2019 CVEs (page 106)
Page 106 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-13979 | High | 8.8 | 2019-07-19 | In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/_/originals remote code execution. |
CVE-2019-1010247 | Medium | 6.1 | 2019-07-19 | ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or inter… |
CVE-2019-1010245 | Critical | 9.8 | 2019-07-19 | The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impact is: A remote attacker can execute arbi… |
CVE-2019-12946 | High | 7.5 | 2019-07-19 | Elcom CMS before 10.7 has SQL Injection via EventSearchByState.aspx and EventSearchAdv.aspx. |
CVE-2019-11552 | High | 7.0 | 2019-07-19 | Code42 Enterprise and Crashplan for Small Business Client version 6.7 before 6.7.5, 6.8 before 6.8.8, and 6.9 before 6.9.4 allows eval injection. A proxy auto-… |
CVE-2019-1010151 | Critical | 9.8 | 2019-07-19 | zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. The impact is: getshell. The component is: /user/ppsave.php. |
CVE-2019-13648 | Medium | 5.5 | 2019-07-19 | In the Linux kernel through 5.2.1 on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad T… |
CVE-2019-13978 | High | 8.8 | 2019-07-19 | Ovidentia 8.4.3 has SQL Injection via the id parameter in an index.php?tg=delegat&idx=mem request. |
CVE-2019-13977 | Medium | 5.4 | 2019-07-19 | index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=create, tg=site&item=4, tg=admdir&idx=mdb&i… |
CVE-2019-13974 | High | 8.8 | 2019-07-19 | LayerBB 1.1.3 allows conversations.php/cmd/new CSRF. |
CVE-2019-13973 | Critical | 9.8 | 2019-07-19 | LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the custom_logo filename suffix is not restricted, and .php may be used. |
CVE-2019-13972 | Medium | 6.1 | 2019-07-19 | LayerBB 1.1.3 allows XSS via the application/commands/new.php pm_title variable, a related issue to CVE-2019-17997. |
CVE-2019-13971 | Medium | 6.1 | 2019-07-19 | OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request. |
CVE-2019-13970 | Medium | 6.1 | 2019-07-19 | In antSword before 2.1.0, self-XSS in the database configuration leads to code execution via modules/database/asp/index.js, modules/database/custom/index.js, m… |
CVE-2019-13969 | High | 8.8 | 2019-07-19 | Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=ui_set&m=admin&c=index&a=doget_text_content&table=lang&field=1 request. |
CVE-2019-7963 | Medium | 6.5 | 2019-07-18 | Adobe Bridge CC version 9.0.2 and earlier versions have an out of bound read vulnerability. Successful exploitation could lead to Information Disclosure in the… |
CVE-2019-7956 | High | 7.8 | 2019-07-18 | Adobe Dreamweaver direct download installer versions 19.0 and below, 18.0 and below have an Insecure Library Loading (DLL hijacking) vulnerability. Successful… |
CVE-2019-7955 | Medium | 6.1 | 2019-07-18 | Adobe Experience Manager version 6.4 and ealier have a Reflected Cross-site Scripting vulnerability. Successful exploitation could lead to Sensitive Informatio… |
CVE-2019-7954 | Medium | 6.1 | 2019-07-18 | Adobe Experience Manager version 6.4 and ealier have a Stored Cross-site Scripting vulnerability. Successful exploitation could lead to Sensitive Information d… |
CVE-2019-7953 | Medium | 6.5 | 2019-07-18 | Adobe Experience Manager version 6.4 and ealier have a Cross-Site Request Forgery vulnerability. Successful exploitation could lead to Sensitive Information di… |
CVE-2019-7941 | High | 7.5 | 2019-07-18 | Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Information Exposure Through an Error Message vulnerability. Successful exploitation c… |
CVE-2019-7850 | Critical | 9.8 | 2019-07-18 | Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Successful exploitation could lead to Arbitrary Code E… |
CVE-2019-7848 | High | 7.5 | 2019-07-18 | Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Inadequate access control vulnerability. Successful exploitation could lead to Informa… |
CVE-2019-7847 | High | 7.5 | 2019-07-18 | Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper Restriction of XML External Entity Reference ('XXE') vulnerability. Successfu… |
CVE-2019-7846 | High | 7.5 | 2019-07-18 | Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper error handling vulnerability. Successful exploitation could lead to Informati… |
CVE-2019-7843 | High | 7.5 | 2019-07-18 | Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Insufficient input validation vulnerability. Successful exploitation could lead to Inf… |
CVE-2019-13962 | Critical | 9.8 | 2019-07-18 | lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly val… |
CVE-2019-13961 | High | 8.8 | 2019-07-18 | A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files.upload-script.php. |
CVE-2019-8286 | Medium | 4.3 | 2019-07-18 | Information Disclosure in Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security versions up to 2019 could potentially disclose unique Pro… |
CVE-2019-13960 | Medium | 5.5 | 2019-07-18 | In libjpeg-turbo 2.0.2, a large amount of memory can be used during processing of an invalid progressive JPEG image containing incorrect width and height value… |
CVE-2019-13959 | Medium | 6.5 | 2019-07-18 | In Bento4 1.5.1-627, AP4_DataBuffer::SetDataSize does not handle reallocation failures, leading to a memory copy into a NULL pointer. This is different from CV… |
CVE-2019-1010279 | High | 7.5 | 2019-07-18 | Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass. The impact is: An attacker… |
CVE-2019-1010246 | High | 7.5 | 2019-07-18 | MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQ… |
CVE-2019-1010112 | High | 8.8 | 2019-07-18 | OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery (CSRF). The impact is: The victim clicks on adding an administrator account. The co… |
CVE-2019-3592 | High | 7.2 | 2019-07-18 | Privilege escalation vulnerability in McAfee Agent (MA) before 5.6.1 HF3, allows local administrator users to potentially disable some McAfee processes by mani… |
CVE-2019-13956 | Critical | 9.8 | 2019-07-18 | Discuz!ML 3.2 through 3.4 allows remote attackers to execute arbitrary PHP code via a modified language cookie, as demonstrated by changing 4gH4_0df5_language=… |
CVE-2019-1010252 | Medium | 4.9 | 2019-07-18 | The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended… |
CVE-2019-1010251 | High | 7.5 | 2019-07-18 | Open Information Security Foundation Suricata prior to version 4.1.2 is affected by: Denial of Service - DNS detection bypass. The impact is: An attacker can e… |
CVE-2019-1010250 | Medium | 4.9 | 2019-07-18 | The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended… |
CVE-2019-1010249 | Medium | 4.9 | 2019-07-18 | The Linux Foundation ONOS 2.0.0 and earlier is affected by: Integer Overflow. The impact is: A network administrator (or attacker) can install unintended flow… |
CVE-2019-1010248 | Critical | 9.8 | 2019-07-18 | Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. The impact is: Unauthenticated mysql database access. The component is: Web login form. Th… |
CVE-2019-13952 | Critical | 9.8 | 2019-07-18 | The set_ipv6() function in zscan_rfc1035.rl in gdnsd before 2.4.3 and 3.x before 3.2.1 has a stack-based buffer overflow via a long and malformed IPv6 address… |
CVE-2019-13951 | Critical | 9.8 | 2019-07-18 | The set_ipv4() function in zscan_rfc1035.rl in gdnsd 3.x before 3.2.1 has a stack-based buffer overflow via a long and malformed IPv4 address in zone data. |
CVE-2019-11230 | Medium | 4.4 | 2019-07-18 | In Avast Antivirus before 19.4, a local administrator can trick the product into renaming arbitrary files by replacing the Logs\Update.log file with a symlink… |
CVE-2019-1010268 | Critical | 9.8 | 2019-07-18 | Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). The impact is: Information Disclosure, reading fi… |
CVE-2019-1010261 | Medium | 6.1 | 2019-07-18 | Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The compone… |
CVE-2019-1010259 | Critical | 9.8 | 2019-07-18 | SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. I… |
CVE-2019-1010065 | Medium | 6.5 | 2019-07-18 | The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. The impact is: Opening crafted disk image triggers crash in tsk/fs/hfs_dent.c:237. The compo… |
CVE-2019-9231 | High | 8.8 | 2019-07-18 | An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions before 7.20A.202.307. A Cross-Site R… |
CVE-2019-3794 | Medium | 5.4 | 2019-07-18 | Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UA… |
CVE-2019-3741 | High | 7.8 | 2019-07-18 | Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain a plain-text password storage vulnerability. A Unisphere user’s (including the admin privil… |
CVE-2019-3734 | Medium | 5.4 | 2019-07-18 | Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain an improper authorization vulnerability in NAS Server quotas configuration. A remote authen… |
CVE-2019-3570 | Critical | 9.8 | 2019-07-18 | Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p). This happens if the parameters are… |
CVE-2019-13950 | Medium | 5.4 | 2019-07-18 | index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment. |
CVE-2019-13949 | High | 8.8 | 2019-07-18 | SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change. |
CVE-2019-13948 | Medium | 5.4 | 2019-07-18 | SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does not properly block XSS payloads, as demonstrated by… |
CVE-2019-13509 | High | 7.5 | 2019-07-18 | In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add sec… |
CVE-2019-1010104 | Critical | 9.8 | 2019-07-18 | TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection. The impact is: Access to the database. The component is: like_escape… |
CVE-2019-9230 | Medium | 6.1 | 2019-07-18 | An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.253. A cross-site s… |
CVE-2019-13915 | High | 7.5 | 2019-07-18 | b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files. First, the attacker can write code in the editor, and compile and run it appro… |
CVE-2019-13607 | Medium | 6.1 | 2019-07-18 | The Opera Mini application through 16.0.14 for iOS has a UXSS vulnerability that can be triggered by performing navigation to a javascript: URL. |
CVE-2019-13575 | Critical | 9.8 | 2019-07-18 | A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Successful exploitation of this vulnerability would allow a… |
CVE-2019-1010069 | Medium | 5.5 | 2019-07-18 | moinejf abcm2ps 8.13.20 is affected by: Incorrect Access Control. The impact is: Allows attackers to cause a denial of service attack via a crafted file. The c… |
CVE-2019-1010066 | High | 7.5 | 2019-07-18 | Lawrence Livermore National Laboratory msr-safe v1.1.0 is affected by: Incorrect Access Control. The impact is: An attacker could modify model specific registe… |
CVE-2019-1010096 | High | 8.8 | 2019-07-18 | DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change the read-only user to admin… |
CVE-2019-1010095 | High | 8.8 | 2019-07-18 | DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can add the administrator account. The c… |
CVE-2019-1010094 | High | 8.8 | 2019-07-18 | domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerability that can change admin password. The component… |
CVE-2019-1010054 | High | 8.8 | 2019-07-18 | Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable passwo… |
CVE-2019-13647 | Medium | 5.4 | 2019-07-18 | Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed… |
CVE-2019-13646 | Medium | 5.4 | 2019-07-18 | Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query. NOTE: It is asserted that an atta… |
CVE-2019-13645 | Medium | 5.4 | 2019-07-18 | Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript code is executed du… |
CVE-2019-13644 | Medium | 5.4 | 2019-07-18 | Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a… |
CVE-2019-13643 | Medium | 6.1 | 2019-07-18 | Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack b… |
CVE-2019-5222 | Medium | 5.5 | 2019-07-17 | There is an information disclosure vulnerability on Secure Input of certain Huawei smartphones in Versions earlier than Tony-AL00B 9.1.0.216(C00E214R2P1). The… |
CVE-2019-13640 | Critical | 9.8 | 2019-07-17 | In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in… |
CVE-2019-8932 | High | 7.5 | 2019-07-17 | Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application. |
CVE-2019-8931 | High | 7.5 | 2019-07-17 | Redbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail, Outlook, etc.) used in the application. |
CVE-2019-3973 | Medium | 5.5 | 2019-07-17 | Comodo Antivirus versions 11.0.0.6582 and below are vulnerable to Denial of Service affecting CmdGuard.sys via its filter port "cmdServicePort". A low privileg… |
CVE-2019-3972 | Medium | 5.5 | 2019-07-17 | Comodo Antivirus versions 12.0.0.6810 and below are vulnerable to Denial of Service affecting CmdAgent.exe via an unprotected section object "<GUID>_CisSharedM… |
CVE-2019-3971 | Medium | 5.5 | 2019-07-17 | Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to a local Denial of Service affecting CmdVirth.exe via its LPC port "cmdvrtLPCServerPort". A low pr… |
CVE-2019-3970 | Medium | 5.5 | 2019-07-17 | Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to Arbitrary File Write due to Cavwp.exe handling of Comodo's Antivirus database. Cavwp.exe loads Co… |
CVE-2019-3969 | High | 7.8 | 2019-07-17 | Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to Local Privilege Escalation due to CmdAgent's handling of COM clients. A local process can bypass… |
CVE-2019-1943 | Medium | 4.7 | 2019-07-17 | A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Switches software could allow an unauthenticated, remote attacker to redi… |
CVE-2019-1942 | Medium | 4.3 | 2019-07-17 | A vulnerability in the sponsor portal web interface for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to impact the integr… |
CVE-2019-1941 | Medium | 6.1 | 2019-07-17 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2019-1940 | Medium | 5.9 | 2019-07-17 | A vulnerability in the Web Services Management Agent (WSMA) feature of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker… |
CVE-2019-1923 | Medium | 6.6 | 2019-07-17 | A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vu… |
CVE-2019-1920 | High | 7.4 | 2019-07-17 | A vulnerability in the 802.11r Fast Transition (FT) implementation for Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker… |
CVE-2019-1919 | High | 8.4 | 2019-07-17 | A vulnerability in the Cisco FindIT Network Management Software virtual machine (VM) images could allow an unauthenticated, local attacker who has access to th… |
CVE-2019-1917 | Critical | 9.1 | 2019-07-17 | A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on… |
CVE-2019-13637 | High | 8.8 | 2019-07-17 | In LogMeIn join.me before 3.16.0.5505, an attacker could execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used… |
CVE-2019-13636 | Medium | 5.9 | 2019-07-17 | In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c. |
CVE-2019-12914 | High | 7.5 | 2019-07-17 | Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application. |
CVE-2019-12913 | Medium | 5.5 | 2019-07-17 | Redbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail, Outlook, etc.) used in the application. |
CVE-2019-12912 | Medium | 5.5 | 2019-07-17 | Redbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail, Outlook, etc.) used in the application. |
CVE-2019-12911 | High | 7.5 | 2019-07-17 | Redbrick Shift through 3.4.3 allows an attacker to extract authentication tokens of services (such as Gmail, Outlook, etc.) used in the application. |
CVE-2019-11772 | Critical | 9.8 | 2019-07-17 | In Eclipse OpenJ9 prior to 0.15, the String.getBytes(int, int, byte[], int) method does not verify that the provided byte array is non-null nor that the provid… |
CVE-2019-11771 | High | 7.8 | 2019-07-17 | AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users. |
CVE-2019-1010287 | Medium | 6.1 | 2019-07-17 | Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript cod… |
CVE-2019-1010283 | High | 7.5 | 2019-07-17 | Univention Corporate Server univention-directory-notifier 12.0.1-3 and earlier is affected by: CWE-213: Intentional Information Exposure. The impact is: Loss o… |