# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
901 |
CVE-2019-15531 |
125 |
|
|
2019-08-23 |
2019-08-30 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
GNU Libextractor through 1.9 has a heap-based buffer over-read in the function EXTRACTOR_dvi_extract_method in plugins/dvi_extractor.c. |
902 |
CVE-2019-15530 |
77 |
|
|
2019-08-23 |
2019-08-27 |
9.0 |
None |
Remote |
Low |
Single system |
Complete |
Complete |
Complete |
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the LoginPassword field to Login. |
903 |
CVE-2019-15529 |
77 |
|
|
2019-08-23 |
2019-08-27 |
9.0 |
None |
Remote |
Low |
Single system |
Complete |
Complete |
Complete |
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Username field to Login. |
904 |
CVE-2019-15528 |
77 |
|
|
2019-08-23 |
2019-08-27 |
9.0 |
None |
Remote |
Low |
Single system |
Complete |
Complete |
Complete |
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Interface field to SetStaticRouteSettings. |
905 |
CVE-2019-15527 |
77 |
|
|
2019-08-23 |
2019-08-27 |
9.0 |
None |
Remote |
Low |
Single system |
Complete |
Complete |
Complete |
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the MaxIdTime field to SetWanSettings. |
906 |
CVE-2019-15526 |
77 |
|
|
2019-08-23 |
2019-08-27 |
9.0 |
None |
Remote |
Low |
Single system |
Complete |
Complete |
Complete |
An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Type field to SetWanSettings, a related issue to CVE-2019-13482. |
907 |
CVE-2019-15525 |
295 |
|
|
2019-08-23 |
2019-08-30 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
There is Missing SSL Certificate Validation in the pw3270 terminal emulator before version 5.1. |
908 |
CVE-2019-15524 |
434 |
|
Exec Code |
2019-08-26 |
2019-08-30 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
CSZ CMS 1.2.3 allows arbitrary file upload, as demonstrated by a .php file to admin/filemanager in the File Management Module, which leads to remote code execution by visiting a photo/upload/2019/ URI. |
909 |
CVE-2019-15521 |
502 |
|
|
2019-08-26 |
2019-08-28 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object. |
910 |
CVE-2019-15520 |
22 |
|
Dir. Trav. |
2019-08-23 |
2019-08-27 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
comelz Quark before 2019-03-26 allows directory traversal to locations outside of the project directory. |
911 |
CVE-2019-15519 |
22 |
|
Dir. Trav. |
2019-08-23 |
2019-08-30 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
Power-Response before 2019-02-02 allows directory traversal (up to the application's main directory) via a plugin. |
912 |
CVE-2019-15518 |
22 |
|
Dir. Trav. |
2019-08-23 |
2019-08-27 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler. |
913 |
CVE-2019-15517 |
22 |
|
Dir. Trav. |
2019-08-23 |
2019-08-27 |
4.9 |
None |
Local |
Low |
Not required |
Complete |
None |
None |
jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal. |
914 |
CVE-2019-15516 |
22 |
|
Dir. Trav. |
2019-08-23 |
2019-08-27 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply removes one ../ substring. |
915 |
CVE-2019-15515 |
352 |
|
CSRF |
2019-08-26 |
2019-08-29 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
Discourse 2.3.2 sends the CSRF token in the query string. |
916 |
CVE-2019-15514 |
200 |
|
+Info |
2019-08-23 |
2019-08-30 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackers can find these numbers via the Group Info feature, e.g., by adding a significant fraction of a region's assigned phone numbers. |
917 |
CVE-2019-15513 |
20 |
|
|
2019-08-23 |
2019-08-30 |
7.8 |
None |
Remote |
Low |
Not required |
None |
None |
Complete |
An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) as used on Motorola CX2L MWR04L 1.01 and C1 MWR03 1.01 devices. /tmp/.uci/network locking is mishandled after reception of a long SetWanSettings command, leading to a device hang. |
918 |
CVE-2019-15506 |
200 |
|
+Info |
2019-08-26 |
2019-08-26 |
7.8 |
None |
Remote |
Low |
Not required |
Complete |
None |
None |
An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the /DATAREPORTS directory can be farmed for reports. Because this directory contains the results of reports such as NMAP, Patch Status, and Active Directory domain metadata, an attacker can easily collect this critical information and parse it for information. There are a number of directories affected. |
919 |
CVE-2019-15505 |
125 |
|
|
2019-08-23 |
2019-09-04 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB device traffic (which may be remote via usbip or usbredir). |
920 |
CVE-2019-15504 |
415 |
|
|
2019-08-23 |
2019-09-04 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traffic (which may be remote via usbip or usbredir). |
921 |
CVE-2019-15503 |
78 |
|
Exec Code |
2019-08-26 |
2019-08-30 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
cgi-cpn/xcoding/prontus_videocut.cgi in AltaVoz Prontus (aka ProntusCMS) through 12.0.3.0 has "Improper Neutralization of Special Elements used in an OS Command," allowing attackers to execute OS commands via an HTTP GET parameter. |
922 |
CVE-2019-15502 |
20 |
|
|
2019-08-29 |
2019-09-03 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
The TeamSpeak client before 3.3.2 allows remote servers to trigger a crash via the 0xe2 0x81 0xa8 0xe2 0x81 0xa7 byte sequence, aka Unicode characters U+2068 (FIRST STRONG ISOLATE) and U+2067 (RIGHT-TO-LEFT ISOLATE). |
923 |
CVE-2019-15501 |
79 |
|
XSS |
2019-08-26 |
2019-08-28 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Reflected cross site scripting (XSS) in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter. |
924 |
CVE-2019-15499 |
79 |
|
XSS |
2019-08-23 |
2019-10-09 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL. |
925 |
CVE-2019-15498 |
78 |
|
Exec Code |
2019-08-23 |
2019-08-27 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh. |
926 |
CVE-2019-15497 |
798 |
|
|
2019-08-26 |
2019-09-04 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP. |
927 |
CVE-2019-15496 |
352 |
|
CSRF |
2019-08-28 |
2019-08-30 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker tricking the administrator into executing arbitrary code via a specially crafted HTML page. |
928 |
CVE-2019-15494 |
918 |
|
|
2019-08-23 |
2019-08-26 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21. |
929 |
CVE-2019-15493 |
284 |
|
|
2019-08-23 |
2019-08-26 |
6.4 |
None |
Remote |
Low |
Not required |
None |
Partial |
Partial |
openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21. |
930 |
CVE-2019-15492 |
79 |
|
XSS |
2019-08-23 |
2019-08-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21. |
931 |
CVE-2019-15491 |
352 |
|
CSRF |
2019-08-23 |
2019-08-26 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21. |
932 |
CVE-2019-15490 |
94 |
|
|
2019-08-23 |
2019-08-26 |
7.5 |
None |
Remote |
Low |
Not required |
Partial |
Partial |
Partial |
openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21. |
933 |
CVE-2019-15489 |
79 |
|
XSS |
2019-08-26 |
2019-08-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
laracom (aka Laravel FREE E-Commerce Software) 1.4.11 has search?q= XSS. |
934 |
CVE-2019-15488 |
79 |
|
XSS |
2019-08-23 |
2019-08-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test. |
935 |
CVE-2019-15487 |
79 |
|
XSS |
2019-08-23 |
2019-08-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
DfE School Experience before v16333-GA has XSS via a teacher training URL. |
936 |
CVE-2019-15486 |
79 |
|
XSS |
2019-08-23 |
2019-08-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline. |
937 |
CVE-2019-15485 |
79 |
|
XSS |
2019-08-23 |
2019-08-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php. |
938 |
CVE-2019-15484 |
79 |
|
XSS |
2019-08-23 |
2019-08-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Bolt before 3.6.10 has XSS via an image's alt or title field. |
939 |
CVE-2019-15483 |
79 |
|
XSS |
2019-08-23 |
2019-08-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Bolt before 3.6.10 has XSS via a title that is mishandled in the system log. |
940 |
CVE-2019-15482 |
79 |
|
XSS |
2019-08-23 |
2019-08-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
selectize-plugin-a11y before 1.1.0 has XSS via the msg field. |
941 |
CVE-2019-15481 |
79 |
|
XSS |
2019-08-23 |
2019-08-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Kimai v2 before 1.1 has XSS via a timesheet description. |
942 |
CVE-2019-15479 |
79 |
|
XSS |
2019-08-26 |
2019-08-28 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Status Board 1.1.81 has reflected XSS via dashboard.ts. |
943 |
CVE-2019-15478 |
79 |
|
XSS |
2019-08-26 |
2019-08-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Status Board 1.1.81 has reflected XSS via logic.ts. |
944 |
CVE-2019-15477 |
79 |
|
XSS |
2019-08-23 |
2019-08-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Jooby before 1.6.4 has XSS via the default error handler. |
945 |
CVE-2019-15476 |
79 |
|
XSS |
2019-08-23 |
2019-08-26 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Former before 4.2.1 has XSS via a checkbox value. |
946 |
CVE-2019-15331 |
74 |
|
|
2019-08-22 |
2019-08-29 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection. |
947 |
CVE-2019-15330 |
200 |
|
+Info |
2019-08-22 |
2019-08-29 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading. |
948 |
CVE-2019-15329 |
352 |
|
CSRF |
2019-08-22 |
2019-08-23 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF. |
949 |
CVE-2019-15328 |
79 |
|
XSS |
2019-08-22 |
2019-08-23 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS. |
950 |
CVE-2019-15327 |
79 |
|
XSS |
2019-08-22 |
2019-08-23 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data. |