2019 CVEs (page 107)
Page 107 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1010275 | Critical | 9.8 | 2019-07-17 | helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because self-signed… |
CVE-2019-1010266 | Medium | 6.5 | 2019-07-17 | lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attac… |
CVE-2019-1010263 | Critical | 9.8 | 2019-07-17 | Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. The impact is: allow attackers to bypass authentication by providing a token by crafti… |
CVE-2019-13619 | High | 7.5 | 2019-07-17 | In Wireshark 3.0.0 to 3.0.2, 2.6.0 to 2.6.9, and 2.4.0 to 2.4.15, the ASN.1 BER dissector and related dissectors could crash. This was addressed in epan/asn1.c… |
CVE-2019-13577 | Critical | 9.8 | 2019-07-17 | SnmpAdm.exe in MAPLE WBT SNMP Administrator v2.0.195.15 has an Unauthenticated Remote Buffer Overflow via a long string to the CE Remote feature listening on P… |
CVE-2019-13493 | Medium | 5.4 | 2019-07-17 | In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extens… |
CVE-2019-13448 | Medium | 6.1 | 2019-07-17 | An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could exploit the vulnerable func… |
CVE-2019-13447 | Critical | 9.8 | 2019-07-17 | An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could access the backend database… |
CVE-2019-12876 | High | 7.3 | 2019-07-17 | Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low… |
CVE-2019-11535 | Critical | 9.8 | 2019-07-17 | Unsanitized user input in the web interface for Linksys WiFi extender products (RE6400 and RE6300 through 1.2.04.022) allows for remote command execution. An a… |
CVE-2019-13631 | Medium | 6.8 | 2019-07-17 | In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an HID report that triggers an… |
CVE-2019-13585 | Critical | 9.8 | 2019-07-17 | The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 has a Buffer Overflow via a forged HTTP request. |
CVE-2019-13584 | Medium | 5.3 | 2019-07-17 | The remote admin webserver on FANUC Robotics Virtual Robot Controller 8.23 allows Directory Traversal via a forged HTTP request. |
CVE-2019-13614 | Critical | 9.8 | 2019-07-17 | CMD_SET_CONFIG_COUNTRY in the TP-Link Device Debug protocol in TP-Link Archer C1200 1.0.0 Build 20180502 rel.45702 and earlier is prone to a stack-based buffer… |
CVE-2019-13613 | Critical | 9.8 | 2019-07-17 | CMD_FTEST_CONFIG in the TP-Link Device Debug protocol in TP-Link Wireless Router Archer Router version 1.0.0 Build 20180502 rel.45702 (EU) and earlier is prone… |
CVE-2019-13403 | High | 7.5 | 2019-07-17 | Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit2.aspx, leading to the viewing of user information. |
CVE-2019-13346 | Medium | 6.1 | 2019-07-17 | In MyT 1.5.1, the User[username] parameter has XSS. |
CVE-2019-12475 | Medium | 6.1 | 2019-07-17 | In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation. |
CVE-2019-12175 | High | 7.5 | 2019-07-17 | In Zeek Network Security Monitor (formerly known as Bro) before 2.6.2, a NULL pointer dereference in the Kerberos (aka KRB) protocol parser leads to DoS becaus… |
CVE-2019-1010091 | Medium | 6.1 | 2019-07-17 | tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The compo… |
CVE-2019-13626 | Medium | 6.5 | 2019-07-17 | SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a heap-based buffer over-read in Fill_IMA_ADPCM_block, caused by an integer overflow in IMA_ADPCM_decode()… |
CVE-2019-13573 | Critical | 9.8 | 2019-07-17 | A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. Successful exploitation of this vuln… |
CVE-2019-10354 | Medium | 4.3 | 2019-07-17 | A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, by… |
CVE-2019-10353 | High | 7.5 | 2019-07-17 | CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection. |
CVE-2019-10352 | Medium | 6.5 | 2019-07-17 | A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attacke… |
CVE-2019-13453 | Medium | 6.5 | 2019-07-17 | Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to z… |
CVE-2019-4430 | High | 7.5 | 2019-07-17 | IBM Maximo Asset Management 7.6 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request con… |
CVE-2019-4211 | Medium | 5.4 | 2019-07-17 | IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri… |
CVE-2019-4194 | Medium | 4.3 | 2019-07-17 | IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 is missing function level access control that could allow a user to delete authorized resources. IB… |
CVE-2019-4054 | Low | 3.3 | 2019-07-17 | IBM QRadar SIEM 7.2 and 7.3 could allow a local user to obtain sensitive information when exporting content that could aid an attacker in further attacks again… |
CVE-2019-1010084 | Medium | 6.5 | 2019-07-17 | Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control. The impact is: Potential for unathorised access to data. The component is… |
CVE-2019-1010083 | High | 7.5 | 2019-07-17 | The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data… |
CVE-2019-13272 | High | 7.8 | 2019-07-17 | In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relati… |
CVE-2019-9849 | Medium | 4.3 | 2019-07-17 | LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default… |
CVE-2019-9848 | Critical | 9.8 | 2019-07-17 | LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffic… |
CVE-2019-13625 | Critical | 9.1 | 2019-07-17 | NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file. |
CVE-2019-13624 | Critical | 9.8 | 2019-07-17 | In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within strings that can be used in a… |
CVE-2019-13623 | High | 7.8 | 2019-07-17 | In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file… |
CVE-2019-3571 | Medium | 5.3 | 2019-07-16 | An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed wi… |
CVE-2019-9700 | Low | 3.9 | 2019-07-16 | Norton Password Manager, prior to 6.3.0.2082, may be susceptible to an address spoofing issue. This type of issue may allow an attacker to disguise their origi… |
CVE-2019-6160 | High | 8.8 | 2019-07-16 | A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API. |
CVE-2019-13359 | High | 7.5 | 2019-07-16 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory… |
CVE-2019-13115 | High | 8.1 | 2019-07-16 | In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read… |
CVE-2019-12992 | High | 8.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 6 of 6). |
CVE-2019-12991 | High | 8.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6). |
CVE-2019-12990 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal. |
CVE-2019-12989 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection. |
CVE-2019-12988 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 4 of 6). |
CVE-2019-12987 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 3 of 6). |
CVE-2019-12986 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 2 of 6). |
CVE-2019-12985 | Critical | 9.8 | 2019-07-16 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 1 of 6). |
CVE-2019-12834 | High | 7.3 | 2019-07-16 | In HT2 Labs Learning Locker 3.15.1, it's possible to inject malicious HTML and JavaScript code into the DOM of the website via the PATH_INFO to the dashboards/… |
CVE-2019-10191 | High | 7.5 | 2019-07-16 | A vulnerability was discovered in DNS resolver of knot resolver before version 4.1.0 which allows remote attackers to downgrade DNSSEC-secure domains to DNSSEC… |
CVE-2019-10190 | High | 7.5 | 2019-07-16 | A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers to bypass DNSSEC val… |
CVE-2019-13618 | High | 7.5 | 2019-07-16 | In GPAC before 0.8.0, isomedia/isom_read.c in libgpac.a has a heap-based buffer over-read, as demonstrated by a crash in gf_m2ts_sync in media_tools/mpegts.c. |
CVE-2019-13617 | Medium | 6.5 | 2019-07-16 | njs through 0.3.3, used in NGINX, has a heap-based buffer over-read in nxt_vsprintf in nxt/nxt_sprintf.c during error handling, as demonstrated by an njs_regex… |
CVE-2019-13616 | High | 8.1 | 2019-07-16 | SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_So… |
CVE-2019-13615 | Medium | 5.5 | 2019-07-16 | libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextE… |
CVE-2019-13605 | High | 8.8 | 2019-07-16 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the kno… |
CVE-2019-13603 | Medium | 5.9 | 2019-07-16 | An issue was discovered in the HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader Windows Biometric Framework driver 5.0.0.5. It h… |
CVE-2019-13383 | Medium | 5.3 | 2019-07-16 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP respon… |
CVE-2019-13360 | Critical | 9.8 | 2019-07-16 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid… |
CVE-2019-1576 | High | 8.8 | 2019-07-16 | Command injection in PAN-0S 9.0.2 and earlier may allow an authenticated attacker to gain access to a remote shell in PAN-OS, and potentially run with the esca… |
CVE-2019-1575 | High | 8.8 | 2019-07-16 | Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS 8.0.18 and earlier, PAN-OS 8.1.8-h4 and earlier, and PAN-OS 9.0.2 and earlier may allow for an auth… |
CVE-2019-1010292 | Critical | 9.8 | 2019-07-16 | Linaro/OP-TEE OP-TEE Prior to version v3.4.0 is affected by: Boundary checks. The impact is: This could lead to corruption of any memory which the TA can acces… |
CVE-2019-1010290 | Medium | 6.1 | 2019-07-16 | Babel: Multilingual site Babel All is affected by: Open Redirection. The impact is: Redirection to any URL, which is supplied to redirect.php in a "newurl" par… |
CVE-2019-1010043 | Critical | 9.8 | 2019-07-16 | Quake3e < 5ed740d is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Argument string creation. |
CVE-2019-13612 | High | 7.5 | 2019-07-16 | MDaemon Email Server 19 through 20.0.1 skips SpamAssassin checks by default for e-mail messages larger than 2 MB (and limits checks to 10 MB even with special… |
CVE-2019-1010062 | Critical | 9.8 | 2019-07-16 | PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/ima… |
CVE-2019-1010060 | Critical | 9.8 | 2019-07-16 | NASA CFITSIO prior to 3.43 is affected by: Buffer Overflow. The impact is: arbitrary code execution. The component is: over 40 source code files were changed… |
CVE-2019-1010057 | High | 7.8 | 2019-07-16 | nfdump 1.6.16 and earlier is affected by: Buffer Overflow. The impact is: The impact could range from a denial of service to local code execution. The componen… |
CVE-2019-1010018 | Medium | 6.1 | 2019-07-16 | Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The compone… |
CVE-2019-13611 | High | 8.8 | 2019-07-16 | An issue was discovered in python-engineio through 3.8.2. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSock… |
CVE-2019-0234 | Medium | 6.1 | 2019-07-15 | A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and coul… |
CVE-2019-6827 | High | 7.8 | 2019-07-15 | A CWE-787: Out-of-bounds Write vulnerability exists in Interactive Graphical SCADA System (IGSS), Version 14 and prior, which could cause a software crash when… |
CVE-2019-6825 | High | 7.8 | 2019-07-15 | A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow a malicious DLL file, with… |
CVE-2019-6824 | Critical | 9.8 | 2019-07-15 | A CWE-119: Buffer Errors vulnerability exists in ProClima (all versions prior to version 8.0.0) which allows an unauthenticated, remote attacker to execute arb… |
CVE-2019-6823 | Critical | 9.8 | 2019-07-15 | A CWE-94: Code Injection vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow an unauthenticated, remote attacker to execut… |
CVE-2019-6822 | High | 7.8 | 2019-07-15 | A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a specially crafted Zeli… |
CVE-2019-1137 | Medium | 5.4 | 2019-07-15 | A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exch… |
CVE-2019-1136 | High | 8.1 | 2019-07-15 | An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. |
CVE-2019-1134 | Medium | 5.4 | 2019-07-15 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2019-1132 | High | 7.8 | 2019-07-15 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil… |
CVE-2019-1130 | High | 7.8 | 2019-07-15 | An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privileg… |
CVE-2019-1129 | High | 7.8 | 2019-07-15 | An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privileg… |
CVE-2019-1128 | High | 8.8 | 2019-07-15 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This… |
CVE-2019-1127 | High | 8.8 | 2019-07-15 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This… |
CVE-2019-1126 | Medium | 5.3 | 2019-07-15 | A security feature bypass vulnerability exists in Active Directory Federation Services (ADFS) which could allow an attacker to bypass the extranet lockout poli… |
CVE-2019-1124 | High | 8.8 | 2019-07-15 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This… |
CVE-2019-1123 | High | 8.8 | 2019-07-15 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This… |
CVE-2019-1122 | High | 8.8 | 2019-07-15 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This… |
CVE-2019-1121 | High | 8.8 | 2019-07-15 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This… |
CVE-2019-1120 | High | 8.8 | 2019-07-15 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This… |
CVE-2019-1119 | High | 8.8 | 2019-07-15 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This… |
CVE-2019-1118 | High | 8.8 | 2019-07-15 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This… |
CVE-2019-1117 | High | 8.8 | 2019-07-15 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This… |
CVE-2019-1116 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1113 | High | 8.8 | 2019-07-15 | A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploit… |
CVE-2019-1112 | Medium | 5.5 | 2019-07-15 | An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosur… |
CVE-2019-1111 | High | 8.8 | 2019-07-15 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |