2019 CVEs (page 102)
Page 102 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-5605 | Medium | 6.5 | 2019-07-26 | In FreeBSD 11.3-STABLE before r350217, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, due to insufficient initialization of mem… |
CVE-2019-5604 | Critical | 9.6 | 2019-07-26 | In FreeBSD 12.0-STABLE before r350246, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350247, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE b… |
CVE-2019-5603 | High | 7.8 | 2019-07-26 | In FreeBSD 12.0-STABLE before r350261, 12.0-RELEASE before 12.0-RELEASE-p8, 11.3-STABLE before r350263, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE b… |
CVE-2019-10976 | Medium | 5.5 | 2019-07-26 | Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sanitized while parsi… |
CVE-2019-10974 | Medium | 5.5 | 2019-07-26 | NREL EnergyPlus, Versions 8.6.0 and possibly prior versions, The application fails to prevent an exception handler from being overwritten with arbitrary code. |
CVE-2019-10972 | Medium | 5.5 | 2019-07-26 | Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability can be triggered when an attacker provides the target with a rogue project fi… |
CVE-2019-10744 | Critical | 9.1 | 2019-07-26 | Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of… |
CVE-2019-1010147 | Medium | 5.4 | 2019-07-26 | Yellowfin Smart Reporting All Versions Prior to 7.3 is affected by: Incorrect Access Control - Privileges Escalation. The impact is: Victim attacked and access… |
CVE-2019-0202 | High | 7.5 | 2019-07-26 | The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating… |
CVE-2019-11922 | High | 8.1 | 2019-07-25 | A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output bu… |
CVE-2019-11921 | Critical | 9.8 | 2019-07-25 | An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malform… |
CVE-2019-10184 | High | 7.5 | 2019-07-25 | undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests withou… |
CVE-2019-13917 | Critical | 9.8 | 2019-07-25 | Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can… |
CVE-2019-13483 | High | 7.3 | 2019-07-25 | Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypa… |
CVE-2019-1010127 | High | 7.8 | 2019-07-25 | VCFTools vcftools prior to version 0.1.15 is affected by: Use-after-free. The impact is: Denial of Service or possibly other impact (eg. code execution or info… |
CVE-2019-9885 | Critical | 9.8 | 2019-07-25 | eClass platform < ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenview_left.php StudentID parameter. |
CVE-2019-9884 | Critical | 9.8 | 2019-07-25 | eClass platform < ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page. |
CVE-2019-3621 | Medium | 6.8 | 2019-07-25 | Authentication protection bypass vulnerability in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows physical local user to bypass the… |
CVE-2019-2346 | High | 7.8 | 2019-07-25 | Firmware is getting into loop of overwriting memory when scan command is given from host because of improper validation. in Snapdragon Compute, Snapdragon Cons… |
CVE-2019-2345 | High | 7.0 | 2019-07-25 | Race condition while accessing DMA buffer in jpeg driver in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapd… |
CVE-2019-2343 | Medium | 5.5 | 2019-07-25 | Out of bound read and information disclosure in firmware due to insufficient checking of an embedded structure that can be sent from a kernel driver in Snapdra… |
CVE-2019-2334 | High | 7.5 | 2019-07-25 | Null pointer dereferencing can happen when playing the clip with wrong block group id in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdrag… |
CVE-2019-2330 | Medium | 5.5 | 2019-07-25 | improper input validation in allocation request for secure allocations can lead to page fault. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… |
CVE-2019-2328 | High | 7.8 | 2019-07-25 | Possible buffer overflow when number of channels passed is more than size of channel mapping array in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer… |
CVE-2019-2327 | Critical | 9.8 | 2019-07-25 | Possible buffer overflow can occur when playing clip with incorrect element size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon In… |
CVE-2019-2326 | High | 7.8 | 2019-07-25 | Data token is received from ADSP and is used without validation as an index into the array leads to out of bound access in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-2322 | Critical | 9.8 | 2019-07-25 | Buffer overflow can occur when playing specific clip which is non-standard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer… |
CVE-2019-2316 | High | 8.8 | 2019-07-25 | When computing the digest a local variable is used after going out of scope in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice &… |
CVE-2019-2314 | High | 7.0 | 2019-07-25 | Possible race condition that will cause a use-after-free when writing to two sysfs entries at nearly the same time in Snapdragon Compute, Snapdragon Consumer I… |
CVE-2019-2312 | High | 7.8 | 2019-07-25 | When handling the vendor command there exists a potential buffer overflow due to lack of input validation of data buffer received in Snapdragon Auto, Snapdrago… |
CVE-2019-2309 | Critical | 9.8 | 2019-07-25 | While storing calibrated data from firmware in cache, An integer overflow may occur since data length received may exceed real data length. in Snapdragon Auto… |
CVE-2019-2308 | High | 7.8 | 2019-07-25 | User application could potentially make RPC call to the fastrpc driver and the driver will allow the message to go through to the remote subsystem in Snapdrago… |
CVE-2019-2307 | Critical | 9.8 | 2019-07-25 | Possible integer underflow due to lack of validation before calculation of data length in 802.11 Rx management configuration in Snapdragon Auto, Snapdragon Con… |
CVE-2019-2306 | High | 7.8 | 2019-07-25 | Improper casting of structure while handling the buffer leads to out of bound read in display in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer… |
CVE-2019-2305 | Critical | 9.8 | 2019-07-25 | Out of bound access when reason code is extracted from frame data without validating the frame length in Snapdragon Auto, Snapdragon Consumer Electronics Conne… |
CVE-2019-2301 | High | 7.8 | 2019-07-25 | Possibility of out-of-bound read if id received from SPI is not in range of FIFO in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon In… |
CVE-2019-2299 | High | 7.8 | 2019-07-25 | An out-of-bound write can be triggered by a specially-crafted command supplied by a userspace application. in Snapdragon Auto, Snapdragon Consumer Electronics… |
CVE-2019-2298 | High | 7.8 | 2019-07-25 | Protection is missing while accessing md sessions info via macro which can lead to use-after-free in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer I… |
CVE-2019-2293 | High | 7.8 | 2019-07-25 | Pointer dereference while freeing IFE resources due to lack of length check of in port resource. in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdra… |
CVE-2019-2290 | High | 7.8 | 2019-07-25 | Multiple open and close from multiple threads will lead camera driver to access destroyed session data pointer in Snapdragon Auto, Snapdragon Connectivity, Sna… |
CVE-2019-2281 | High | 7.8 | 2019-07-25 | An unauthenticated bitmap image can be loaded in to memory and subsequently cause execution of unverified code. in Snapdragon Compute, Snapdragon Connectivity… |
CVE-2019-2278 | High | 7.8 | 2019-07-25 | User keystore signature is ignored in boot and can lead to bypass boot image signature verification in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mob… |
CVE-2019-2276 | Critical | 9.8 | 2019-07-25 | Possible out of bound read occurs while processing beaconing request due to lack of check on action frames received from user controlled space in Snapdragon Au… |
CVE-2019-2273 | High | 7.5 | 2019-07-25 | IOMMU page fault while playing h265 video file leads to denial of service issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Con… |
CVE-2019-2272 | High | 7.8 | 2019-07-25 | Buffer overflow can occur in display function due to lack of validation of header block size set by user. in Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag… |
CVE-2019-2263 | High | 7.8 | 2019-07-25 | Access to freed memory can happen while reading from diag driver due to use after free issue in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer I… |
CVE-2019-2254 | Critical | 9.8 | 2019-07-25 | Position determination accuracy may be degraded due to wrongly decoded information in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon… |
CVE-2019-2253 | Critical | 9.8 | 2019-07-25 | Buffer over-read can occur while parsing an ogg file with a corrupted comment block. in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snap… |
CVE-2019-2241 | Medium | 5.5 | 2019-07-25 | While rendering the layout background, Error status check is not caught properly and also incorrect status handling is being done leading to unintended SUI beh… |
CVE-2019-2240 | Medium | 5.5 | 2019-07-25 | While sending the rendered surface content to the screen, Error handling is not properly checked results in an unpredictable behaviour in Snapdragon Auto, Snap… |
CVE-2019-2239 | Medium | 5.5 | 2019-07-25 | Sanity checks are missing in layout which can lead to SUI Corruption or can lead to Denial of Service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connec… |
CVE-2019-2238 | High | 7.8 | 2019-07-25 | Lack of check of data type can lead to subsequent loop-expression potentially go negative and the condition will still evaluate to true leading to buffer under… |
CVE-2019-2237 | Medium | 5.5 | 2019-07-25 | Failure in taking appropriate action to handle the error case If keypad gpio deactivation fails leads to silent failure scenario and subsequent logic gets exec… |
CVE-2019-2236 | Medium | 5.5 | 2019-07-25 | Null pointer dereference during secure application termination using specific application ids. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2019-2235 | High | 7.8 | 2019-07-25 | Buffer overflow occurs when emulated RPMB is used due to sector size assumptions in the TA rollback protection logic. in Snapdragon Auto, Snapdragon Compute, S… |
CVE-2019-14270 | High | 7.1 | 2019-07-25 | Comodo Antivirus through 12.0.0.6870, Comodo Firewall through 12.0.0.6870, and Comodo Internet Security Premium through 12.0.0.6870, with the Comodo Container… |
CVE-2019-14268 | Medium | 6.5 | 2019-07-25 | In Octopus Deploy versions 3.0.19 to 2019.7.2, when a web request proxy is configured, an authenticated user (in certain limited circumstances) could trigger a… |
CVE-2019-14266 | High | 8.8 | 2019-07-25 | OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/Use… |
CVE-2019-4439 | Medium | 5.3 | 2019-07-25 | IBM Cloud Private 3.1.0, 3.1.1, and 3.1.2 does not invalidate session after logout which could allow a local user to impersonate another user on the system. IB… |
CVE-2019-4415 | High | 7.8 | 2019-07-25 | IBM Cloud Private 3.1.1 and 3.1.2 could allow a local user to obtain elevated privileges due to improper security context constraints. IBM X-Force ID: 162706. |
CVE-2019-4212 | High | 8.8 | 2019-07-25 | IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… |
CVE-2019-4116 | Medium | 5.5 | 2019-07-25 | IBM Cloud Private 2.1.0, 3.1.0, and 3.1.1 could disclose highly sensitive information in installer logs that could be use for further attacks against the syste… |
CVE-2019-3486 | Medium | 4.6 | 2019-07-25 | Mitigates a stored cross site scripting issue in ArcSight Security Management Center versions prior to 2.9.1 |
CVE-2019-1010182 | Medium | 6.5 | 2019-07-25 | yaml-rust 0.4.0 and earlier is affected by: Uncontrolled Recursion. The impact is: Denial of service by impossible to catch abort. The component is: YamlLoader… |
CVE-2019-1010176 | Critical | 9.8 | 2019-07-25 | JerryScript commit 4e58ccf68070671e1fff5cd6673f0c1d5b80b166 is affected by: Buffer Overflow. The impact is: denial of service and possibly arbitrary code execu… |
CVE-2019-1010174 | Critical | 9.8 | 2019-07-25 | CImg The CImg Library v.2.3.3 and earlier is affected by: command injection. The impact is: RCE. The component is: load_network() function. The attack vector i… |
CVE-2019-1010172 | High | 7.5 | 2019-07-25 | Jsish 2.4.84 2.0484 is affected by: Uncontrolled Resource Consumption. The impact is: denial of service. The component is: function jsiValueGetString (jsiUtils… |
CVE-2019-1010161 | Critical | 9.8 | 2019-07-25 | perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The component is: JWT.pm for JWT security toke… |
CVE-2019-1010183 | Medium | 6.5 | 2019-07-25 | serde serde_yaml 0.6.0 to 0.8.3 is affected by: Uncontrolled Recursion. The impact is: Denial of service by aborting. The component is: from_* functions (all d… |
CVE-2019-14262 | High | 7.5 | 2019-07-25 | MetadataExtractor 2.1.0 allows stack consumption. |
CVE-2019-3622 | High | 8.2 | 2019-07-24 | Files or Directories Accessible to External Parties in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows authenticated user to redirec… |
CVE-2019-3485 | Medium | 4.6 | 2019-07-24 | Mitigates a stored cross site scripting issue in ArcSight Logger versions prior to 6.7.1 |
CVE-2019-3595 | Medium | 6.5 | 2019-07-24 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in ePO extension in McAfee Data Loss Prevention (DLP) 11.x prior to 11.3.0… |
CVE-2019-3591 | Low | 3.9 | 2019-07-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Windows 11.x pr… |
CVE-2019-10992 | Medium | 5.5 | 2019-07-24 | Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple out-of-bounds read vulnerabilities may cause information disclosure due to lacking… |
CVE-2019-10982 | High | 7.8 | 2019-07-24 | Delta Electronics CNCSoft ScreenEditor, Versions 1.00.89 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing speciall… |
CVE-2019-10968 | Medium | 4.4 | 2019-07-24 | Philips Holter 2010 Plus, all versions. A vulnerability has been identified that may allow system options that were not purchased to be enabled. |
CVE-2019-1010191 | Critical | 9.8 | 2019-07-24 | marginalia < 1.6 is affected by: SQL Injection. The impact is: The impact is a injection of any SQL queries when a user controller argument is added as a compo… |
CVE-2019-1010189 | Medium | 5.5 | 2019-07-24 | mgetty prior to version 1.2.1 is affected by: Infinite Loop. The impact is: DoS, the program does never terminates. The component is: g3/g32pbm.c. The attack v… |
CVE-2019-1010179 | Critical | 9.8 | 2019-07-24 | PHKP including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b is affected by: Improper Neutralization of Special Elements used in a Command ('Command Injectio… |
CVE-2019-1010178 | Critical | 9.8 | 2019-07-24 | Fred MODX Revolution < 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/component… |
CVE-2019-1010193 | Medium | 6.1 | 2019-07-24 | hisiphp 1.0.8 is affected by: Cross Site Scripting (XSS). |
CVE-2019-1010190 | Medium | 5.5 | 2019-07-24 | mgetty prior to 1.2.1 is affected by: out-of-bounds read. The impact is: DoS, the program may crash if the memory is not mapped. The component is: putwhitespan… |
CVE-2019-1010180 | High | 7.8 | 2019-07-24 | GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and Possible Code Executi… |
CVE-2019-1010177 | Critical | 9.8 | 2019-07-24 | Jsish 2.4.70 2.047 is affected by: Use After Free. The impact is: denial of service and possibly arbitrary code execution. The component is: function Jsi_RegEx… |
CVE-2019-1010163 | High | 7.8 | 2019-07-24 | Socusoft Co Photo 2 Video Converter 8.0.0 is affected by: Buffer Overflow - Local shell-code execution and Denial of Service. The impact is: Local privilege es… |
CVE-2019-14250 | Medium | 5.5 | 2019-07-24 | An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrnd… |
CVE-2019-14249 | Medium | 6.5 | 2019-07-24 | dwarf_elf_load_headers.c in libdwarf before 2019-07-05 allows attackers to cause a denial of service (division by zero) via an ELF file with a zero-size sectio… |
CVE-2019-14248 | Medium | 5.5 | 2019-07-24 | In libnasm.a in Netwide Assembler (NASM) 2.14.xx, asm/pragma.c allows a NULL pointer dereference in process_pragma, search_pragma_list, and nasm_set_limit when… |
CVE-2019-14247 | Medium | 5.5 | 2019-07-24 | The scan() function in mad.c in mpg321 0.3.2 allows remote attackers to trigger an out-of-bounds write via a zero bitrate in an MP3 file. |
CVE-2019-2879 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.16 and prior. Easily exploitab… |
CVE-2019-2878 | Medium | 6.1 | 2019-07-23 | Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: HTTP data path subsystems). The supported… |
CVE-2019-2877 | Medium | 5.5 | 2019-07-23 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and… |
CVE-2019-2876 | Low | 3.3 | 2019-07-23 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and… |
CVE-2019-2875 | Low | 3.3 | 2019-07-23 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and… |
CVE-2019-2874 | Low | 3.3 | 2019-07-23 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and… |
CVE-2019-2873 | Low | 3.3 | 2019-07-23 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and… |
CVE-2019-2871 | High | 7.0 | 2019-07-23 | Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are 12.1.6.1.23, 12.1.6.1.26, 12.1.6.1.29, 12.1.6.1.36, 1… |
CVE-2019-2870 | High | 7.0 | 2019-07-23 | Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are 12.1.6.1.23, 12.1.6.1.26, 12.1.6.1.29, 12.1.6.1.36, 1… |
CVE-2019-2869 | High | 7.0 | 2019-07-23 | Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are 12.1.6.1.23, 12.1.6.1.26, 12.1.6.1.29, 12.1.6.1.36, 1… |