Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: August 2019

86 records · 6 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2019-0193
    83Now

    In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in whi

    HighCVSS 7.2KEVWeaponizedEPSS 83%

    apache · solrAug 1, 2019

  • CVE-2019-14529
    47Plan

    OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php.

    CriticalCVSS 9.8Proof of conceptEPSS 28%

    open-emr · openemrAug 2, 2019

  • CVE-2019-14348
    45Plan

    The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_seaso

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    beardev · joomsportAug 5, 2019

  • CVE-2019-14696
    29Monitor

    Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter.

    MediumCVSS 6.1Proof of conceptEPSS 15%

    open-school · open-schoolAug 6, 2019

  • CVE-2019-1912
    41Plan

    Cisco Small Business 220 Series Smart Switches Authentication Bypass Vulnerability

    CriticalCVSS 9.1Proof of conceptEPSS 17%

    cisco · sf-220-24 firmwareAug 7, 2019

  • CVE-2019-1913
    47Plan

    Cisco Small Business 220 Series Smart Switches Remote Code Execution Vulnerabilities

    CriticalCVSS 9.8Proof of conceptEPSS 25%

    cisco · sf-220-24 firmwareAug 7, 2019

  • CVE-2019-1914
    35Monitor

    Cisco Small Business 220 Series Smart Switches Command Injection Vulnerability

    HighCVSS 7.2Proof of conceptEPSS 24%

    cisco · sf-220-24 firmwareAug 7, 2019

  • CVE-2019-14750
    27Monitor

    An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1.

    MediumCVSS 6.1Proof of conceptEPSS 10%

    enhancesoft · osticketAug 7, 2019

  • CVE-2019-13101
    59Plan

    An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices.

    CriticalCVSS 9.8Proof of conceptEPSS 67%

    dlink · dir-600m firmwareAug 8, 2019

  • CVE-2019-14234
    53Plan

    An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4.

    CriticalCVSS 9.8Proof of conceptEPSS 47%

    djangoproject · djangoAug 9, 2019

  • CVE-2019-14312
    32Monitor

    Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer.

    MediumCVSS 6.5Proof of conceptEPSS 20%

    aptana · jaxerAug 9, 2019

  • CVE-2019-12256
    47Plan

    Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component.

    CriticalCVSS 9.8No exploitEPSS 26%

    windriver · vxworksAug 9, 2019

  • CVE-2019-12257
    60This week

    Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component.

    HighCVSS 8.8No exploitEPSS 84%

    windriver · vxworksAug 9, 2019

  • CVE-2019-12259
    35Monitor

    Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component.

    HighCVSS 7.5No exploitEPSS 15%

    windriver · vxworksAug 9, 2019

  • CVE-2019-12265
    39Monitor

    Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component.

    MediumCVSS 5.3No exploitEPSS 59%

    windriver · vxworksAug 9, 2019

  • CVE-2019-11581
    94Now

    There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail a

    CriticalCVSS 9.8KEVWeaponizedEPSS 84%

    atlassian · jira serverAug 9, 2019

  • CVE-2019-12255
    62This week

    Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4).

    CriticalCVSS 9.8Proof of conceptEPSS 75%

    windriver · vxworksAug 9, 2019

  • CVE-2019-12258
    60This week

    Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component.

    HighCVSS 7.5WeaponizedEPSS 22%

    windriver · vxworksAug 9, 2019

  • CVE-2019-12260
    46Plan

    Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4).

    CriticalCVSS 9.8No exploitEPSS 23%

    windriver · vxworksAug 9, 2019

  • CVE-2019-13462
    39Monitor

    Lansweeper before 7.1.117.4 allows unauthenticated SQL injection.

    CriticalCVSS 9.1Proof of conceptEPSS 11%

    lansweeper · lansweeperAug 12, 2019

  • CVE-2019-14530
    55Plan

    An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter.

    HighCVSS 8.8Proof of conceptEPSS 65%

    open-emr · openemrAug 13, 2019

  • CVE-2019-9511
    48Plan

    Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

    HighCVSS 7.5Proof of conceptEPSS 59%

    apple · swiftnioAug 13, 2019

  • CVE-2019-9512
    55Plan

    Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

    HighCVSS 7.5No exploitEPSS 83%

    apple · swiftnioAug 13, 2019

  • CVE-2019-9513
    54Plan

    Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service

    HighCVSS 7.5No exploitEPSS 81%

    apple · swiftnioAug 13, 2019

  • CVE-2019-9514
    55Plan

    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

    HighCVSS 7.5No exploitEPSS 82%

    apple · swiftnioAug 13, 2019

  • CVE-2019-9515
    56Plan

    Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

    HighCVSS 7.5No exploitEPSS 87%

    apple · swiftnioAug 13, 2019

  • CVE-2019-9516
    43Plan

    Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service

    MediumCVSS 6.5No exploitEPSS 56%

    apple · swiftnioAug 13, 2019

  • CVE-2019-9517
    38Monitor

    Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

    HighCVSS 7.5No exploitEPSS 27%

    apple · swiftnioAug 13, 2019

  • CVE-2019-9518
    38Monitor

    Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service

    HighCVSS 7.5No exploitEPSS 25%

    apple · swiftnioAug 13, 2019

  • CVE-2019-0344
    71This week

    Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possi

    CriticalCVSS 9.8KEVWeaponizedEPSS 7%

    sap · commerce cloudAug 14, 2019

  • CVE-2019-14974
    33Monitor

    SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.

    MediumCVSS 6.1Proof of conceptEPSS 28%

    sugarcrm · sugarcrmAug 14, 2019

  • CVE-2019-1144
    39Monitor

    Microsoft Graphics Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 13%

    microsoft · windows 10Aug 14, 2019

  • CVE-2019-1145
    39Monitor

    Microsoft Graphics Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 13%

    microsoft · windows 10Aug 14, 2019

  • CVE-2019-1149
    39Monitor

    Microsoft Graphics Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 13%

    microsoft · officeAug 14, 2019

  • CVE-2019-1150
    43Plan

    Microsoft Graphics Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 26%

    microsoft · windows 10Aug 14, 2019

  • CVE-2019-1151
    40Plan

    Microsoft Graphics Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 15%

    microsoft · officeAug 14, 2019

  • CVE-2019-1152
    39Monitor

    Microsoft Graphics Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 13%

    microsoft · windows 10Aug 14, 2019

  • CVE-2019-1159
    34Monitor

    Windows Kernel Elevation of Privilege Vulnerability

    HighCVSS 7.8No exploitEPSS 11%

    microsoft · windows 10Aug 14, 2019

  • CVE-2019-1181
    62This week

    Remote Desktop Services Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 75%

    microsoft · windows 10Aug 14, 2019

  • CVE-2019-1182
    44Plan

    Remote Desktop Services Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 16%

    microsoft · windows 10Aug 14, 2019

  • CVE-2019-1184
    47Plan

    Windows Elevation of Privilege Vulnerability

    MediumCVSS 6.7Proof of conceptEPSS 70%

    microsoft · windows 10Aug 14, 2019

  • CVE-2019-1225
    33Monitor

    Remote Desktop Protocol Server Information Disclosure Vulnerability

    HighCVSS 7.5No exploitEPSS 10%

    microsoft · windows 10Aug 14, 2019

  • CVE-2019-12854
    34Monitor

    Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory.

    HighCVSS 7.5No exploitEPSS 11%

    squid-cache · squidAug 15, 2019

  • CVE-2019-14422
    40Plan

    An issue was discovered in in TortoiseSVN 1.12.1.

    HighCVSS 8.8Proof of conceptEPSS 16%

    tortoisesvn · tortoisesvnAug 15, 2019

  • CVE-2019-13510
    35Monitor

    Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416.

    HighCVSS 7.8No exploitEPSS 12%

    rockwellautomation · arenaAug 15, 2019

  • CVE-2019-10081
    34Monitor

    HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the

    HighCVSS 7.5No exploitEPSS 14%

    apache · http serverAug 15, 2019

  • CVE-2019-9851
    62This week

    LibreLogo global-event script execution

    CriticalCVSS 9.8WeaponizedEPSS 77%

    libreoffice · libreofficeAug 15, 2019

  • CVE-2019-15106
    47Plan

    An issue was discovered in Zoho ManageEngine OpManager in builds before 14310.

    CriticalCVSS 9.8Proof of conceptEPSS 25%

    zohocorp · manageengine opmanagerAug 15, 2019

  • CVE-2019-15107
    99Now

    An issue was discovered in Webmin <=1.920.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    webmin · webminAug 15, 2019

  • CVE-2019-7964
    42Plan

    Adobe Experience Manager versions 6.5, and 6.4 have an authentication bypass vulnerability.

    CriticalCVSS 9.8No exploitEPSS 10%

    adobe · experience managerAug 16, 2019

  • CVE-2015-9323
    53Plan

    The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.

    CriticalCVSS 9.8Proof of conceptEPSS 46%

    duckdev · 404 to 301Aug 16, 2019

  • CVE-2019-3963
    40Plan

    In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter.

    MediumCVSS 6.1No exploitEPSS 52%

    open-emr · openemrAug 20, 2019

  • CVE-2019-3964
    40Plan

    In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter.

    MediumCVSS 6.1No exploitEPSS 52%

    open-emr · openemrAug 20, 2019

  • CVE-2019-3967
    35Monitor

    In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to

    MediumCVSS 6.5No exploitEPSS 29%

    open-emr · openemrAug 20, 2019

  • CVE-2019-8016
    46Plan

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    CriticalCVSS 9.8Proof of conceptEPSS 22%

    adobe · acrobat dcAug 20, 2019

  • CVE-2019-8017
    43Plan

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    adobe · acrobat dcAug 20, 2019

  • CVE-2019-8024
    44Plan

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    adobe · acrobat dcAug 20, 2019

  • CVE-2019-8041
    44Plan

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    CriticalCVSS 9.8Proof of conceptEPSS 17%

    adobe · acrobat dcAug 20, 2019

  • CVE-2019-8042
    44Plan

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    adobe · acrobat dcAug 20, 2019

  • CVE-2019-8043
    34Monitor

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    HighCVSS 7.5Proof of conceptEPSS 13%

    adobe · acrobat dcAug 20, 2019

  • CVE-2019-8044
    43Plan

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    adobe · acrobat dcAug 20, 2019

  • CVE-2019-8045
    44Plan

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    adobe · acrobat dcAug 20, 2019

  • CVE-2019-8046
    44Plan

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    CriticalCVSS 9.8Proof of conceptEPSS 17%

    adobe · acrobat dcAug 20, 2019

  • CVE-2019-8048
    49Plan

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    CriticalCVSS 9.8Proof of conceptEPSS 34%

    adobe · acrobat dcAug 20, 2019

  • CVE-2019-8049
    45Plan

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    adobe · acrobat dcAug 20, 2019

  • CVE-2019-8050
    51Plan

    Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear

    CriticalCVSS 9.8Proof of conceptEPSS 40%

    adobe · acrobat dcAug 20, 2019

  • CVE-2019-10086
    38Monitor

    In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access

    HighCVSS 7.3No exploitEPSS 28%

    apache · commons beanutilsAug 20, 2019

  • CVE-2019-12624
    40Plan

    Cisco IOS XE NGWC Legacy Wireless Device Manager GUI Cross-Site Request Forgery Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 18%

    cisco · ios xeAug 21, 2019

  • CVE-2019-1935
    64This week

    Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability

    CriticalCVSS 9.8WeaponizedEPSS 83%

    cisco · integrated management controller supervisorAug 21, 2019

  • CVE-2019-1936
    40Plan

    Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Command Injection Vulnerability

    HighCVSS 7.2WeaponizedEPSS 39%

    cisco · integrated management controller supervisorAug 21, 2019

  • CVE-2019-1937
    62This week

    Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability

    CriticalCVSS 9.8WeaponizedEPSS 75%

    cisco · integrated management controller supervisorAug 21, 2019

  • CVE-2016-10924
    33Monitor

    The ebook-download plugin before 1.2 for WordPress has directory traversal.

    HighCVSS 7.5Proof of conceptEPSS 11%

    zedna ebook download project · zedna ebook downloadAug 22, 2019

  • CVE-2017-18580
    43Plan

    The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    getshortcodes · shortcodes ultimateAug 22, 2019

  • CVE-2019-11013
    34Monitor

    Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability.

    MediumCVSS 6.5Proof of conceptEPSS 26%

    softvelum · nimble streamerAug 22, 2019

  • CVE-2019-8446
    26Monitor

    The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect author

    MediumCVSS 5.3Proof of conceptEPSS 17%

    atlassian · jira serverAug 23, 2019

  • CVE-2019-15637
    36Monitor

    Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a

    HighCVSS 8.1Proof of conceptEPSS 14%

    tableau · tableau serverAug 26, 2019

  • CVE-2019-15642
    45Plan

    rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an e

    HighCVSS 8.8Proof of conceptEPSS 34%

    webmin · webminAug 26, 2019

  • CVE-2019-7989
    39Monitor

    Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a command injection vulnerability.

    HighCVSS 8.8No exploitEPSS 14%

    adobe · photoshop ccAug 26, 2019

  • CVE-2019-14314
    52Plan

    A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress.

    CriticalCVSS 9.8Proof of conceptEPSS 43%

    imagely · nextgen galleryAug 27, 2019

  • CVE-2019-15752
    76This week

    Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.ex

    HighCVSS 7.8KEVWeaponizedEPSS 48%

    docker · dockerAug 28, 2019

  • CVE-2019-11248
    55Plan

    Kubernetes kubelet exposes /debug/pprof info on healthz port

    HighCVSS 8.2Proof of conceptEPSS 75%

    kubernetes · kubernetesAug 28, 2019

  • CVE-2019-11500
    58Plan

    In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings.

    CriticalCVSS 9.8No exploitEPSS 62%

    dovecot · dovecotAug 29, 2019

  • CVE-2019-3394
    38Monitor

    There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting.

    HighCVSS 8.8Proof of conceptEPSS 11%

    atlassian · confluenceAug 29, 2019

  • CVE-2019-13608
    69This week

    Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.

    HighCVSS 7.5KEVWeaponizedEPSS 30%

    citrix · storefront serverAug 29, 2019

  • CVE-2019-12402
    35Monitor

    The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with speci

    HighCVSS 7.5No exploitEPSS 16%

    apache · commons compressAug 30, 2019

  • CVE-2019-15821
    33Monitor

    The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.

    HighCVSS 7.5No exploitEPSS 11%

    bold-themes · bold page builderAug 30, 2019