Low-severity CVEs (page 92)
Page 92 of 100 — low-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10433 | Low | 3.3 | 2019-10-01 | Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read p… |
CVE-2019-3729 | Low | 2.4 | 2019-09-30 | RSA BSAFE Micro Edition Suite versions prior to 4.4 (in 4.0.x, 4.1.x, 4.2.x and 4.3.x) are vulnerable to a Heap-based Buffer Overflow vulnerability when parsin… |
CVE-2019-4112 | Low | 3.3 | 2019-09-30 | IBM WebSphere eXtreme Scale 8.6 Admin Console allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 158105. |
CVE-2019-9440 | Low | 3.3 | 2019-09-27 | In AOSP Email, there is a possible information disclosure due to a confused deputy. This could lead to local disclosure of the Email app's protected files with… |
CVE-2019-9438 | Low | 3.3 | 2019-09-27 | In the Package Manager service, there is a possible information disclosure due to a confused deputy. This could lead to local disclosure of information about i… |
CVE-2019-9377 | Low | 3.3 | 2019-09-27 | In FingerprintService, there is a possible bypass for operating system protections that isolate user profiles from each other due to a missing permission check… |
CVE-2019-9364 | Low | 3.3 | 2019-09-27 | In AudioService, there is a possible trigger of background user audio due to a permissions bypass. This could lead to local information disclosure by playing t… |
CVE-2019-9351 | Low | 3.3 | 2019-09-27 | In SyncStatusObserver, there is a possible bypass for operating system protections that isolate user profiles from each other due to a missing permission check… |
CVE-2019-9292 | Low | 3.3 | 2019-09-27 | In the Activity Manager service, there is a possible information disclosure due to a confused deputy. This could lead to local disclosure of current foreground… |
CVE-2019-9280 | Low | 3.3 | 2019-09-27 | In keyguard, there is a possible escalation of privilege due to improper permission checks. This could lead to a local bypass of the keyguard under limited cir… |
CVE-2019-9277 | Low | 3.3 | 2019-09-27 | In the proc filesystem, there is a possible information disclosure due to log information disclosure. This could lead to local disclosure of app and browser ac… |
CVE-2018-9581 | Low | 3.3 | 2019-09-27 | In WiFi, the RSSI value and SSID information is broadcast as part of android.net.wifi.RSSI_CHANGE and android.net.wifi.STATE_CHANGE intents. This could lead to… |
CVE-2019-11743 | Low | 3.7 | 2019-09-27 | Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts… |
CVE-2019-12617 | Low | 2.7 | 2019-09-26 | In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution. |
CVE-2019-12068 | Low | 3.8 | 2019-09-24 | In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing scrip… |
CVE-2019-4271 | Low | 3.5 | 2019-09-17 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin console is vulnerable to a Client-side HTTP parameter pollution vulnerability. IBM X-Force ID: 16… |
CVE-2019-4171 | Low | 3.7 | 2019-09-17 | IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or session cookies. This could allow an atta… |
CVE-2019-13922 | Low | 2.7 | 2019-09-13 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). An attacker with administrative privileges can obtain the hash o… |
CVE-2019-10397 | Low | 3.1 | 2019-09-12 | Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentiall… |
CVE-2019-1563 | Low | 3.7 | 2019-09-10 | In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large numbe… |
CVE-2019-0353 | Low | 3.3 | 2019-09-10 | Under certain conditions SAP Business One client (B1_ON_HANA, SAP-M-BO), before versions 9.2 and 9.3, allows an attacker to access information which would othe… |
CVE-2019-7176 | Low | 3.7 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x b… |
CVE-2019-16183 | Low | 2.7 | 2019-09-09 | In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions. |
CVE-2019-16181 | Low | 2.7 | 2019-09-09 | In Limesurvey before 3.17.14, admin users can mark other users' notifications as read. |
CVE-2019-5461 | Low | 3.5 | 2019-09-09 | An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a… |
CVE-2019-9455 | Low | 2.3 | 2019-09-06 | In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This could lead to local information disclosure with Syste… |
CVE-2019-15919 | Low | 3.3 | 2019-09-04 | An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs/smb2pdu.c has a use-after-free. |
CVE-2019-10988 | Low | 3.4 | 2019-09-04 | In Philips HDI 4000 Ultrasound Systems, all versions running on old, unsupported operating systems such as Windows 2000, the HDI 4000 Ultrasound System is buil… |
CVE-2019-4132 | Low | 3.3 | 2019-08-29 | IBM Cloud Automation Manager 3.1.2 could allow a user to be impropertly redirected and obtain sensitive information rather than receive a 404 error message. IB… |
CVE-2019-11806 | Low | 3.3 | 2019-08-20 | OX App Suite 7.10.1 and earlier has Insecure Permissions. |
CVE-2019-13512 | Low | 3.3 | 2019-08-15 | Fuji Electric FRENIC Loader 3.5.0.0 and prior is vulnerable to an out-of-bounds read vulnerability, which may allow an attacker to read limited information fro… |
CVE-2019-13511 | Low | 3.3 | 2019-08-15 | Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200. A maliciously crafted Arena file opened by… |
CVE-2019-14359 | Low | 2.4 | 2019-08-12 | On BC Vault devices, a side channel for the row-based SSD1309 OLED display was found. The power consumption of each row-based display cycle depends on the numb… |
CVE-2019-14357 | Low | 2.4 | 2019-08-10 | On Mooltipass Mini devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the numbe… |
CVE-2019-14355 | Low | 2.4 | 2019-08-10 | On ShapeShift KeepKey devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the nu… |
CVE-2019-14354 | Low | 2.4 | 2019-08-10 | On Ledger Nano S and Nano X devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on… |
CVE-2019-5301 | Low | 3.3 | 2019-08-08 | Huawei smart phones Honor V20 with the versions before 9.0.1.161(C00E161R2P2) have an information leak vulnerability. An attacker may trick a user into install… |
CVE-2016-10796 | Low | 3.3 | 2019-08-06 | cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130). |
CVE-2019-14671 | Low | 3.3 | 2019-08-05 | Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as fo… |
CVE-2019-10994 | Low | 3.3 | 2019-08-05 | Processing a specially crafted project file in LAquis SCADA 4.3.1.71 may trigger an out-of-bounds read, which may allow an attacker to obtain sensitive informa… |
CVE-2016-10772 | Low | 3.3 | 2019-08-05 | cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168). |
CVE-2017-18466 | Low | 2.7 | 2019-08-05 | cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228). |
CVE-2017-18458 | Low | 3.3 | 2019-08-02 | cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219). |
CVE-2017-18455 | Low | 2.7 | 2019-08-02 | In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208). |
CVE-2017-18436 | Low | 3.5 | 2019-08-02 | cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239). |
CVE-2017-18429 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291). |
CVE-2017-18428 | Low | 2.5 | 2019-08-02 | In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290). |
CVE-2017-18427 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, weak log-file permissions can occur after account modification (SEC-289). |
CVE-2017-18426 | Low | 2.7 | 2019-08-02 | cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288). |
CVE-2017-18425 | Low | 2.5 | 2019-08-02 | In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280). |
CVE-2017-18424 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt (SEC-274). |
CVE-2017-18423 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273). |
CVE-2017-18422 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions (SEC-272). |
CVE-2017-18421 | Low | 3.3 | 2019-08-02 | cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271). |
CVE-2017-18412 | Low | 2.5 | 2019-08-02 | cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296). |
CVE-2017-18404 | Low | 3.1 | 2019-08-02 | cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341). |
CVE-2017-18401 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334). |
CVE-2017-18399 | Low | 3.7 | 2019-08-02 | cPanel before 68.0.15 allows attackers to read root's crontab file during a short time interval upon enabling or disabling sqloptimizer (SEC-332). |
CVE-2017-18398 | Low | 3.8 | 2019-08-02 | DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331). |
CVE-2017-18397 | Low | 3.3 | 2019-08-02 | cPanel before 68.0.15 does not preserve permissions for local backup transport (SEC-330). |
CVE-2017-18395 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 does not block a username of ssl (SEC-328). |
CVE-2017-18394 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 does not have a sufficient list of reserved usernames (SEC-327). |
CVE-2017-18393 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 does not block a username of postmaster, which might allow reception of private e-mail (SEC-326). |
CVE-2017-18392 | Low | 2.0 | 2019-08-02 | cPanel before 68.0.15 allows collisions because PostgreSQL databases can be assigned to multiple accounts (SEC-325). |
CVE-2017-18391 | Low | 2.5 | 2019-08-02 | cPanel before 68.0.15 allows attackers to read backup files because they are world-readable during a short time interval (SEC-323). |
CVE-2017-18384 | Low | 3.8 | 2019-08-02 | cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310). |
CVE-2017-18382 | Low | 2.7 | 2019-08-02 | cPanel before 68.0.15 allows use of an unreserved e-mail address in DNS zone SOA records (SEC-306). |
CVE-2018-20946 | Low | 3.3 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read zone information because a world-readable archive is created by the archive_sync_zones script (SEC-355). |
CVE-2018-20944 | Low | 3.3 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read a copy of httpd.conf that is created during a syntax test (SEC-353). |
CVE-2018-20943 | Low | 2.5 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon a post-update task (SEC-352). |
CVE-2018-20942 | Low | 2.5 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon configuring crontab (SEC-351). |
CVE-2018-20940 | Low | 3.3 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups (SEC-342). |
CVE-2018-20939 | Low | 3.3 | 2019-08-01 | cPanel before 68.0.27 allows a user to discover contents of directories (that are not owned by that user) by leveraging backups (SEC-339). |
CVE-2018-20938 | Low | 2.7 | 2019-08-01 | cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324). |
CVE-2018-20936 | Low | 3.3 | 2019-08-01 | cPanel before 68.0.27 allows attackers to read the SRS secret via exim.conf (SEC-308). |
CVE-2018-20932 | Low | 2.7 | 2019-08-01 | cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains (SEC-406). |
CVE-2018-20927 | Low | 3.8 | 2019-08-01 | cPanel before 70.0.23 allows jailshell escape because of incorrect crontab parsing (SEC-382). |
CVE-2018-20897 | Low | 2.8 | 2019-08-01 | cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395). |
CVE-2018-20896 | Low | 3.9 | 2019-08-01 | cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface (SEC-394). |
CVE-2018-20894 | Low | 3.3 | 2019-08-01 | cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories (SEC-443). |
CVE-2018-20893 | Low | 2.3 | 2019-08-01 | cPanel before 74.0.0 allows file-rename operations during account renames (SEC-442). |
CVE-2015-7559 | Low | 2.7 | 2019-08-01 | It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a comprom… |
CVE-2018-20880 | Low | 3.3 | 2019-08-01 | cPanel before 74.0.8 mishandles account suspension because of an invalid email_accounts.json file (SEC-445). |
CVE-2018-20873 | Low | 3.3 | 2019-08-01 | cPanel before 74.0.8 allows local users to disable the ClamAV daemon (SEC-409). |
CVE-2019-10343 | Low | 3.3 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the configuration being appli… |
CVE-2019-10165 | Low | 2.3 | 2019-07-30 | OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenShift API server. A… |
CVE-2019-5452 | Low | 2.4 | 2019-07-30 | Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although t… |
CVE-2019-1552 | Low | 3.3 | 2019-07-30 | OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory… |
CVE-2019-14414 | Low | 3.3 | 2019-07-30 | In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478). |
CVE-2019-14412 | Low | 3.3 | 2019-07-30 | Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474). |
CVE-2019-14410 | Low | 3.3 | 2019-07-30 | Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472). |
CVE-2019-14407 | Low | 2.7 | 2019-07-30 | cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415). |
CVE-2019-14402 | Low | 3.3 | 2019-07-30 | cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481). |
CVE-2019-14396 | Low | 3.3 | 2019-07-30 | API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495). |
CVE-2019-14395 | Low | 3.3 | 2019-07-30 | cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494). |
CVE-2019-14391 | Low | 3.3 | 2019-07-30 | cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514). |
CVE-2018-20855 | Low | 3.3 | 2019-07-26 | An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized… |
CVE-2019-3591 | Low | 3.9 | 2019-07-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Windows 11.x pr… |
CVE-2019-2876 | Low | 3.3 | 2019-07-23 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and… |
CVE-2019-2875 | Low | 3.3 | 2019-07-23 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and… |