2019 CVEs (page 104)
Page 104 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-2764 | High | 7.3 | 2019-07-23 | Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affec… |
CVE-2019-2763 | High | 8.2 | 2019-07-23 | Vulnerability in the Oracle Hospitality Gift and Loyalty component of Oracle Food and Beverage Applications. Supported versions that are affected are 9.0.0 and… |
CVE-2019-2762 | Medium | 5.3 | 2019-07-23 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221… |
CVE-2019-2761 | Low | 3.7 | 2019-07-23 | Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Attachments / File Upload). Supported versions that… |
CVE-2019-2760 | High | 7.0 | 2019-07-23 | Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are 12.1.6.1.23, 12.1.6.1.26, 12.1.6.1.29, 12.1.6.1.36, 1… |
CVE-2019-2759 | High | 7.3 | 2019-07-23 | Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affec… |
CVE-2019-2758 | Medium | 5.5 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.26 and prior and 8.0.16 and pr… |
CVE-2019-2757 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.26 and prior and 8… |
CVE-2019-2756 | High | 7.3 | 2019-07-23 | Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). The supported version that is affec… |
CVE-2019-2755 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.7.25 and prior and… |
CVE-2019-2754 | High | 8.1 | 2019-07-23 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions t… |
CVE-2019-2753 | Medium | 4.6 | 2019-07-23 | Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. Easily exp… |
CVE-2019-2752 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Options). Supported versions that are affected are 8.0.16 and prior. Easily… |
CVE-2019-2751 | Medium | 5.9 | 2019-07-23 | Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: OHS Config MBeans). Supported versions that are affected are 12.1… |
CVE-2019-2750 | High | 8.6 | 2019-07-23 | Vulnerability in the MICROS Retail-J component of Oracle Retail Applications (subcomponent: Internal Operations). Supported versions that are affected are 12.1… |
CVE-2019-2749 | Medium | 6.8 | 2019-07-23 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult… |
CVE-2019-2748 | High | 7.1 | 2019-07-23 | Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Application Server). Supported versions that a… |
CVE-2019-2747 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: GIS). Supported versions that are affected are 8.0.12 and prior. Easily expl… |
CVE-2019-2746 | Medium | 6.5 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Data Dictionary). Supported versions that are affected are 8.0.12 and prior… |
CVE-2019-2745 | Medium | 5.1 | 2019-07-23 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 7u221, 8u212 and 11.0.3. D… |
CVE-2019-2744 | Medium | 6.1 | 2019-07-23 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions t… |
CVE-2019-2743 | Medium | 5.3 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Roles). Supported versions that are affected are 8.0.12 and prior… |
CVE-2019-2742 | High | 7.2 | 2019-07-23 | Vulnerability in the Oracle BI Publisher component of Oracle Fusion Middleware (subcomponent: Web Service API). The supported version that is affected is 11.1… |
CVE-2019-2741 | Medium | 5.3 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Audit Log). Supported versions that are affected are 5.7.26 and prior and 8… |
CVE-2019-2740 | Medium | 6.5 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: XML). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and… |
CVE-2019-2739 | Medium | 5.1 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.44 and p… |
CVE-2019-2738 | Low | 3.1 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Compiling). Supported versions that are affected are 5.6.44 and prior, 5.7… |
CVE-2019-2737 | Medium | 4.9 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Pluggable Auth). Supported versions that are affected are 5.6.44 and prior… |
CVE-2019-2736 | Medium | 6.1 | 2019-07-23 | Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions… |
CVE-2019-2735 | Low | 2.4 | 2019-07-23 | Vulnerability in the Oracle Hyperion Workspace component of Oracle Hyperion (subcomponent: UI and Visualization). The supported version that is affected is 11… |
CVE-2019-2733 | Medium | 4.3 | 2019-07-23 | Vulnerability in the Oracle Demantra Demand Management component of Oracle Supply Chain Products Suite (subcomponent: Product Security). The supported version… |
CVE-2019-2732 | Medium | 5.3 | 2019-07-23 | Vulnerability in the Oracle Demantra Demand Management component of Oracle Supply Chain Products Suite (subcomponent: Product Security). The supported version… |
CVE-2019-2731 | Medium | 5.4 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.7.23 and prior. Eas… |
CVE-2019-2730 | Low | 2.7 | 2019-07-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.44 and p… |
CVE-2019-2728 | Medium | 4.3 | 2019-07-23 | Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Products Suite (subcomponent: Networking). Supported versions that ar… |
CVE-2019-2727 | High | 7.3 | 2019-07-23 | Vulnerability in the Oracle Application Testing Suite component of Oracle Enterprise Manager Products Suite (subcomponent: Load Testing for Web Apps). The supp… |
CVE-2019-2672 | High | 8.2 | 2019-07-23 | Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: Print Server). Supported versions that are affected are… |
CVE-2019-2668 | High | 8.2 | 2019-07-23 | Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: Print Server). Supported versions that are affected are… |
CVE-2019-2666 | High | 8.2 | 2019-07-23 | Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: Print Server). Supported versions that are affected are… |
CVE-2019-2599 | Medium | 6.5 | 2019-07-23 | Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Pagelet Wizard). Supported versions that are a… |
CVE-2019-2569 | Medium | 4.0 | 2019-07-23 | Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Difficult to exp… |
CVE-2019-2561 | High | 8.2 | 2019-07-23 | Vulnerability in the Oracle Retail Xstore Office component of Oracle Retail Applications (subcomponent: Internal Operations). Supported versions that are affec… |
CVE-2019-2484 | Medium | 5.4 | 2019-07-23 | Vulnerability in the Application Express component of Oracle Database Server. Supported versions that are affected are 5.1 and 18.2. Easily exploitable vulnera… |
CVE-2019-12164 | Critical | 9.8 | 2019-07-23 | ubuntu-server.js in Status React Native Desktop before v0.57.8_mobile_ui allows Remote Code Execution. |
CVE-2019-11273 | Medium | 4.3 | 2019-07-23 | Pivotal Container Services (PKS) versions 1.3.x prior to 1.3.7, and versions 1.4.x prior to 1.4.1, contains a vulnerable component which logs the username and… |
CVE-2019-14243 | High | 7.5 | 2019-07-23 | headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote attac… |
CVE-2019-1010201 | Medium | 6.5 | 2019-07-23 | Jeesite 1.2.7 is affected by: SQL Injection. The impact is: sensitive information disclosure. The component is: updateProcInsIdByBusinessId() function in src/m… |
CVE-2019-1010200 | Critical | 9.8 | 2019-07-23 | Voice Builder Prior to commit c145d4604df67e6fc625992412eef0bf9a85e26b and f6660e6d8f0d1d931359d591dbdec580fef36d36 is affected by: CWE-78: Improper Neutraliza… |
CVE-2019-1010199 | Medium | 6.1 | 2019-07-23 | ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting (XSS). The impact is: JavaScrpit is reflected in the server response, hence exe… |
CVE-2019-13570 | High | 7.2 | 2019-07-23 | The AJdG AdRotate plugin before 5.3 for WordPress allows SQL Injection. |
CVE-2019-12162 | High | 7.8 | 2019-07-23 | Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local pr… |
CVE-2019-1010173 | High | 7.5 | 2019-07-23 | Jsish 2.4.84 2.0484 is affected by: Reachable Assertion. The impact is: denial of service. The component is: function Jsi_ValueArrayIndex (jsiValue.c:366). The… |
CVE-2019-9821 | High | 8.1 | 2019-07-23 | A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. This results in a potentially exploitable crash. Th… |
CVE-2019-9820 | Critical | 9.8 | 2019-07-23 | A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This… |
CVE-2019-9819 | Critical | 9.8 | 2019-07-23 | A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerab… |
CVE-2019-9818 | High | 8.3 | 2019-07-23 | A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can lead to a use-after-free in the main pr… |
CVE-2019-9817 | Medium | 5.3 | 2019-07-23 | Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violati… |
CVE-2019-9816 | Medium | 5.9 | 2019-07-23 | A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security ch… |
CVE-2019-9815 | High | 8.1 | 2019-07-23 | If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to… |
CVE-2019-9814 | Critical | 9.8 | 2019-07-23 | Mozilla developers and community members reported memory safety bugs present in Firefox 66. Some of these bugs showed evidence of memory corruption and we pres… |
CVE-2019-9811 | High | 8.3 | 2019-07-23 | As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that… |
CVE-2019-9800 | Critical | 9.8 | 2019-07-23 | Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed e… |
CVE-2019-11730 | Medium | 6.5 | 2019-07-23 | A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directo… |
CVE-2019-11729 | High | 7.5 | 2019-07-23 | Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This… |
CVE-2019-11728 | Medium | 4.7 | 2019-07-23 | The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that the accessible to a user when web content… |
CVE-2019-11727 | Medium | 5.3 | 2019-07-23 | A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only… |
CVE-2019-11725 | Medium | 6.5 | 2019-07-23 | When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation is interrupted but resources from the sam… |
CVE-2019-11724 | Medium | 6.1 | 2019-07-23 | Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been retired and now redirects to another si… |
CVE-2019-11723 | High | 7.5 | 2019-07-23 | A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookie… |
CVE-2019-11721 | Medium | 6.5 | 2019-07-23 | The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar. This allows for domain spoofing attacks as do not display as… |
CVE-2019-11720 | Medium | 6.1 | 2019-07-23 | Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This allows malicious cod… |
CVE-2019-11719 | High | 7.5 | 2019-07-23 | When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Servic… |
CVE-2019-11718 | Medium | 5.3 | 2019-07-23 | Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without saniti… |
CVE-2019-11717 | Medium | 5.3 | 2019-07-23 | A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible… |
CVE-2019-11716 | High | 8.3 | 2019-07-23 | Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNames(window). S… |
CVE-2019-11715 | Medium | 6.1 | 2019-07-23 | Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on web sites in certa… |
CVE-2019-11714 | Critical | 9.8 | 2019-07-23 | Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances. This vulnerability affects… |
CVE-2019-11713 | Critical | 9.8 | 2019-07-23 | A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash. This… |
CVE-2019-11712 | High | 8.8 | 2019-07-23 | POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to per… |
CVE-2019-11711 | High | 8.8 | 2019-07-23 | When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperative… |
CVE-2019-11710 | Critical | 9.8 | 2019-07-23 | Mozilla developers and community members reported memory safety bugs present in Firefox 67. Some of these bugs showed evidence of memory corruption and we pres… |
CVE-2019-11709 | Critical | 9.8 | 2019-07-23 | Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory c… |
CVE-2019-11708 | Critical | 10.0 | 2019-07-23 | Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process op… |
CVE-2019-11707 | High | 8.8 | 2019-07-23 | A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware… |
CVE-2019-11706 | High | 7.5 | 2019-07-23 | A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulti… |
CVE-2019-11705 | Critical | 9.8 | 2019-07-23 | A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in… |
CVE-2019-11704 | Critical | 9.8 | 2019-07-23 | A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting… |
CVE-2019-11703 | Critical | 9.8 | 2019-07-23 | A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a pot… |
CVE-2019-11702 | Medium | 6.5 | 2019-07-23 | A hyperlink using protocols associated with Internet Explorer, such as IE.HTTP:, can be used to open local files at a known location with Internet Explorer if… |
CVE-2019-11701 | Medium | 6.1 | 2019-07-23 | The default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks. This default was left in place as a legacy feature… |
CVE-2019-11700 | Medium | 6.5 | 2019-07-23 | A hyperlink using the res: protocol can be used to open local files at a known location in Internet Explorer if a user approves execution when prompted. *Note… |
CVE-2019-11699 | Medium | 6.5 | 2019-07-23 | A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page navigations. This could result in user con… |
CVE-2019-11698 | Medium | 5.3 | 2019-07-23 | If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web conten… |
CVE-2019-11697 | Medium | 6.5 | 2019-07-23 | If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that… |
CVE-2019-11696 | High | 7.8 | 2019-07-23 | Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though they can be execut… |
CVE-2019-11695 | Medium | 4.3 | 2019-07-23 | A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the… |
CVE-2019-11694 | High | 7.5 | 2019-07-23 | A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an… |
CVE-2019-11693 | Critical | 9.8 | 2019-07-23 | The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a… |
CVE-2019-11692 | Critical | 9.8 | 2019-07-23 | A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable… |
CVE-2019-11691 | Critical | 9.8 | 2019-07-23 | A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been fr… |