2019 CVEs (page 100)
Page 100 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-14194 | Critical | 9.8 | 2019-07-31 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in th… |
CVE-2019-14193 | Critical | 9.8 | 2019-07-31 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with an unvalidated length at nfs_readlink_reply, in the "if" block after c… |
CVE-2019-14192 | Critical | 9.8 | 2019-07-31 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer unde… |
CVE-2019-10366 | Medium | 6.5 | 2019-07-31 | Jenkins Skytap Cloud CI Plugin 2.06 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by user… |
CVE-2019-10365 | Medium | 4.3 | 2019-07-31 | Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspace, where it could… |
CVE-2019-10364 | Medium | 5.5 | 2019-07-31 | Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log. |
CVE-2019-10363 | Medium | 4.9 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form. |
CVE-2019-10362 | Medium | 5.4 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, all… |
CVE-2019-10361 | Medium | 5.5 | 2019-07-31 | Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users with access to the mas… |
CVE-2019-10360 | Medium | 5.4 | 2019-07-31 | A stored cross site scripting vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier allowed attackers to inject arbitrary HTML and JavaScript in the… |
CVE-2019-10359 | Medium | 6.3 | 2019-07-31 | A cross-site request forgery vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier in the M2ReleaseAction#doSubmit method allowed attackers to perfo… |
CVE-2019-10358 | Medium | 6.5 | 2019-07-31 | Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the bu… |
CVE-2019-10357 | Medium | 4.3 | 2019-07-31 | A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited inform… |
CVE-2019-10356 | High | 8.8 | 2019-07-31 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to ex… |
CVE-2019-10355 | High | 8.8 | 2019-07-31 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary… |
CVE-2019-10345 | Medium | 5.5 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export. |
CVE-2019-10344 | Medium | 4.3 | 2019-07-31 | Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access t… |
CVE-2019-10343 | Low | 3.3 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the configuration being appli… |
CVE-2019-14452 | High | 7.5 | 2019-07-31 | Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that i… |
CVE-2019-10165 | Low | 2.3 | 2019-07-30 | OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenShift API server. A… |
CVE-2019-10163 | Medium | 4.3 | 2019-07-30 | A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authorized master server to cause a high CPU lo… |
CVE-2019-10162 | High | 7.5 | 2019-07-30 | A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the server to exit by insert… |
CVE-2019-10161 | High | 7.8 | 2019-07-30 | It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an ar… |
CVE-2019-10156 | Medium | 5.4 | 2019-07-30 | A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclos… |
CVE-2019-10153 | Medium | 5.0 | 2019-07-30 | A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm… |
CVE-2019-10152 | High | 7.2 | 2019-07-30 | A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has comprom… |
CVE-2019-7616 | Medium | 4.9 | 2019-07-30 | Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer. An attacker with… |
CVE-2019-7615 | High | 7.4 | 2019-07-30 | A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the 'serve… |
CVE-2019-7614 | Medium | 5.9 | 2019-07-30 | A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users sub… |
CVE-2019-5460 | Medium | 5.5 | 2019-07-30 | Double Free in VLC versions <= 3.0.6 leads to a crash. |
CVE-2019-5459 | High | 7.1 | 2019-07-30 | An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read. |
CVE-2019-5458 | Medium | 5.4 | 2019-07-30 | Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaS… |
CVE-2019-5457 | Medium | 5.4 | 2019-07-30 | Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaSc… |
CVE-2019-5456 | High | 8.1 | 2019-07-30 | SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version <= 5.10.21 and their actual SMTP server to record th… |
CVE-2019-5455 | Medium | 6.8 | 2019-07-30 | Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process. |
CVE-2019-5454 | Critical | 9.8 | 2019-07-30 | SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query is executed requiring to resetup the acc… |
CVE-2019-5453 | Medium | 6.1 | 2019-07-30 | Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to… |
CVE-2019-5452 | Low | 2.4 | 2019-07-30 | Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although t… |
CVE-2019-5451 | Medium | 4.6 | 2019-07-30 | Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing the app in a very sho… |
CVE-2019-5450 | Medium | 6.8 | 2019-07-30 | Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style the directory name in the header bar when… |
CVE-2019-5449 | Medium | 4.3 | 2019-07-30 | A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events. |
CVE-2019-5448 | High | 8.1 | 2019-07-30 | Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over t… |
CVE-2019-13026 | Critical | 9.8 | 2019-07-30 | OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows SQL Injection via a crafted URL, leading to full access by an attacker. This includes all shopping… |
CVE-2019-14383 | Medium | 6.5 | 2019-07-30 | J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs. |
CVE-2019-14382 | Medium | 6.5 | 2019-07-30 | DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs. |
CVE-2019-14380 | Medium | 6.5 | 2019-07-30 | libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files. |
CVE-2019-14313 | Critical | 9.8 | 2019-07-30 | A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a… |
CVE-2019-14242 | Medium | 6.7 | 2019-07-30 | An issue was discovered in Bitdefender products for Windows (Bitdefender Endpoint Security Tool versions prior to 6.6.8.115; and Bitdefender Antivirus Plus, Bi… |
CVE-2019-1552 | Low | 3.3 | 2019-07-30 | OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory… |
CVE-2019-14318 | Medium | 5.9 | 2019-07-30 | Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote attacker, able to measure the duration o… |
CVE-2019-11202 | Critical | 9.8 | 2019-07-30 | An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher s… |
CVE-2019-10142 | High | 7.1 | 2019-07-30 | A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17. A parameter passed to an ioc… |
CVE-2019-10141 | High | 8.3 | 2019-07-30 | A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in… |
CVE-2019-10138 | High | 8.8 | 2019-07-30 | A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient ac… |
CVE-2019-10130 | Medium | 4.3 | 2019-07-30 | A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9… |
CVE-2019-10129 | Medium | 6.5 | 2019-07-30 | A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned table, an attacker can read arbitrary byte… |
CVE-2019-14414 | Low | 3.3 | 2019-07-30 | In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains (SEC-478). |
CVE-2019-14413 | Medium | 4.3 | 2019-07-30 | cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476). |
CVE-2019-14412 | Low | 3.3 | 2019-07-30 | Maketext in cPanel before 78.0.2 allows format-string injection in the DCV check_domains_via_dns UAPI (SEC-474). |
CVE-2019-14411 | Medium | 5.3 | 2019-07-30 | cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI (SEC-473). |
CVE-2019-14410 | Low | 3.3 | 2019-07-30 | Maketext in cPanel before 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472). |
CVE-2019-14409 | Medium | 5.5 | 2019-07-30 | cPanel before 78.0.2 allows arbitrary file-read operations via Passenger adminbin (SEC-466). |
CVE-2019-14408 | Medium | 4.3 | 2019-07-30 | cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460). |
CVE-2019-14407 | Low | 2.7 | 2019-07-30 | cPanel before 78.0.2 reveals internal data to OpenID providers (SEC-415). |
CVE-2019-14406 | Medium | 6.1 | 2019-07-30 | cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493). |
CVE-2019-14405 | High | 8.8 | 2019-07-30 | cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487). |
CVE-2019-14404 | Medium | 5.5 | 2019-07-30 | cPanel before 78.0.18 allows certain file-read operations in the context of the root account via the Exim virtual_user_spam router (SEC-484). |
CVE-2019-14403 | Medium | 4.3 | 2019-07-30 | cPanel before 78.0.18 offers an open mail relay because of incorrect domain-redirect routing (SEC-483). |
CVE-2019-14402 | Low | 3.3 | 2019-07-30 | cPanel before 78.0.18 unsafely determines terminal capabilities by using infocmp (SEC-481). |
CVE-2019-14401 | High | 8.8 | 2019-07-30 | cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480). |
CVE-2019-14400 | High | 7.8 | 2019-07-30 | cPanel before 78.0.18 allows local users to escalate to root access because of userdata cache misparsing (SEC-479). |
CVE-2019-14399 | High | 7.1 | 2019-07-30 | The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account (SEC-477). |
CVE-2019-14398 | High | 8.8 | 2019-07-30 | cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498). |
CVE-2019-14397 | Medium | 5.3 | 2019-07-30 | cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call (SEC-496). |
CVE-2019-14396 | Low | 3.3 | 2019-07-30 | API Analytics adminbin in cPanel before 80.0.5 allows spoofed insertions of log data (SEC-495). |
CVE-2019-14395 | Low | 3.3 | 2019-07-30 | cPanel before 80.0.5 uses world-readable permissions for the Queueprocd log (SEC-494). |
CVE-2019-14394 | Medium | 5.5 | 2019-07-30 | cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetch_ssl_certificates_for_fqdns API (SEC-489). |
CVE-2019-14393 | Medium | 5.3 | 2019-07-30 | cPanel before 80.0.5 allows local code execution in the context of a different cPanel account because of insecure cpphp execution (SEC-486). |
CVE-2019-4456 | High | 7.1 | 2019-07-30 | IBM Daeja ViewONE Professional, Standard & Virtual 5.0.5 and 5.0.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A r… |
CVE-2019-4285 | Medium | 5.4 | 2019-07-30 | IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to vi… |
CVE-2019-4062 | High | 7.1 | 2019-07-30 | IBM i2 Intelligent Analyis Platform 9.0.0 through 9.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2019-14392 | High | 8.8 | 2019-07-30 | cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501). |
CVE-2019-11775 | High | 7.4 | 2019-07-30 | All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning -… |
CVE-2019-14444 | Medium | 5.5 | 2019-07-30 | apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to trigger a write access violation (in byte_put_little_… |
CVE-2019-14443 | Medium | 6.5 | 2019-07-30 | An issue was discovered in Libav 12.3. Division by zero in range_decode_culshift in libavcodec/apedec.c allows remote attackers to cause a denial of service (a… |
CVE-2019-14442 | Medium | 6.5 | 2019-07-30 | In mpc8_read_header in libavformat/mpc8.c in Libav 12.3, an input file can result in an avio_seek infinite loop and hang, with 100% CPU consumption. Attackers… |
CVE-2019-14441 | Medium | 6.5 | 2019-07-30 | An issue was discovered in Libav 12.3. An access violation allows remote attackers to cause a denial of service (application crash), as demonstrated by avconv… |
CVE-2019-14391 | Low | 3.3 | 2019-07-30 | cPanel before 82.0.2 does not properly enforce Reseller package creation ACLs (SEC-514). |
CVE-2019-14390 | Medium | 5.4 | 2019-07-30 | cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512). |
CVE-2019-14389 | High | 7.8 | 2019-07-30 | cPanel before 82.0.2 allows local users to discover the MySQL root password (SEC-510). |
CVE-2019-14388 | High | 7.5 | 2019-07-30 | cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507). |
CVE-2019-14387 | Medium | 6.1 | 2019-07-30 | cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506). |
CVE-2019-14386 | Medium | 5.4 | 2019-07-30 | cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504). |
CVE-2019-14381 | High | 7.5 | 2019-07-30 | libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL instrument to an empty instrument note map slot. |
CVE-2019-14327 | Medium | 6.5 | 2019-07-30 | A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings. |
CVE-2019-13635 | Critical | 9.1 | 2019-07-30 | The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal. |
CVE-2019-14439 | High | 7.5 | 2019-07-30 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for… |
CVE-2019-3948 | High | 7.5 | 2019-07-29 | The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.0.R, Dahua DH-IPC HX883X and DH-IPC-HX86… |
CVE-2019-14431 | Critical | 9.8 | 2019-07-29 | In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-based buffer overflow of up to 256 bytes and… |
CVE-2019-14418 | High | 8.8 | 2019-07-29 | An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. When uploading an application bundle, a directory traversal vulnerability allows a… |