2019 CVEs (page 105)
Page 105 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1010221 | Medium | 6.8 | 2019-07-23 | LineageOS 16.0 and earlier is affected by: Incorrect Access Control. The impact is: The property checked by `adb root` can also be set in a normal adb shell se… |
CVE-2019-1010209 | High | 7.5 | 2019-07-23 | GoUrl.io GoURL Wordpress Plugin 1.4.13 and earlier is affected by: CWE-434. The impact is: unauthenticated/unzuthorized Attacker can upload executable file in… |
CVE-2019-1010208 | Low | 3.3 | 2019-07-23 | IDRIX, Truecrypt Veracrypt, Truecrypt Prior to 1.23-Hotfix-1 (Veracrypt), all versions (Truecrypt) is affected by: Buffer Overflow. The impact is: Minor inform… |
CVE-2019-1010207 | Medium | 6.1 | 2019-07-23 | Genetechsolutions Pie Register 3.0.15 is affected by: Cross Site Scripting (XSS). The impact is: Stealing of session cookies. The component is: File: Login. Pa… |
CVE-2019-1010206 | Medium | 5.9 | 2019-07-23 | OSS Http Request (Apache Cordova Plugin) 6 is affected by: Missing SSL certificate validation. The impact is: certificate spoofing. The component is: use this… |
CVE-2019-1010205 | High | 7.5 | 2019-07-23 | LINAGORA hublin latest (commit 72ead897082403126bf8df9264e70f0a9de247ff) is affected by: Directory Traversal. The impact is: The vulnerability allows an attack… |
CVE-2019-1010204 | Medium | 5.5 | 2019-07-23 | GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The… |
CVE-2019-1010202 | Medium | 6.5 | 2019-07-23 | Jeesite 1.2.7 is affected by: XML External Entity (XXE). The impact is: sensitive information disclosure. The component is: convertToModel() function in src/ma… |
CVE-2019-1010171 | High | 7.5 | 2019-07-23 | Jsish 2.4.83 2.0483 is affected by: Nullpointer dereference. The impact is: denial of service. The component is: function jsi_DumpFunctions (jsiEval.c:567). Th… |
CVE-2019-1010170 | High | 7.5 | 2019-07-23 | Jsish 2.4.77 2.0477 is affected by: Use After Free. The impact is: denial of service. The component is: function Jsi_ObjFree (jsiObj.c:230). The attack vector… |
CVE-2019-1010169 | High | 7.5 | 2019-07-23 | Jsish 2.4.77 2.0477 is affected by: Out-of-bounds Read. The impact is: denial of service. The component is: function lexer_getchar (jsiLexer.c:9). The attack v… |
CVE-2019-1010162 | Medium | 5.5 | 2019-07-23 | jsish 2.4.74 2.0474 is affected by: CWE-476: NULL Pointer Dereference. The impact is: denial of service. The component is: function Jsi_StrcmpDict (jsiChar.c:1… |
CVE-2019-1010155 | Critical | 9.1 | 2019-07-23 | D-Link DSL-2750U 1.11 is affected by: Authentication Bypass. The impact is: denial of service and information leakage. The component is: login. NOTE: Third par… |
CVE-2019-1010153 | Critical | 9.8 | 2019-07-23 | zzcms 8.3 and earlier is affected by: SQL Injection. The impact is: sql inject. The component is: zs/subzs.php. |
CVE-2019-1010152 | Critical | 9.8 | 2019-07-23 | zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/manage.php line 31-80. |
CVE-2019-1010150 | Critical | 9.8 | 2019-07-23 | zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/zssave.php. |
CVE-2019-1010149 | Critical | 9.8 | 2019-07-23 | zzcms version 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: zzcms File Delete to Code Execution. The component is: user/licence… |
CVE-2019-1010148 | Critical | 9.8 | 2019-07-23 | zzcms version 8.3 and earlier is affected by: SQL Injection. The impact is: zzcms File Delete to Code Execution. |
CVE-2019-14241 | High | 7.5 | 2019-07-23 | HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in proto_htx.c. |
CVE-2019-10173 | Critical | 9.8 | 2019-07-23 | It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been… |
CVE-2019-1010124 | Medium | 5.4 | 2019-07-23 | WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPres… |
CVE-2019-1010123 | High | 7.5 | 2019-07-23 | MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and… |
CVE-2019-14240 | High | 8.1 | 2019-07-23 | WCMS v0.3.2 has a CSRF vulnerability, with resultant directory traversal, to modify index.html via the /wex/html.php?finish=../index.html URI. |
CVE-2019-12552 | Medium | 5.5 | 2019-07-22 | In SweetScape 010 Editor 9.0.1, an integer overflow during the initialization of variables could allow an attacker to cause a denial of service. |
CVE-2019-12551 | Medium | 5.5 | 2019-07-22 | In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the Memcpy function (provided by the scripting engine) allow… |
CVE-2019-3414 | Medium | 4.8 | 2019-07-22 | All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain th… |
CVE-2019-12328 | Critical | 9.0 | 2019-07-22 | A command injection (missing input validation) issue in the remote phonebook configuration URI in the web interface of the Atcom A10W VoIP phone with firmware… |
CVE-2019-12327 | High | 7.2 | 2019-07-22 | Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get access to the device via telnet. The telnet service is running on port… |
CVE-2019-1010220 | Low | 3.3 | 2019-07-22 | tcpdump.org tcpdump 4.9.2 is affected by: CWE-126: Buffer Over-read. The impact is: May expose Saved Frame Pointer, Return Address etc. on stack. The component… |
CVE-2019-1010218 | High | 7.5 | 2019-07-22 | Cherokee Webserver Latest Cherokee Web server Upto Version 1.2.103 (Current stable) is affected by: Buffer Overflow - CWE-120. The impact is: Crash. The compon… |
CVE-2019-13097 | High | 7.5 | 2019-07-22 | The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are assumed to be immutable but are actually… |
CVE-2019-13096 | Critical | 9.8 | 2019-07-22 | TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure storage. An attacker can read and reuse the user keystore of a valid… |
CVE-2019-12326 | High | 7.2 | 2019-07-22 | Missing file and path validation in the ringtone upload function of the Akuvox R50P VoIP phone 50.0.6.156 allows an attacker to upload a manipulated ringtone f… |
CVE-2019-1010228 | Critical | 9.8 | 2019-07-22 | OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRL… |
CVE-2019-13100 | Medium | 6.5 | 2019-07-22 | The Send Anywhere application 9.4.18 for Android stores confidential information insecurely on the system (i.e., in cleartext), which allows a non-root user to… |
CVE-2019-13099 | Medium | 6.5 | 2019-07-22 | The Momo application 2.1.9 for Android stores confidential information insecurely on the system (i.e., in cleartext), which allows a non-root user to find out… |
CVE-2019-13098 | Medium | 6.5 | 2019-07-22 | The user password via the registration form of TronLink Wallet 2.2.0 is stored in the log when the class CreateWalletTwoActivity is called. Other authenticated… |
CVE-2019-12325 | High | 8.8 | 2019-07-22 | The Htek UC902 VoIP phone web management interface contains several buffer overflow vulnerabilities in the firmware version 2.0.4.4.46, which allow an attacker… |
CVE-2019-12324 | High | 7.2 | 2019-07-22 | A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP… |
CVE-2019-1010232 | Medium | 6.5 | 2019-07-22 | Juniper juniper/libslax libslax latest version (as of commit 084ddf6ab4a55b59dfa9a53f9c5f14d192c4f8e5 Commits on Sep 1, 2018) is affected by: Buffer Overflow… |
CVE-2019-9959 | Medium | 6.5 | 2019-07-22 | The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making i… |
CVE-2019-1010237 | Medium | 6.1 | 2019-07-22 | Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). The impact is: Execute code… |
CVE-2019-1010235 | Medium | 5.4 | 2019-07-22 | Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing… |
CVE-2019-1010234 | Critical | 9.8 | 2019-07-22 | The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely execute any commands by sending… |
CVE-2019-4267 | High | 7.8 | 2019-07-22 | The IBM Spectrum Protect 7.1 and 8.1 Backup-Archive Client is vulnerable to a buffer overflow. This could allow execution of arbitrary code on the local system… |
CVE-2019-4236 | Medium | 4.4 | 2019-07-22 | A IBM Spectrum Protect 7.l client backup or archive operation running for an HP-UX VxFS object is silently skipping Access Control List (ACL) entries from back… |
CVE-2019-2292 | High | 7.8 | 2019-07-22 | Out of bound access can occur due to buffer copy without checking size of input received from WLAN firmware in Snapdragon Auto, Snapdragon Consumer IOT, Snapdr… |
CVE-2019-2287 | Critical | 9.8 | 2019-07-22 | Improper validation for inputs received from firmware can lead to an out of bound write issue in video driver. in Snapdragon Auto, Snapdragon Compute, Snapdrag… |
CVE-2019-2279 | Critical | 9.8 | 2019-07-22 | Shared memory gets updated with invalid data and may lead to access beyond the allocated memory. in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consum… |
CVE-2019-2277 | High | 7.8 | 2019-07-22 | Out of bound read can happen due to lack of NULL termination on user controlled data in WLAN in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, S… |
CVE-2019-2269 | Critical | 9.8 | 2019-07-22 | Possible buffer overflow while processing the high level lim process action frame due to improper buffer length validation in Snapdragon Auto, Snapdragon Compu… |
CVE-2019-2264 | High | 7.8 | 2019-07-22 | Null pointer dereference occurs for channel context while opening glink channel in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voic… |
CVE-2019-2261 | Medium | 5.5 | 2019-07-22 | Unauthorized access from GPU subsystem to HLOS or other non secure subsystem memory can lead to information disclosure in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-2260 | High | 7.0 | 2019-07-22 | A race condition occurs while processing perf-event which can lead to a use after free condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IO… |
CVE-2019-2243 | Medium | 5.5 | 2019-07-22 | Possible buffer overflow at the end of iterating loop while getting the version info and lead to information disclosure. in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-14231 | Critical | 9.8 | 2019-07-21 | An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress. One could exploit the points parameter in the ob_get_results aja… |
CVE-2019-14230 | Critical | 9.8 | 2019-07-21 | An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the set_count ajax nopriv… |
CVE-2019-14215 | High | 7.5 | 2019-07-21 | An issue was discovered in Foxit PhantomPDF before 8.3.11. The application could crash when calling xfa.event.rest XFA JavaScript due to accessing a wild point… |
CVE-2019-14214 | High | 7.5 | 2019-07-21 | An issue was discovered in Foxit PhantomPDF before 8.3.10. The application could be exposed to a JavaScript Denial of Service when deleting pages in a document… |
CVE-2019-14213 | High | 7.5 | 2019-07-21 | An issue was discovered in Foxit PhantomPDF before 8.3.11. The application could crash due to the repeated release of the signature dictionary during CSG_Signa… |
CVE-2019-14212 | High | 7.5 | 2019-07-21 | An issue was discovered in Foxit PhantomPDF before 8.3.11. The application could crash when calling certain XFA JavaScript due to the use of, or access to, a N… |
CVE-2019-14211 | High | 7.5 | 2019-07-21 | An issue was discovered in Foxit PhantomPDF before 8.3.11. The application could crash due to the lack of proper validation of the existence of an object prior… |
CVE-2019-14210 | High | 7.5 | 2019-07-21 | An issue was discovered in Foxit PhantomPDF before 8.3.10. The application could be exposed to Memory Corruption due to the use of an invalid pointer copy, res… |
CVE-2019-14209 | Critical | 9.8 | 2019-07-21 | An issue was discovered in Foxit PhantomPDF before 8.3.10. The application could be exposed to Heap Corruption due to data desynchrony when adding AcroForm. |
CVE-2019-14208 | High | 7.5 | 2019-07-21 | An issue was discovered in Foxit PhantomPDF before 8.3.10. The application could be exposed to a NULL pointer dereference and crash when getting a PDF object f… |
CVE-2019-14207 | High | 7.5 | 2019-07-21 | An issue was discovered in Foxit PhantomPDF before 8.3.11. The application could crash when calling the clone function due to an endless loop resulting from co… |
CVE-2019-14206 | High | 7.5 | 2019-07-21 | An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via… |
CVE-2019-14205 | High | 7.5 | 2019-07-21 | A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via th… |
CVE-2019-9229 | High | 8.8 | 2019-07-20 | An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.251. An internal in… |
CVE-2019-12934 | High | 8.8 | 2019-07-20 | An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as d… |
CVE-2019-9228 | High | 7.5 | 2019-07-19 | An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A at least to 7.20A.252.062. Th… |
CVE-2019-13569 | Critical | 9.8 | 2019-07-19 | A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnera… |
CVE-2019-12815 | Critical | 9.8 | 2019-07-19 | An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a… |
CVE-2019-12725 | Critical | 9.8 | 2019-07-19 | Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP paramet… |
CVE-2019-1579 | High | 8.1 | 2019-07-19 | Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gatew… |
CVE-2019-11990 | High | 8.8 | 2019-07-19 | Security vulnerabilities in HPE UIoT versions 1.6, 1.5, 1.4.2, 1.4.1, 1.4.0, and 1.2.4.2 could allow unauthorized remote access and access to sensitive data. H… |
CVE-2019-11989 | Medium | 5.9 | 2019-07-19 | A security vulnerability in HPE IceWall SSO Agent Option and IceWall MFA (Agent module ) could be exploited remotely to cause a denial of service. The versions… |
CVE-2019-7590 | Medium | 6.7 | 2019-07-19 | ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to inser… |
CVE-2019-13991 | Medium | 6.5 | 2019-07-19 | Embedded systems based on Arduino before Rev3 allow remote attackers to send data to LEDs (directly connected to GPIO pins) via a laser, because of LED photose… |
CVE-2019-5680 | Medium | 6.7 | 2019-07-19 | In NVIDIA Jetson TX1 L4T R32 version branch prior to R32.2, Tegra bootloader contains a vulnerability in nvtboot in which the nvtboot-cpu image is loaded witho… |
CVE-2019-13989 | High | 7.8 | 2019-07-19 | dpic 2019.06.20 has a Stack-based Buffer Overflow in the wfloat() function in main.c. |
CVE-2019-12821 | Medium | 4.8 | 2019-07-19 | A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner, while adding a device to the account using a QR-code. The QR-code fol… |
CVE-2019-12820 | Medium | 5.6 | 2019-07-19 | A vulnerability was found in the app 2.0 of the Shenzhen Jisiwei i3 robot vacuum cleaner. Actions performed on the app such as changing a password, and persona… |
CVE-2019-12453 | Medium | 6.1 | 2019-07-19 | In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input validation. |
CVE-2019-11553 | High | 8.8 | 2019-07-19 | In Code42 for Enterprise through 6.8.4, an administrator without web restore permission but with the ability to manage users in an organization can impersonate… |
CVE-2019-1010241 | Medium | 6.5 | 2019-07-19 | Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can reco… |
CVE-2019-1010239 | High | 7.5 | 2019-07-19 | DaveGamble/cJSON cJSON 1.7.8 is affected by: Improper Check for Unusual or Exceptional Conditions. The impact is: Null dereference, so attack can cause denial… |
CVE-2019-1010238 | Critical | 9.8 | 2019-07-19 | Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is… |
CVE-2019-12193 | Critical | 9.8 | 2019-07-19 | H3C H3Cloud OS all versions allows SQL injection via the ear/grid_event sidx parameter. |
CVE-2019-1010142 | High | 7.5 | 2019-07-19 | scapy 2.4.0 is affected by: Denial of Service. The impact is: infinite loop, resource consumption and program unresponsive. The component is: _RADIUSAttrPacket… |
CVE-2019-1010136 | High | 7.5 | 2019-07-19 | ChinaMobile GPN2.4P21-C-CN W2001EN-00 is affected by: Incorrect Access Control - Unauthenticated Remote Reboot. The impact is: PLC Wireless Router's are vulner… |
CVE-2019-1010113 | Medium | 6.1 | 2019-07-19 | Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting (XSS). The impact is: An attacker might be able to inject arbitrary html and s… |
CVE-2019-1010101 | Critical | 9.8 | 2019-07-19 | Akeo Consulting Rufus 3.0 and earlier is affected by: Insecure Permissions. The impact is: arbitrary code execution with escalation of privilege. The component… |
CVE-2019-1010100 | High | 7.8 | 2019-07-19 | Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. The impact is: Arbitrary code execution WITH escalation of privilege. The com… |
CVE-2019-1167 | Medium | 4.1 | 2019-07-19 | A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement, aka 'Wi… |
CVE-2019-13984 | High | 8.8 | 2019-07-19 | Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded file, acce… |
CVE-2019-13983 | Critical | 9.8 | 2019-07-19 | Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth… |
CVE-2019-13982 | Medium | 5.3 | 2019-07-19 | interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview. |
CVE-2019-13981 | Medium | 5.3 | 2019-07-19 | In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ directory. This is re… |
CVE-2019-13980 | High | 8.8 | 2019-07-19 | In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads/_/originals remote code executi… |