was discovered in Open Ticket Request System (OTRS) Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be then be potentially abused in order to impersonate the agent user.	2019-08-21	not yet calculated	CVE-2019-12746 CONFIRM CONFIRM MISC
ox_software -- ox_app_suite	OX App Suite 7.10.1 and earlier has Insecure Permissions.	2019-08-20	not yet calculated	CVE-2019-11806 MISC
ox_software -- ox_app_suite	OX App Suite 7.10.1 allows Content Spoofing.	2019-08-20	not yet calculated	CVE-2019-11521 MISC
palo_alto_networks -- pan-os	Memory corruption in PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow an administrative user to cause arbitrary memory corruption by rekeying the current client interactive session.	2019-08-23	not yet calculated	CVE-2019-1582 CONFIRM
palo_alto_networks -- pan-os	Memory corruption in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow a remote, unauthenticated user to craft a message to Secure Shell Daemon (SSHD) and corrupt arbitrary memory.	2019-08-23	not yet calculated	CVE-2019-1580 CONFIRM
palo_alto_networks -- pan-os	Mitigation bypass in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow a remote, unauthenticated user to execute arbitrary code by crafting a malicious message.	2019-08-23	not yet calculated	CVE-2019-1581 CONFIRM
palo_alto_networks -- twistlock_console	Escalation of privilege vulnerability in the Palo Alto Networks Twistlock console 19.07.358 and earlier allows a Twistlock user with Operator capabilities to escalate privileges to that of another user. Active interaction with an affected component is required for the payload to execute on the victim.	2019-08-23	not yet calculated	CVE-2019-1583 CONFIRM
pivotal -- pivotal_application_service	Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.16, 2.4.x prior to 2.4.12, 2.5.x prior to 2.5.8, and 2.6.x prior to 2.6.3, makes a request to the /cloudapplication endpoint via Spring actuator, and subsequent requests via unsecured http. An adjacent unauthenticated user could eavesdrop on the network traffic and gain access to the unencrypted token allowing the attacker to read the type of access a user has over an app. They may also modify the logging level, potentially leading to lost information that would otherwise have been logged.	2019-08-19	not yet calculated	CVE-2019-11276 CONFIRM
pw3270_terminal_emulator -- pw3270_terminal_emulator	There is Missing SSL Certificate Validation in the pw3270 terminal emulator before version 5.1.	2019-08-23	not yet calculated	CVE-2019-15525 MISC
rapid7 -- insightappsec	The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the system (who must already be authenticated to the operating system) can elevate their privileges with this vulnerability to the privilege level of InsightAppSec (usually, SYSTEM). This issue affects version 2019.06.24 and prior versions of the product.	2019-08-19	not yet calculated	CVE-2019-5631 CONFIRM
rapid7 -- nexpose	Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage.	2019-08-21	not yet calculated	CVE-2019-5638 CONFIRM
redcap -- redcap	REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to Calendar/calendar_popup_ajax.php. The attacker can obtain a user's login sessionid from the database, and then re-login into REDCap to compromise all data.	2019-08-17	not yet calculated	CVE-2019-14937 MISC MISC CONFIRM
rest-client_gem_for_ruby_on_rails -- rest-client_gem_for_ruby_on_rails	The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected.	2019-08-19	not yet calculated	CVE-2019-15224 MISC MISC
riot_os -- riot	RIOT through 2019.07 contains a memory leak in the TCP implementation (gnrc_tcp), allowing an attacker to consume all memory available for network packets and thus effectively stopping all network threads from working. This is related to _receive in sys/net/gnrc/transport_layer/tcp/gnrc_tcp_eventloop.c upon receiving an ACK before a SYN.	2019-08-17	not yet calculated	CVE-2019-15134 MISC
roundcube -- roundcube_webmail	Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.	2019-08-19	not yet calculated	CVE-2019-15237 MISC
sailpoint -- sailpoint_desktop_password_reset	An unauthenticated privilege escalation exists in SailPoint Desktop Password Reset 7.2. A user with local access to only the Windows logon screen can escalate their privileges to NT AUTHORITY\System. An attacker would need local access to the machine for a successful exploit. The attacker must disconnect the computer from the local network / WAN and connect it to an internet facing access point / network. At that point, the attacker can execute the password-reset functionality, which will expose a web browser. Browsing to a site that calls local Windows system functions (e.g., file upload) will expose the local file system. From there an attacker can launch a privileged command shell.	2019-08-20	not yet calculated	CVE-2019-12889 MISC
sec-1 -- watchguard_fireware	The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).	2019-08-23	not yet calculated	CVE-2016-6154 MISC
selectize.js -- selectize.js	selectize-plugin-a11y before 1.1.0 has XSS via the msg field.	2019-08-23	not yet calculated	CVE-2019-15482 MISC MISC
set-value -- set-value	set-value is vulnerable to Prototype Pollution in versions before 2.0.1 and version 3.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.	2019-08-23	not yet calculated	CVE-2019-10747 MISC
softvelum -- nimble_streamer	Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the file system to access files or directories that are outside of the restricted directory on the remote server.	2019-08-22	not yet calculated	CVE-2019-11013 MISC MISC
sonatype -- nexus_repository_manager	In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS.	2019-08-22	not yet calculated	CVE-2019-14469 MISC
sphinx_technologies -- sphinx	Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).	2019-08-22	not yet calculated	CVE-2019-14511 MISC MISC MISC
swoole -- swoole-src	Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler.	2019-08-23	not yet calculated	CVE-2019-15518 MISC MISC
telegram -- telegram	The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackers can find these numbers via the Group Info feature, e.g., by adding a significant fraction of a region's assigned phone numbers.	2019-08-23	not yet calculated	CVE-2019-15514 MISC
texas_instruments -- tm4c_microcontrollers	An issue was discovered in the Texas Instruments (TI) TM4C microcontroller series, such as the TM4C123. The eXecute-Only-Memory (XOM) implementation prevents code read-outs on protected memory by generating bus faults. However, single-stepping and using breakpoints is allowed in XOM-protected flash memory. As a consequence, it is possible to execute single instructions with arbitrary system states (e.g., registers, status flags, and SRAM content) and observe the state changes produced by the unknown instruction. An attacker could exploit this vulnerability by executing protected and unknown instructions with specific system states and observing the state changes. Based on the gathered information, it is possible to reverse-engineer the executed instructions. The processor acts as a kind of "instruction oracle."	2019-08-20	not yet calculated	CVE-2018-18056 MISC
tibco_software -- multiple_tibco_ftl_products	The realm configuration component of TIBCO Software Inc.'s TIBCO FTL Community Edition, TIBCO FTL Developer Edition, TIBCO FTL Enterprise Edition contains a vulnerability that theoretically fails to properly enforce access controls. This issue affects TIBCO FTL Community Edition 6.0.0; 6.0.1; 6.1.0, TIBCO FTL Developer Edition 6.0.1; 6.1.0, and TIBCO FTL Enterprise Edition 6.0.0; 6.0.1; 6.1.0.	2019-08-20	not yet calculated	CVE-2019-11209 CONFIRM CONFIRM
tiki -- tiki	tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download_file.php?display&fileId= URI.	2019-08-22	not yet calculated	CVE-2019-15314 MISC
tp-link -- tl-wr840n_device	The traceroute function on the TP-Link TL-WR840N v4 router with firmware through 0.9.1 3.16 is vulnerable to remote code execution via a crafted payload in an IP address input field.	2019-08-22	not yet calculated	CVE-2019-15060 MISC MISC
trend_micro -- password_manager	A DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited, would allow an attacker to load an arbitrary unsigned DLL into the signed service's process. This process is very similar, yet not identical to CVE-2019-14684.	2019-08-20	not yet calculated	CVE-2019-14687 CONFIRM MISC
trend_micro -- password_manager	A DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited, would allow an attacker to load an arbitrary unsigned DLL into the signed service's process. This process is very similar, yet not identical to CVE-2019-14687.	2019-08-20	not yet calculated	CVE-2019-14684 CONFIRM MISC
trend_micro -- security_2019	A DLL hijacking vulnerability exists in the Trend Micro Security's 2019 consumer family of products (v15) Folder Shield component and the standalone Trend Micro Ransom Buster (1.0) tool in which, if exploited, would allow an attacker to load a malicious DLL, leading to elevated privileges.	2019-08-21	not yet calculated	CVE-2019-14686 CONFIRM
trend_micro -- security_2019	A local privilege escalation vulnerability exists in Trend Micro Security 2019 (v15.0) in which, if exploited, would allow an attacker to manipulate a specific product feature to load a malicious service.	2019-08-21	not yet calculated	CVE-2019-14685 FULLDISC CONFIRM MISC
valve -- steam_client_for_windows	Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition.	2019-08-21	not yet calculated	CVE-2019-15316 MISC MISC MISC MISC
valve -- steam_client_for_windows	Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local users can replace the current versions of SteamService.exe and SteamService.dll with older versions that lack the CVE-2019-14743 patch.	2019-08-21	not yet calculated	CVE-2019-15315 MISC
vera_control -- vera_edge_home_controller	cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh.	2019-08-23	not yet calculated	CVE-2019-15498 MISC
wordpress -- wordpress	The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.	2019-08-20	not yet calculated	CVE-2016-10892 MISC
wordpress -- wordpress	The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type.	2019-08-22	not yet calculated	CVE-2018-20979 MISC
wordpress -- wordpress	The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files.	2019-08-22	not yet calculated	CVE-2015-9340 MISC
wordpress -- wordpress	The reflex-gallery plugin before 1.4.3 for WordPress has XSS.	2019-08-22	not yet calculated	CVE-2013-7482 MISC
wordpress -- wordpress	The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.	2019-08-22	not yet calculated	CVE-2015-9338 MISC
wordpress -- wordpress	The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.	2019-08-22	not yet calculated	CVE-2016-10923 MISC
wordpress -- wordpress	The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.	2019-08-16	not yet calculated	CVE-2017-18547 MISC
wordpress -- wordpress	The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.	2019-08-22	not yet calculated	CVE-2019-15330 MISC
wordpress -- wordpress	The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.	2019-08-22	not yet calculated	CVE-2018-20980 MISC
wordpress -- wordpress	The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.	2019-08-16	not yet calculated	CVE-2019-15115 MISC
wordpress -- wordpress	The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.	2019-08-22	not yet calculated	CVE-2018-20983 MISC
wordpress -- wordpress	The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.	2019-08-16	not yet calculated	CVE-2015-9324 MISC MISC
wordpress -- wordpress	The email-newsletter plugin through 20.15 for WordPress has SQL injection.	2019-08-22	not yet calculated	CVE-2015-9334 MISC MISC MISC
wordpress -- wordpress	The cforms2 plugin before 14.6.10 for WordPress has SQL injection.	2019-08-22	not yet calculated	CVE-2015-9333 MISC
wordpress -- wordpress	The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS.	2019-08-21	not yet calculated	CVE-2015-9327 MISC
wordpress -- wordpress	The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection.	2019-08-22	not yet calculated	CVE-2019-15331 MISC
wordpress -- wordpress	The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.	2019-08-16	not yet calculated	CVE-2015-9323 MISC
wordpress -- wordpress	The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.	2019-08-21	not yet calculated	CVE-2016-10897 MISC
wordpress -- wordpress	The clean-login plugin before 1.5.1 for WordPress has reflected XSS.	2019-08-22	not yet calculated	CVE-2015-9336 MISC
wordpress -- wordpress	The tubepress plugin before 1.6.5 for WordPress has XSS.	2019-08-22	not yet calculated	CVE-2008-7321 MISC
wordpress -- wordpress	The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection.	2019-08-22	not yet calculated	CVE-2014-10391 MISC
wordpress -- wordpress	The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling.	2019-08-22	not yet calculated	CVE-2015-9335 MISC
wordpress -- wordpress	The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.	2019-08-22	not yet calculated	CVE-2015-9339 MISC
wordpress -- wordpress	The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.	2019-08-22	not yet calculated	CVE-2015-9337 MISC
wordpress -- wordpress	The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.	2019-08-22	not yet calculated	CVE-2016-10927 MISC
wordpress -- wordpress	The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.	2019-08-20	not yet calculated	CVE-2016-10893 MISC
wordpress -- wordpress	The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.	2019-08-22	not yet calculated	CVE-2016-10916 MISC
wordpress -- wordpress	The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.	2019-08-21	not yet calculated	CVE-2015-9321 MISC
wordpress -- wordpress	The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.	2019-08-22	not yet calculated	CVE-2016-10917 MISC
wordpress -- wordpress	The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.	2019-08-22	not yet calculated	CVE-2016-10918 MISC
wordpress -- wordpress	The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633.	2019-08-22	not yet calculated	CVE-2016-10919 MISC
wordpress -- wordpress	The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.	2019-08-22	not yet calculated	CVE-2016-10920 MISC
wordpress -- wordpress	The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.	2019-08-22	not yet calculated	CVE-2016-10921 MISC
wordpress -- wordpress	The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.	2019-08-22	not yet calculated	CVE-2016-10922 MISC
wordpress -- wordpress	The ebook-download plugin before 1.2 for WordPress has directory traversal.	2019-08-22	not yet calculated	CVE-2016-10924 MISC
wordpress -- wordpress	The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.	2019-08-22	not yet calculated	CVE-2016-10926 MISC
wordpress -- wordpress	The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal.	2019-08-22	not yet calculated	CVE-2014-10390 MISC
wordpress -- wordpress	The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.	2019-08-22	not yet calculated	CVE-2016-10928 MISC MISC
wordpress -- wordpress	The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header.	2019-08-21	not yet calculated	CVE-2012-6715 MISC
wordpress -- wordpress	The cforms2 plugin before 10.2 for WordPress has XSS.	2019-08-22	not yet calculated	CVE-2014-10392 MISC MISC
wordpress -- wordpress	The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.	2019-08-22	not yet calculated	CVE-2013-7480 MISC
wordpress -- wordpress	The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.	2019-08-22	not yet calculated	CVE-2013-7479 MISC
wordpress -- wordpress	The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.	2019-08-22	not yet calculated	CVE-2013-7478 MISC
wordpress -- wordpress	The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.	2019-08-22	not yet calculated	CVE-2013-7477 MISC
wordpress -- wordpress	The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.	2019-08-22	not yet calculated	CVE-2012-6716 MISC
wordpress -- wordpress	The user-access-manager plugin before 1.2 for WordPress has CSRF.	2019-08-20	not yet calculated	CVE-2011-5328 MISC
wordpress -- wordpress	The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.	2019-08-22	not yet calculated	CVE-2013-7481 MISC
wordpress -- wordpress	The user-domain-whitelist plugin before 1.5 for WordPress has CSRF.	2019-08-20	not yet calculated	CVE-2014-10381 MISC
wordpress -- wordpress	The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.	2019-08-22	not yet calculated	CVE-2016-10930 MISC
wordpress -- wordpress	The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.	2019-08-20	not yet calculated	CVE-2015-9319 MISC
wordpress -- wordpress	The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion.	2019-08-22	not yet calculated	CVE-2013-7483 MISC
wordpress -- wordpress	The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.	2019-08-16	not yet calculated	CVE-2014-10376 MISC
wordpress -- wordpress	The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.	2019-08-21	not yet calculated	CVE-2014-10377 MISC
wordpress -- wordpress	The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.	2019-08-16	not yet calculated	CVE-2015-9322 MISC
wordpress -- wordpress	The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.	2019-08-22	not yet calculated	CVE-2014-10382 MISC
wordpress -- wordpress	The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header.	2019-08-22	not yet calculated	CVE-2014-10394 MISC
wordpress -- wordpress	The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.	2019-08-22	not yet calculated	CVE-2014-10383 MISC
wordpress -- wordpress	The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.	2019-08-22	not yet calculated	CVE-2014-10384 MISC
wordpress -- wordpress	The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.	2019-08-22	not yet calculated	CVE-2014-10385 MISC
wordpress -- wordpress	The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.	2019-08-22	not yet calculated	CVE-2014-10386 MISC
wordpress -- wordpress	The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection.	2019-08-22	not yet calculated	CVE-2014-10387 MISC
wordpress -- wordpress	The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure.	2019-08-22	not yet calculated	CVE-2014-10388 MISC
wordpress -- wordpress	The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication.	2019-08-22	not yet calculated	CVE-2014-10389 MISC
wordpress -- wordpress	The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.	2019-08-22	not yet calculated	CVE-2015-9341 MISC
wordpress -- wordpress	The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.	2019-08-22	not yet calculated	CVE-2019-15322 MISC
wordpress -- wordpress	The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.	2019-08-22	not yet calculated	CVE-2016-10925 MISC
wordpress -- wordpress	The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.	2019-08-22	not yet calculated	CVE-2009-5158 MISC
wordpress -- wordpress	The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.	2019-08-23	not yet calculated	CVE-2019-15092 MISC MISC
wordpress -- wordpress	The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion.	2019-08-16	not yet calculated	CVE-2018-20973 MISC
wordpress -- wordpress	The js-jobs plugin before 1.0.7 for WordPress has CSRF.	2019-08-16	not yet calculated	CVE-2018-20974 MISC
wordpress -- wordpress	The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page.	2019-08-21	not yet calculated	CVE-2018-20977 MISC
wordpress -- wordpress	The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.	2019-08-22	not yet calculated	CVE-2018-20981 MISC
wordpress -- wordpress	The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.	2019-08-22	not yet calculated	CVE-2018-20982 MISC
wordpress -- wordpress	The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.	2019-08-22	not yet calculated	CVE-2018-20984 MISC
wordpress -- wordpress	The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec.	2019-08-22	not yet calculated	CVE-2018-20985 MISC
wordpress -- wordpress	The ad-inserter plugin before 2.4.20 for WordPress has path traversal.	2019-08-22	not yet calculated	CVE-2019-15323 MISC
wordpress -- wordpress	The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation.	2019-08-22	not yet calculated	CVE-2018-20988 MISC
wordpress -- wordpress	The advanced-custom-fields plugin before 5.7.8 for WordPress has XSS by authors.	2019-08-22	not yet calculated	CVE-2018-20986 MISC
wordpress -- wordpress	The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.	2019-08-20	not yet calculated	CVE-2017-18522 MISC
wordpress -- wordpress	The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.	2019-08-16	not yet calculated	CVE-2018-20971 MISC
wordpress -- wordpress	The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.	2019-08-16	not yet calculated	CVE-2019-15113 MISC
wordpress -- wordpress	The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.	2019-08-16	not yet calculated	CVE-2019-15116 MISC MISC
wordpress -- wordpress	The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.	2019-08-20	not yet calculated	CVE-2019-15238 MISC MISC
wordpress -- wordpress	The give plugin before 2.4.7 for WordPress has XSS via a donor name.	2019-08-22	not yet calculated	CVE-2019-15317 MISC MISC MISC
wordpress -- wordpress	The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.	2019-08-22	not yet calculated	CVE-2019-15318 MISC MISC
wordpress -- wordpress	The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.	2019-08-22	not yet calculated	CVE-2019-15319 MISC MISC
wordpress -- wordpress	The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.	2019-08-22	not yet calculated	CVE-2019-15320 MISC MISC
wordpress -- wordpress	The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.	2019-08-22	not yet calculated	CVE-2019-15321 MISC MISC
wordpress -- wordpress	The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.	2019-08-21	not yet calculated	CVE-2019-15109 MISC MISC
wordpress -- wordpress	The cforms2 plugin before 10.5 for WordPress has XSS.	2019-08-22	not yet calculated	CVE-2014-10393 MISC
wordpress -- wordpress	The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.	2019-08-22	not yet calculated	CVE-2016-10929 MISC
wordpress -- wordpress	The ad-inserter plugin before 2.4.22 for WordPress has remote code execution.	2019-08-22	not yet calculated	CVE-2019-15324 MISC MISC
wordpress -- wordpress	The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.	2019-08-22	not yet calculated	CVE-2017-18586 MISC
wordpress -- wordpress	The companion-auto-update plugin before 3.2.1 for WordPress has CSRF.	2019-08-16	not yet calculated	CVE-2018-20972 MISC
wordpress -- wordpress	The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.	2019-08-22	not yet calculated	CVE-2017-18571 MISC
wordpress -- wordpress	The moreads-se plugin before 1.4.7 for WordPress has XSS.	2019-08-20	not yet calculated	CVE-2017-18526 MISC
wordpress -- wordpress	The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.	2019-08-20	not yet calculated	CVE-2017-18533 MISC
wordpress -- wordpress	The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.	2019-08-21	not yet calculated	CVE-2017-18534 MISC
wordpress -- wordpress	The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.	2019-08-16	not yet calculated	CVE-2017-18542 MISC
wordpress -- wordpress	The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.	2019-08-16	not yet calculated	CVE-2017-18543 MISC
wordpress -- wordpress	The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.	2019-08-16	not yet calculated	CVE-2017-18544 MISC
wordpress -- wordpress	The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.	2019-08-16	not yet calculated	CVE-2017-18545 MISC
wordpress -- wordpress	The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.	2019-08-16	not yet calculated	CVE-2017-18546 MISC
wordpress -- wordpress	The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.	2019-08-21	not yet calculated	CVE-2017-18559 MISC
wordpress -- wordpress	The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.	2019-08-20	not yet calculated	CVE-2017-18523 MISC
wordpress -- wordpress	The embed-comment-images plugin before 0.6 for WordPress has XSS.	2019-08-21	not yet calculated	CVE-2017-18561 MISC
wordpress -- wordpress	The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.	2019-08-22	not yet calculated	CVE-2017-18570 MISC
wordpress -- wordpress	The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.	2019-08-22	not yet calculated	CVE-2017-18580 MISC
wordpress -- wordpress	The gnucommerce plugin before 1.4.2 for WordPress has XSS.	2019-08-22	not yet calculated	CVE-2017-18572 MISC
wordpress -- wordpress	The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.	2019-08-22	not yet calculated	CVE-2017-18583 MISC
wordpress -- wordpress	The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.	2019-08-22	not yet calculated	CVE-2017-18582 MISC
wordpress -- wordpress	The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.	2019-08-22	not yet calculated	CVE-2017-18584 MISC
wordpress -- wordpress	The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.	2019-08-22	not yet calculated	CVE-2017-18581 MISC
wordpress -- wordpress	The corner-ad plugin before 1.0.8 for WordPress has XSS.	2019-08-22	not yet calculated	CVE-2017-18579 MISC
wordpress -- wordpress	The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.	2019-08-22	not yet calculated	CVE-2017-18576 MISC
wordpress -- wordpress	The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.	2019-08-22	not yet calculated	CVE-2017-18575 MISC
wordpress -- wordpress	The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.	2019-08-22	not yet calculated	CVE-2017-18574 MISC
wordpress -- wordpress	The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.	2019-08-22	not yet calculated	CVE-2017-18573 MISC
youphptube -- youphptube	plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection.	2019-08-20	not yet calculated	CVE-2019-14430 MISC EXPLOIT-DB
zabbix -- zabbix	Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php.	2019-08-17	not yet calculated	CVE-2019-15132 MISC
zebra -- industrial_printers	Zebra Industrial Printers All Versions, Zebra printers are shipped with unrestricted end-user access to front panel options. If the option to use a passcode to limit the functionality of the front panel is applied, specially crafted packets could be sent over the same network to a port on the printer and the printer will respond with an array of information that includes the front panel passcode for the printer. Once the passcode is retrieved, an attacker must have physical access to the front panel of the printer to enter the passcode to access the full functionality of the front panel.	2019-08-20	not yet calculated	CVE-2019-10960 MISC
zenoss -- zenoss	The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988.	2019-08-21	not yet calculated	CVE-2019-14258 MISC CONFIRM
zenoss -- zenoss	pyraw in Zenoss 2.5.3 allows local privilege escalation by modifying environment variables to redirect execution before privileges are dropped, aka ZEN-31765.	2019-08-21	not yet calculated	CVE-2019-14257 MISC CONFIRM

Please share your thoughts

We recently updated our anonymous product survey; we’d welcome your feedback.