2019 CVEs (page 10)
Page 10 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-19286 | High | 7.2 | 2020-12-14 | A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow SQL injection attacks if an attacker is able to modify content o… |
CVE-2019-19285 | Medium | 5.4 | 2020-12-14 | A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow injections that could lead to XSS attacks if unsuspecting users… |
CVE-2019-19284 | Medium | 5.4 | 2020-12-14 | A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow Cross-Site Scripting (XSS) attacks if an attacker is able to mod… |
CVE-2019-19283 | Medium | 5.3 | 2020-12-14 | A vulnerability has been identified in XHQ (All Versions < 6.1). The application's web server could expose non-sensitive information about the server's archite… |
CVE-2019-4738 | Medium | 6.5 | 2020-12-10 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.1 discloses sensitive information to an authenticated user from… |
CVE-2019-7198 | Critical | 9.8 | 2020-12-10 | This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in… |
CVE-2019-16958 | Medium | 5.4 | 2020-12-01 | Cross-site Scripting (XSS) vulnerability in SolarWinds Web Help Desk 12.7.0 allows attacker to inject arbitrary web script or HTML via Location Name. |
CVE-2019-20934 | Medium | 5.3 | 2020-11-28 | An issue was discovered in the Linux kernel before 5.2.6. On NUMA systems, the Linux fair scheduler has a use-after-free in show_numa_stats() because NUMA faul… |
CVE-2019-19878 | High | 7.5 | 2020-11-27 | An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get access to historical data from AprolSqlServer by bypassing au… |
CVE-2019-19877 | Medium | 5.3 | 2020-11-27 | An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get access to sensitive information outside the working directory… |
CVE-2019-19876 | Critical | 9.8 | 2020-11-27 | An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An EnMon PHP script was vulnerable to SQL injection, a different vulnerability th… |
CVE-2019-19875 | Critical | 9.8 | 2020-11-27 | An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands could be injected (using Python scripts) via the AprolCluster… |
CVE-2019-19874 | Critical | 9.8 | 2020-11-27 | An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Some web scripts in the web interface allowed injection and execution of arbitrar… |
CVE-2019-19873 | High | 7.5 | 2020-11-27 | An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get information from the AprolSqlServer DBMS by bypassing authent… |
CVE-2019-19872 | Critical | 9.8 | 2020-11-27 | An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. The AprolLoader could be used to inject and execute arbitrary unintended commands… |
CVE-2019-19869 | High | 7.5 | 2020-11-27 | An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. PVs could be changed (unencrypted) by using the IosHttp service and the JSON inte… |
CVE-2019-20925 | High | 7.5 | 2020-11-24 | An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectl… |
CVE-2019-14587 | Medium | 6.5 | 2020-11-23 | Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access. |
CVE-2019-14586 | High | 8.0 | 2020-11-23 | Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of s… |
CVE-2019-14575 | High | 7.8 | 2020-11-23 | Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2019-14563 | High | 7.8 | 2020-11-23 | Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2019-2393 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use $lookup and collations. This issue… |
CVE-2019-2392 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which use the $mod operator to overflow negat… |
CVE-2019-20924 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the IndexBoundsB… |
CVE-2019-20923 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions c… |
CVE-2019-14562 | Medium | 5.5 | 2020-11-23 | Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2019-14559 | High | 7.5 | 2020-11-23 | Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access. |
CVE-2019-14553 | Medium | 4.9 | 2020-11-23 | Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access. |
CVE-2019-20933 | Critical | 9.8 | 2020-11-19 | InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empt… |
CVE-2019-12412 | High | 7.5 | 2020-11-19 | A flaw in the libapreq2 v2.07 to v2.13 multipart parser can deference a null pointer leading to a process crash. A remote attacker could send a request causing… |
CVE-2019-19563 | Low | 2.4 | 2020-11-16 | A misconfiguration in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with direct physical access to device hardware to obtain cellular mode… |
CVE-2019-19562 | Medium | 4.6 | 2020-11-16 | An authentication bypass in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with physical access to device hardware to obtain system informa… |
CVE-2019-19561 | Low | 2.4 | 2020-11-16 | A misconfiguration in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with direct physical access to device hardware to obtain cellular mode… |
CVE-2019-19560 | Medium | 4.6 | 2020-11-16 | An authentication bypass in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with physical access to device hardware to obtain system informa… |
CVE-2019-19557 | Low | 2.4 | 2020-11-16 | A misconfiguration in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with direct physical access to device hardware to obtain cellular modem… |
CVE-2019-19556 | Medium | 4.6 | 2020-11-16 | An authentication bypass in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with physical access to device hardware to obtain system informati… |
CVE-2019-17566 | High | 7.5 | 2020-11-12 | Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted arg… |
CVE-2019-11121 | High | 7.8 | 2020-11-12 | Improper file permissions in the installer for the Intel(R) Media SDK for Windows before version 2019 R1 may allow an authenticated user to potentially enable… |
CVE-2019-7357 | High | 8.8 | 2020-11-10 | Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins. |
CVE-2019-7356 | Medium | 5.4 | 2020-11-04 | Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter. |
CVE-2019-4349 | Low | 3.5 | 2020-11-03 | IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 applications can be installed on a deprecated operating system version that could compromised the co… |
CVE-2019-4563 | Medium | 5.3 | 2020-10-29 | IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie value… |
CVE-2019-4547 | Medium | 5.3 | 2020-10-29 | IBM Security Directory Server 6.4.0 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Forc… |
CVE-2019-8901 | Medium | 6.5 | 2020-10-27 | This issue was addressed by verifying host keys when connecting to a previously-known SSH server. This issue is fixed in iOS 13.1 and iPadOS 13.1. An attacker… |
CVE-2019-8898 | Medium | 4.3 | 2020-10-27 | An information disclosure issue existed in the handling of the Storage Access API. This issue was addressed with improved logic. This issue is fixed in iOS 13… |
CVE-2019-8858 | Medium | 5.3 | 2020-10-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-0… |
CVE-2019-8857 | Low | 3.3 | 2020-10-27 | The issue was addressed with improved validation when an iCloud Link is created. This issue is fixed in iOS 13.3 and iPadOS 13.3. Live Photo audio and video da… |
CVE-2019-8856 | Low | 3.3 | 2020-10-27 | An API issue existed in the handling of outgoing phone calls initiated with Siri. This issue was addressed with improved state handling. This issue is fixed in… |
CVE-2019-8855 | Medium | 6.3 | 2020-10-27 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Catalina 10.15. A malicious application may be able to access… |
CVE-2019-8854 | High | 7.5 | 2020-10-27 | A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in macOS Catalina 10.15, watchOS 6, iOS 13, tvOS 13. A device may… |
CVE-2019-8853 | Medium | 5.5 | 2020-10-27 | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.4, Security Update 2020-002 Mojave, Security Upd… |
CVE-2019-8852 | High | 7.8 | 2020-10-27 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Secu… |
CVE-2019-8850 | Medium | 5.5 | 2020-10-27 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15, iOS 13.1 and iPadOS 13.1, tvOS 13, macOS Catal… |
CVE-2019-8848 | High | 7.8 | 2020-10-27 | This issue was addressed with improved checks. This issue is fixed in tvOS 13.3, watchOS 6.1.1, iCloud for Windows 10.9, macOS Catalina 10.15.2, Security Updat… |
CVE-2019-8847 | High | 7.8 | 2020-10-27 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Secu… |
CVE-2019-8846 | High | 8.8 | 2020-10-27 | A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 13.3, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safa… |
CVE-2019-8796 | Medium | 5.3 | 2020-10-27 | A logic issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, iO… |
CVE-2019-8664 | Medium | 6.5 | 2020-10-27 | An input validation issue was addressed with improved input validation. This issue is fixed in iOS 12.3, watchOS 5.2.1. Processing a maliciously crafted messag… |
CVE-2019-8531 | Critical | 9.8 | 2020-10-27 | A validation issue existed in Trust Anchor Management. This issue was addressed with improved validation. This issue is fixed in watchOS 5.2, macOS Mojave 10.1… |
CVE-2019-8851 | High | 7.5 | 2020-10-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update… |
CVE-2019-8844 | High | 8.8 | 2020-10-27 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13.3, watchOS 6.1.1, iCloud for Windows 10.9, iOS 1… |
CVE-2019-8842 | Low | 3.3 | 2020-10-27 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Upd… |
CVE-2019-8841 | High | 7.8 | 2020-10-27 | An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.3 and iPadOS 13.3. An application may be able to e… |
CVE-2019-8840 | High | 8.8 | 2020-10-27 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 11.3. Compiling with untrusted sources may lead to arbitrary co… |
CVE-2019-8839 | Medium | 5.5 | 2020-10-27 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Upd… |
CVE-2019-8838 | High | 7.8 | 2020-10-27 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3 and iPadOS 13.3, watchOS 6.1.1, macOS Catalina 10.15.2… |
CVE-2019-8837 | High | 7.8 | 2020-10-27 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 201… |
CVE-2019-8836 | High | 7.8 | 2020-10-27 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in watchOS 6.1.2, iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1. An appl… |
CVE-2019-8835 | High | 8.8 | 2020-10-27 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13.3, iCloud for Windows 10.9, iOS 13.3 and iPadOS… |
CVE-2019-8834 | Medium | 4.3 | 2020-10-27 | A configuration issue was addressed with additional restrictions. This issue is fixed in tvOS 13.3, watchOS 6.1.1, iCloud for Windows 10.9, macOS Catalina 10.1… |
CVE-2019-8833 | High | 7.8 | 2020-10-27 | A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.3 and iPadOS 13.3, watchOS 6.1.1, macOS Catalina 10.15.2… |
CVE-2019-8832 | High | 7.8 | 2020-10-27 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3 and iPadOS 13.3, watchOS 6.1.1, macOS Catalina 10.15.2… |
CVE-2019-8831 | High | 7.8 | 2020-10-27 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15, iOS 13.1 and iPadOS 13.1, tvOS 13, macOS Ca… |
CVE-2019-8830 | High | 8.8 | 2020-10-27 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in tvOS 13.3, watchOS 6.1.1, macOS Catalina 10.15.2, Security Update 20… |
CVE-2019-8829 | High | 7.8 | 2020-10-27 | A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Up… |
CVE-2019-8828 | High | 7.8 | 2020-10-27 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3 and iPadOS 13.3, watchOS 6.1.1, macOS Catalina 10.15.2… |
CVE-2019-8827 | Medium | 4.3 | 2020-10-27 | The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin. This issue is f… |
CVE-2019-8826 | High | 8.8 | 2020-10-27 | A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15. Processing maliciously crafted web content… |
CVE-2019-8825 | High | 8.8 | 2020-10-27 | A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15, iOS 13, iCloud for Windows 10.7, macOS Cat… |
CVE-2019-8824 | High | 7.8 | 2020-10-27 | A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security U… |
CVE-2019-8809 | Low | 3.3 | 2020-10-27 | A validation issue was addressed with improved logic. This issue is fixed in macOS Catalina 10.15, iOS 13.1 and iPadOS 13.1, tvOS 13, watchOS 6, iOS 13. A loca… |
CVE-2019-8799 | Low | 2.4 | 2020-10-27 | This issue was resolved by replacing device names with a random identifier. This issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15, watchOS 6, t… |
CVE-2019-8790 | Medium | 5.5 | 2020-10-27 | This issue was addresses by updating incorrect URLSession file descriptors management logic to match Swift 5.0. This issue is fixed in Swift 5.1.1 for Ubuntu… |
CVE-2019-8780 | Medium | 5.5 | 2020-10-27 | The issue was addressed with improved permissions logic. This issue is fixed in iOS 13.1 and iPadOS 13.1, tvOS 13. A malicious application may be able to deter… |
CVE-2019-8777 | Low | 2.4 | 2020-10-27 | A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in macOS Mojave… |
CVE-2019-8776 | High | 7.8 | 2020-10-27 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15. An application may be able to execute arbit… |
CVE-2019-8774 | Medium | 5.5 | 2020-10-27 | A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15. Parsing a mali… |
CVE-2019-8773 | High | 8.8 | 2020-10-27 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, iCloud for Wind… |
CVE-2019-8771 | Medium | 6.1 | 2020-10-27 | This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Maliciously crafted web content may violate if… |
CVE-2019-8767 | Critical | 9.8 | 2020-10-27 | A memory consumption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security U… |
CVE-2019-8762 | Medium | 6.1 | 2020-10-27 | A validation issue was addressed with improved logic. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, iCloud for Windows 10.7, tvOS 13, iCloud… |
CVE-2019-8761 | Medium | 5.5 | 2020-10-27 | This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, macOS Cat… |
CVE-2019-8759 | High | 7.1 | 2020-10-27 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update… |
CVE-2019-8756 | Critical | 9.8 | 2020-10-27 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Catalina 10.15, iOS 13, iCloud for Windows 7.14… |
CVE-2019-8754 | Medium | 6.5 | 2020-10-27 | A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue is fixed in macOS Catalina 10.15… |
CVE-2019-8753 | Medium | 6.1 | 2020-10-27 | This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15, watchOS 6, iOS 13, tvOS 13. Processing maliciously crafted web cont… |
CVE-2019-8752 | High | 8.8 | 2020-10-27 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, iCloud for Wind… |
CVE-2019-8751 | High | 8.8 | 2020-10-27 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, iCloud for Wind… |
CVE-2019-8749 | Critical | 9.8 | 2020-10-27 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Catalina 10.15, iOS 13, iCloud for Windows 7.14… |
CVE-2019-8746 | Critical | 9.8 | 2020-10-27 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15, iOS 13, iCloud for Windows 7.14, iCloud for Wi… |