2019 CVEs (page 109)
Page 109 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-8998 | High | 7.8 | 2019-07-12 | An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the /proc filesystem) of BlackBerry QNX Sof… |
CVE-2019-13027 | Critical | 9.8 | 2019-07-12 | Realization Concerto Critical Chain Planner (aka CCPM) 5.10.8071 has SQL Injection in at least in the taskupdt/taskdetails.aspx webpage via the projectname par… |
CVE-2019-11360 | Medium | 4.2 | 2019-07-12 | A buffer overflow in iptables-restore in netfilter iptables 1.8.2 allows an attacker to (at least) crash the program or potentially gain code execution via a s… |
CVE-2019-13567 | High | 8.8 | 2019-07-12 | The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon (aka the h… |
CVE-2019-13494 | High | 7.8 | 2019-07-12 | nodeimp.exe in Castle Rock SNMPc before 9.0.12.1 and 10.x before 10.0.9 has a stack-based buffer overflow via a long variable string in a Map Objects text file. |
CVE-2019-13574 | High | 7.8 | 2019-07-12 | In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is direct… |
CVE-2019-10935 | High | 7.2 | 2019-07-11 | A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC… |
CVE-2019-10933 | Medium | 6.1 | 2019-07-11 | A vulnerability has been identified in Spectrum Power 3 (Corporate User Interface) (All versions <= v3.11), Spectrum Power 4 (Corporate User Interface) (Versio… |
CVE-2019-10931 | High | 7.5 | 2019-07-11 | A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules (A… |
CVE-2019-10930 | High | 7.5 | 2019-07-11 | A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules (A… |
CVE-2019-10915 | High | 7.8 | 2019-07-11 | A vulnerability has been identified in TIA Administrator (All versions < V1.0 SP1 Upd1). The integrated configuration web application (TIA Administrator) allow… |
CVE-2019-5528 | Medium | 5.3 | 2019-07-11 | VMware ESXi 6.5 suffers from partial denial of service vulnerability in hostd process. Patch ESXi650-201907201-UG for this issue is available. |
CVE-2019-3415 | Medium | 5.7 | 2019-07-11 | ZTE MW NR8000V2.4.4.03 and NR8000V2.4.4.04 are impacted by path traversal vulnerability. Due to path traversal,users can download any files. |
CVE-2019-12751 | Critical | 9.8 | 2019-07-11 | Symantec Messaging Gateway, prior to 10.7.1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attem… |
CVE-2019-11133 | High | 7.8 | 2019-07-11 | Improper access control in the Intel(R) Processor Diagnostic Tool before version 4.1.2.24 may allow an authenticated user to potentially enable escalation of p… |
CVE-2019-4263 | Medium | 4.3 | 2019-07-11 | IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file in the ICN server. IBM X-Force ID: 16001… |
CVE-2019-4193 | High | 7.5 | 2019-07-11 | IBM Jazz for Service Management 1.1.3 and 1.1.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parti… |
CVE-2019-4131 | Medium | 5.3 | 2019-07-11 | IBM Application Performance Management (IBM Monitoring 8.1.4) could allow a remote attacker to induce the application to perform server-side DNS lookups of arb… |
CVE-2019-4118 | Medium | 4.4 | 2019-07-11 | IBM Multicloud Manager 3.1.0, 3.1.1, and 3.1.2 ibm-mcm-chart could allow a local attacker with admin privileges to obtain highly sensitive information upon dep… |
CVE-2019-12579 | High | 7.8 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to run… |
CVE-2019-12578 | High | 7.8 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary… |
CVE-2019-12577 | High | 7.8 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary… |
CVE-2019-12576 | High | 7.8 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary… |
CVE-2019-12575 | High | 7.8 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary… |
CVE-2019-12574 | High | 7.8 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitra… |
CVE-2019-12573 | High | 7.1 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to over… |
CVE-2019-12571 | High | 7.1 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v0.9.8 beta (build 02099) for macOS could allow an authenticated, local atta… |
CVE-2019-10970 | Critical | 9.8 | 2019-07-11 | In Rockwell Automation PanelView 5510 (all versions manufactured before March 13, 2019 that have never been updated to v4.003, v5.002, or later), a remote, una… |
CVE-2019-1010319 | Medium | 5.5 | 2019-07-11 | WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component… |
CVE-2019-1010317 | Medium | 5.5 | 2019-07-11 | WavPack 5.1.0 and earlier is affected by: CWE-457: Use of Uninitialized Variable. The impact is: Unexpected control flow, crashes, and segfaults. The component… |
CVE-2019-1010316 | High | 7.8 | 2019-07-11 | pyxtrlock 0.3 and earlier is affected by: Incorrect Access Control. The impact is: False locking impression when run in a non-X11 session. The fixed version is… |
CVE-2019-1010315 | Medium | 5.5 | 2019-07-11 | WavPack 5.1 and earlier is affected by: CWE 369: Divide by Zero. The impact is: Divide by zero can lead to sudden crash of a software/service that tries to par… |
CVE-2019-1010314 | Medium | 6.1 | 2019-07-11 | Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded… |
CVE-2019-0053 | High | 7.8 | 2019-07-11 | Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffer overflows, which can be exploited to… |
CVE-2019-0052 | High | 7.5 | 2019-07-11 | The srxpfe process may crash on SRX Series services gateways when the UTM module processes a specific fragmented HTTP packet. The packet is misinterpreted as a… |
CVE-2019-0049 | High | 7.5 | 2019-07-11 | On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled, a certain sequence of BGP session restart on… |
CVE-2019-0048 | Medium | 5.8 | 2019-07-11 | On EX4300 Series switches with TCAM optimization enabled, incoming multicast traffic matches an implicit loopback filter rule first, since it has high priority… |
CVE-2019-0046 | Medium | 6.5 | 2019-07-11 | A vulnerability in the pfe-chassisd Chassis Manager (CMLC) daemon of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the EX4… |
CVE-2019-9886 | High | 7.5 | 2019-07-11 | Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version… |
CVE-2019-9657 | High | 7.8 | 2019-07-11 | Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control, a different issue than CVE-2018-19588. This occurs because of incorrect protection of VPN ce… |
CVE-2019-7003 | Critical | 10.0 | 2019-07-11 | A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and… |
CVE-2019-3889 | Medium | 5.4 | 2019-07-11 | A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7 a… |
CVE-2019-13029 | Medium | 4.8 | 2019-07-11 | Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to injec… |
CVE-2019-12529 | Medium | 5.9 | 2019-07-11 | An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Pr… |
CVE-2019-12527 | High | 8.8 | 2019-07-11 | An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decod… |
CVE-2019-12525 | Critical | 9.8 | 2019-07-11 | An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Au… |
CVE-2019-11062 | Critical | 9.8 | 2019-07-11 | The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php". The target server can be exploited witho… |
CVE-2019-10194 | Medium | 5.5 | 2019-07-11 | Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be disclose… |
CVE-2019-10193 | High | 7.2 | 2019-07-11 | A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By… |
CVE-2019-10192 | High | 7.2 | 2019-07-11 | A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By c… |
CVE-2019-10135 | High | 7.2 | 2019-07-11 | A flaw was found in the yaml.load() function in the osbs-client versions since 0.46 before 0.56.1. Insecure use of the yaml.load() function allowed the user to… |
CVE-2019-13564 | Medium | 6.1 | 2019-07-11 | XSS exists in Ping Identity Agentless Integration Kit before 1.5. |
CVE-2019-11268 | Medium | 4.3 | 2019-07-11 | Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for on… |
CVE-2019-10651 | Critical | 9.8 | 2019-07-11 | An issue was discovered in the Core Server in Ivanti Endpoint Manager (EPM) 2017.3 before SU7 and 2018.x before 2018.3 SU3, with remote code execution. In othe… |
CVE-2019-13563 | High | 8.8 | 2019-07-11 | D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console. |
CVE-2019-13562 | Medium | 6.1 | 2019-07-11 | D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/ping_response.cgi ping_ipaddr parameter, the /www/ping6_response.cgi ping… |
CVE-2019-13561 | Critical | 9.8 | 2019-07-11 | D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the online_firmware_check.cgi c… |
CVE-2019-13560 | Critical | 9.8 | 2019-07-11 | D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password via the apply_sec.cgi setup_wizard parameter. |
CVE-2019-13507 | Critical | 9.8 | 2019-07-11 | hidea.com AZ Admin 1.0 has news_det.php?cod= SQL Injection. |
CVE-2019-13506 | Medium | 6.1 | 2019-07-11 | @nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS. |
CVE-2019-12597 | Medium | 6.1 | 2019-07-11 | An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the parameter pageName. |
CVE-2019-12596 | Medium | 6.1 | 2019-07-11 | An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType. |
CVE-2019-12595 | Medium | 6.1 | 2019-07-11 | An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter. |
CVE-2019-12540 | Medium | 6.1 | 2019-07-11 | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field. |
CVE-2019-12539 | Medium | 6.1 | 2019-07-11 | An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerabilit… |
CVE-2019-12537 | Medium | 6.1 | 2019-07-11 | An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field. |
CVE-2019-12363 | High | 8.8 | 2019-07-11 | An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to con… |
CVE-2019-10351 | High | 8.8 | 2019-07-11 | Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read per… |
CVE-2019-10350 | High | 8.8 | 2019-07-11 | Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read… |
CVE-2019-10349 | Medium | 5.4 | 2019-07-11 | A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to i… |
CVE-2019-10348 | High | 8.8 | 2019-07-11 | Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permissio… |
CVE-2019-10347 | High | 8.8 | 2019-07-11 | Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the master file system. |
CVE-2019-10346 | Medium | 6.1 | 2019-07-11 | A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScri… |
CVE-2019-10342 | Medium | 4.3 | 2019-07-11 | A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access to enu… |
CVE-2019-10341 | Medium | 6.5 | 2019-07-11 | A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to co… |
CVE-2019-10340 | High | 8.8 | 2019-07-11 | A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/R… |
CVE-2019-13505 | Medium | 6.1 | 2019-07-11 | The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1. |
CVE-2019-12838 | Critical | 9.8 | 2019-07-11 | SchedMD Slurm 17.11.x, 18.08.0 through 18.08.7, and 19.05.0 allows SQL Injection. |
CVE-2019-1010003 | Medium | 6.1 | 2019-07-11 | Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS). |
CVE-2019-13504 | Medium | 6.5 | 2019-07-11 | There is an out-of-bounds read in Exiv2::MrwImage::readMetadata in mrwimage.cpp in Exiv2 through 0.27.2. |
CVE-2019-13503 | High | 7.5 | 2019-07-11 | mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read. |
CVE-2019-13489 | Critical | 9.8 | 2019-07-10 | Trape through 2019-05-08 has SQL injection via the data[2] variable in core/db.py, as demonstrated by the /bs t parameter. |
CVE-2019-13488 | Medium | 6.1 | 2019-07-10 | A cross-site scripting (XSS) vulnerability in static/js/trape.js in Trape through 2019-05-08 allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2019-5446 | High | 7.2 | 2019-07-10 | Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root. |
CVE-2019-5445 | Medium | 4.9 | 2019-07-10 | DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands. |
CVE-2019-5444 | Medium | 5.3 | 2019-07-10 | Path traversal vulnerability in version up to v1.1.3 in serve-here.js npm module allows attackers to list any file in arbitrary folder. |
CVE-2019-13482 | High | 8.8 | 2019-07-10 | An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shel… |
CVE-2019-13481 | High | 8.8 | 2019-07-10 | An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shel… |
CVE-2019-12804 | Medium | 5.5 | 2019-07-10 | In Hunesion i-oneNet version 3.0.7 ~ 3.0.53 and 4.0.4 ~ 4.0.16, due to the lack of update file integrity checking in the upgrade process, an attacker can craft… |
CVE-2019-12803 | Critical | 9.8 | 2019-07-10 | In Hunesion i-oneNet version 3.0.7 ~ 3.0.53 and 4.0.4 ~ 4.0.16, the specific upload web module doesn't verify the file extension and type, and an attacker can… |
CVE-2019-0330 | Critical | 9.1 | 2019-07-10 | The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service), version 7.2, allow an attacker to inject cod… |
CVE-2019-0329 | Medium | 6.1 | 2019-07-10 | SAP Information Steward, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. |
CVE-2019-0328 | High | 7.2 | 2019-07-10 | ABAP Tests Modules (SAP Basis, versions 7.0, 7.1, 7.3, 7.31, 7.4, 7.5) of SAP NetWeaver Process Integration enables an attacker the execution of OS commands wi… |
CVE-2019-0327 | High | 7.2 | 2019-07-10 | SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7… |
CVE-2019-0326 | Medium | 6.1 | 2019-07-10 | SAP BusinessObjects Business Intelligence Platform (BI Workspace) (Enterprise), versions 4.1, 4.2, 4.3, does not sufficiently encode user-controlled inputs, re… |
CVE-2019-0325 | Medium | 4.2 | 2019-07-10 | SAP ERP HCM (SAP_HRCES) , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due t… |
CVE-2019-13132 | Critical | 9.8 | 2019-07-10 | In ZeroMQ libzmq before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.3.2, a remote, unauthenticated client connecting to a libzmq application, running with a… |
CVE-2019-11650 | Medium | 5.9 | 2019-07-10 | A potential Man in the Middle attack (MITM) was found in NetIQ Advanced Authentication Framework versions prior to 6.0. |
CVE-2019-0322 | High | 7.5 | 2019-07-10 | SAP Commerce Cloud (previously known as SAP Hybris Commerce), (HY_COM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811), allows an attacker to prevent legitimate… |
CVE-2019-0321 | Medium | 6.1 | 2019-07-10 | ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS)… |