2019 CVEs (page 108)
Page 108 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1110 | High | 8.8 | 2019-07-15 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
CVE-2019-1109 | Critical | 9.1 | 2019-07-15 | A spoofing vulnerability exists when Microsoft Office Javascript does not check the validity of the web page making a request to Office documents.An attacker w… |
CVE-2019-1108 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows RDP client improperly discloses the contents of its memory, aka 'Remote Desktop Protocol Client… |
CVE-2019-1107 | High | 7.5 | 2019-07-15 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
CVE-2019-1106 | High | 7.5 | 2019-07-15 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
CVE-2019-1104 | High | 7.5 | 2019-07-15 | A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft Browser Memory Corruption Vulnerabilit… |
CVE-2019-1103 | High | 7.5 | 2019-07-15 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
CVE-2019-1102 | High | 8.8 | 2019-07-15 | A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code E… |
CVE-2019-1101 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1100 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1099 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1098 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1097 | Medium | 5.5 | 2019-07-15 | An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulner… |
CVE-2019-1096 | Medium | 5.5 | 2019-07-15 | An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerabili… |
CVE-2019-1095 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1094 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1093 | Medium | 5.5 | 2019-07-15 | An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulner… |
CVE-2019-1092 | High | 7.5 | 2019-07-15 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
CVE-2019-1091 | Medium | 5.5 | 2019-07-15 | An information disclosure vulnerability exists when Unistore.dll fails to properly handle objects in memory, aka 'Microsoft unistore.dll Information Disclosure… |
CVE-2019-1090 | High | 7.8 | 2019-07-15 | An elevation of privilege vulnerability exists in the way that the dnsrslvr.dll handles objects in memory, aka 'Windows dnsrlvr.dll Elevation of Privilege Vuln… |
CVE-2019-1089 | High | 7.8 | 2019-07-15 | An elevation of privilege vulnerability exists in rpcss.dll when the RPC service Activation Kernel improperly handles an RPC request. To exploit this vulnerabi… |
CVE-2019-1088 | High | 7.8 | 2019-07-15 | An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-201… |
CVE-2019-1087 | High | 7.8 | 2019-07-15 | An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-201… |
CVE-2019-1086 | High | 7.8 | 2019-07-15 | An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-201… |
CVE-2019-1085 | High | 7.8 | 2019-07-15 | An elevation of privilege vulnerability exists in the way that the wlansvc.dll handles objects in memory, aka 'Windows WLAN Service Elevation of Privilege Vuln… |
CVE-2019-1084 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated a… |
CVE-2019-1083 | High | 7.5 | 2019-07-15 | A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests, aka '.NET Denial of Service Vulnerabilit… |
CVE-2019-1082 | High | 7.8 | 2019-07-15 | An elevation of privilege vulnerability exists in Microsoft Windows where a certain DLL, with Local Service privilege, is vulnerable to race planting a customi… |
CVE-2019-1079 | Medium | 6.5 | 2019-07-15 | An information disclosure vulnerability exists when Visual Studio improperly parses XML input in certain settings files, aka 'Visual Studio Information Disclos… |
CVE-2019-1077 | Medium | 5.0 | 2019-07-15 | An elevation of privilege vulnerability exists when the Visual Studio updater service improperly handles file permissions, aka 'Visual Studio Elevation of Priv… |
CVE-2019-1076 | Medium | 5.4 | 2019-07-15 | A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross… |
CVE-2019-1075 | Medium | 6.1 | 2019-07-15 | A spoofing vulnerability exists in ASP.NET Core that could lead to an open redirect, aka 'ASP.NET Core Spoofing Vulnerability'. |
CVE-2019-1074 | Medium | 5.5 | 2019-07-15 | An elevation of privilege vulnerability exists in Microsoft Windows where certain folders, with local service privilege, are vulnerable to symbolic link attack… |
CVE-2019-1073 | Medium | 5.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera… |
CVE-2019-1072 | Critical | 9.8 | 2019-07-15 | A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server a… |
CVE-2019-1071 | Medium | 5.5 | 2019-07-15 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera… |
CVE-2019-1068 | High | 8.8 | 2019-07-15 | A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Re… |
CVE-2019-1067 | High | 7.8 | 2019-07-15 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege V… |
CVE-2019-1063 | High | 7.5 | 2019-07-15 | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerabili… |
CVE-2019-1062 | High | 7.5 | 2019-07-15 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
CVE-2019-1059 | High | 7.5 | 2019-07-15 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory… |
CVE-2019-1056 | High | 7.5 | 2019-07-15 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory… |
CVE-2019-1037 | High | 7.0 | 2019-07-15 | An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vuln… |
CVE-2019-1006 | High | 7.5 | 2019-07-15 | An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens… |
CVE-2019-1004 | High | 7.5 | 2019-07-15 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory… |
CVE-2019-1001 | High | 7.5 | 2019-07-15 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corr… |
CVE-2019-0999 | High | 7.8 | 2019-07-15 | An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulnerability'. |
CVE-2019-0975 | Medium | 6.3 | 2019-07-15 | A security feature bypass vulnerability exists when Active Directory Federation Services (ADFS) improperly updates its list of banned IP addresses. To exploit… |
CVE-2019-0966 | Medium | 6.8 | 2019-07-15 | A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating s… |
CVE-2019-0962 | Medium | 4.9 | 2019-07-15 | An elevation of privilege vulnerability exists in Azure Automation "RunAs account" runbooks for users with contributor role, aka 'Azure Automation Elevation of… |
CVE-2019-0887 | High | 8.0 | 2019-07-15 | A remote code execution vulnerability exists in Remote Desktop Services - formerly known as Terminal Services - when an authenticated attacker abuses clipboard… |
CVE-2019-0880 | High | 7.8 | 2019-07-15 | A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'. |
CVE-2019-0865 | High | 7.5 | 2019-07-15 | A denial of service vulnerability exists when SymCrypt improperly handles a specially crafted digital signature.An attacker could exploit the vulnerability by… |
CVE-2019-0811 | High | 7.5 | 2019-07-15 | A denial of service vulnerability exists in Windows DNS Server when it fails to properly handle DNS queries, aka 'Windows DNS Server Denial of Service Vulnerab… |
CVE-2019-0785 | Critical | 9.8 | 2019-07-15 | A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP failover server, aka 'Wi… |
CVE-2019-5447 | Medium | 5.3 | 2019-07-15 | A path traversal vulnerability in <= v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders. |
CVE-2019-1010308 | Critical | 9.8 | 2019-07-15 | Aquaverde GmbH Aquarius CMS prior to version 4.1.1 is affected by: Incorrect Access Control. The impact is: The access to the log file is not restricted. It co… |
CVE-2019-1010307 | Medium | 5.4 | 2019-07-15 | GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting (XSS). The impact is: All dropdown values are vulnerable to XSS leading to privilege escalation an… |
CVE-2019-1010302 | Medium | 5.5 | 2019-07-15 | jhead 3.03 is affected by: Incorrect Access Control. The impact is: Denial of service. The component is: iptc.c Line 122 show_IPTC(). The attack vector is: the… |
CVE-2019-1010301 | Medium | 5.5 | 2019-07-15 | jhead 3.03 is affected by: Buffer Overflow. The impact is: Denial of service. The component is: gpsinfo.c Line 151 ProcessGpsInfo(). The attack vector is: Open… |
CVE-2019-1010300 | High | 7.5 | 2019-07-15 | mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. The impact is: Software crash. The component is: server_example_complex_array. The… |
CVE-2019-1010299 | Medium | 5.3 | 2019-07-15 | The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory… |
CVE-2019-1010298 | Critical | 9.8 | 2019-07-15 | Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in the context of TEE core (kernel). The component is: op… |
CVE-2019-1010297 | Critical | 9.8 | 2019-07-15 | Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Execution of code in TEE core (kernel) context. The component is: optee_… |
CVE-2019-1010296 | Critical | 9.8 | 2019-07-15 | Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in context of TEE core (kernel). The component is: optee_… |
CVE-2019-1010295 | Critical | 9.8 | 2019-07-15 | Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Memory corruption and disclosure of memory content. The component is: op… |
CVE-2019-1010294 | High | 7.5 | 2019-07-15 | Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Rounding error. The impact is: Potentially leaking code and/or data from previous Trusted Application. T… |
CVE-2019-1010293 | Critical | 9.8 | 2019-07-15 | Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Boundary crossing. The impact is: Memory corruption of the TEE itself. The component is: optee_os. The f… |
CVE-2019-1010044 | Critical | 9.8 | 2019-07-15 | borg-reducer c6d5240 is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Output parameter within t… |
CVE-2019-1010306 | Critical | 9.8 | 2019-07-15 | Slanger 0.6.0 is affected by: Remote Code Execution (RCE). The impact is: A remote attacker can execute arbitrary commands by sending a crafted request to the… |
CVE-2019-1010305 | Medium | 5.5 | 2019-07-15 | libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file l… |
CVE-2019-1010304 | Medium | 5.3 | 2019-07-15 | Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorr… |
CVE-2019-13604 | Medium | 5.9 | 2019-07-15 | There is a short key vulnerability in HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader v24. The key for obfuscating the fingerpr… |
CVE-2019-1010039 | Critical | 9.8 | 2019-07-15 | uLaunchELF < commit 170827a is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Loader program (lo… |
CVE-2019-1010038 | Critical | 9.8 | 2019-07-15 | OpenModelica OMCompiler is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: OPENMODELICAHOME param… |
CVE-2019-1010034 | Medium | 6.5 | 2019-07-15 | Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBa… |
CVE-2019-1010028 | Medium | 6.1 | 2019-07-15 | phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attack administrators and… |
CVE-2019-1010025 | Medium | 5.3 | 2019-07-15 | GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NO… |
CVE-2019-1010024 | Medium | 5.3 | 2019-07-15 | GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE… |
CVE-2019-1010023 | Medium | 5.4 | 2019-07-15 | GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The… |
CVE-2019-1010022 | Critical | 9.8 | 2019-07-15 | GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Ex… |
CVE-2019-1010017 | High | 7.5 | 2019-07-15 | libnmap < v0.6.3 is affected by: XML Injection. The impact is: Denial of service (DoS) by consuming resources. The component is: XML Parsing. The attack vector… |
CVE-2019-1010016 | Medium | 6.1 | 2019-07-15 | Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector i… |
CVE-2019-1010009 | Critical | 9.8 | 2019-07-15 | DGLogik Inc DGLux Server All Versions is affected by: Insecure Permissions. The impact is: Remote Execution, Credential Leaks. The component is: IoT API. The a… |
CVE-2019-1010008 | Medium | 5.4 | 2019-07-15 | OpenEnergyMonitor Project Emoncms 9.8.8 is affected by: Cross Site Scripting (XSS). The impact is: Theoretically low, but might potentially enable persistent X… |
CVE-2019-1010006 | High | 7.8 | 2019-07-15 | Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector i… |
CVE-2019-1010005 | Medium | 6.1 | 2019-07-15 | HexoEditor v1.1.8-beta is affected by: XSS to code execution. |
CVE-2019-1010004 | Medium | 5.5 | 2019-07-15 | SoX - Sound eXchange 14.4.2 and earlier is affected by: Out-of-bounds Read. The impact is: Denial of Service. The component is: read_samples function at xa.c:2… |
CVE-2019-13602 | High | 7.8 | 2019-07-14 | An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial… |
CVE-2019-13598 | Critical | 9.8 | 2019-07-14 | LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port_3480/data_re… |
CVE-2019-13597 | Critical | 9.8 | 2019-07-14 | _s_/sprm/_s_/dyn/Player_setScriptFile in Sahi Pro 8.0.0 allows command execution. It allows one to run ".sah" scripts via Sahi Launcher. Also, one can create a… |
CVE-2019-13594 | High | 8.8 | 2019-07-14 | In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid… |
CVE-2019-13590 | Medium | 5.5 | 2019-07-14 | An issue was discovered in libsox.a in SoX 14.4.2. In sox-fmt.h (startread function), there is an integer overflow on the result of integer addition (wraparoun… |
CVE-2019-13589 | Critical | 9.8 | 2019-07-14 | The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without th… |
CVE-2019-5629 | High | 7.8 | 2019-07-13 | Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Age… |
CVE-2019-13161 | Medium | 5.3 | 2019-07-12 | An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-ce… |
CVE-2019-12827 | Medium | 6.5 | 2019-07-12 | Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash… |
CVE-2019-11242 | High | 8.1 | 2019-07-12 | A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prior to 6.1.1c. Cohesity clusters did not v… |
CVE-2019-1010310 | Low | 3.5 | 2019-07-12 | GLPI GLPI Product 9.3.1 is affected by: Frame and Form tags Injection allowing admins to phish users by putting code in reminder description. The impact is: Ad… |
CVE-2019-12731 | High | 7.8 | 2019-07-12 | The Windows versions of Snapview Mikogo, versions before 5.10.2 are affected by insecure implementations which allow local attackers to escalate privileges. |