2019 CVEs (page 110)
Page 110 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-0319 | High | 7.5 | 2019-07-10 | The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could… |
CVE-2019-0318 | Medium | 5.3 | 2019-07-10 | Under certain conditions SAP NetWeaver Application Server for Java (Startup Framework), versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an attacker to access… |
CVE-2019-0281 | Medium | 6.1 | 2019-07-10 | SAPUI5 and OpenUI5, before versions 1.38.39, 1.44.39, 1.52.25, 1.60.6 and 1.63.0, does not sufficiently encode user-controlled inputs, resulting in Cross-Site… |
CVE-2019-5221 | Medium | 6.5 | 2019-07-10 | There is a path traversal vulnerability on Huawei Share. The software does not properly validate the path, an attacker could crafted a file path when transport… |
CVE-2019-5220 | Medium | 4.6 | 2019-07-10 | There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones. The system does not sufficiently verify the permission, an attacker coul… |
CVE-2019-1873 | High | 8.6 | 2019-07-10 | A vulnerability in the cryptographic driver for Cisco Adaptive Security Appliance Software (ASA) and Firepower Threat Defense (FTD) Software could allow an una… |
CVE-2019-10966 | Medium | 5.3 | 2019-07-10 | In GE Aestiva and Aespire versions 7100 and 7900, a vulnerability exists where serial devices are connected via an added unsecured terminal server to a TCP/IP… |
CVE-2019-13279 | Critical | 9.8 | 2019-07-10 | TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple stack-based buffer overflows when processing user input for the setup wizard, a… |
CVE-2019-13278 | Critical | 9.8 | 2019-07-10 | TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple command injections when processing user input for the setup wizard, allowing an… |
CVE-2019-13276 | Critical | 9.8 | 2019-07-10 | TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow in the ssi binary. The overflow allows an unauthenticated… |
CVE-2019-13122 | Medium | 6.1 | 2019-07-10 | A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to i… |
CVE-2019-12470 | Medium | 6.5 | 2019-07-10 | Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. |
CVE-2019-12469 | Medium | 6.5 | 2019-07-10 | MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. |
CVE-2019-12474 | High | 7.5 | 2019-07-10 | Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak. Privileged API responses that include whether a recent change has been patrolled may be cach… |
CVE-2019-12473 | High | 7.5 | 2019-07-10 | Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in… |
CVE-2019-12472 | High | 7.5 | 2019-07-10 | An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBl… |
CVE-2019-12471 | Medium | 6.1 | 2019-07-10 | Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on… |
CVE-2019-12466 | High | 8.8 | 2019-07-10 | Wikimedia MediaWiki through 1.32.1 allows CSRF. |
CVE-2019-12468 | Critical | 9.8 | 2019-07-10 | An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypas… |
CVE-2019-12467 | Medium | 5.3 | 2019-07-10 | MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability t… |
CVE-2019-13396 | Medium | 5.3 | 2019-07-10 | FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POS… |
CVE-2019-13240 | Medium | 5.9 | 2019-07-10 | An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next… |
CVE-2019-13225 | Medium | 6.5 | 2019-07-10 | A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause denial of service by providing a crafted regular… |
CVE-2019-13224 | Critical | 9.8 | 2019-07-10 | A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possib… |
CVE-2019-13071 | High | 8.8 | 2019-07-10 | CSRF in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows an attacker to submit POST requests to any forms in the web applicati… |
CVE-2019-12724 | Medium | 6.1 | 2019-07-10 | An issue was discovered in the Teclib News plugin through 1.5.2 for GLPI. It allows a stored XSS attack via the $_POST['name'] parameter. |
CVE-2019-10653 | Critical | 9.8 | 2019-07-10 | An issue was discovered in Hsycms V1.1. There is a SQL injection vulnerability via a /news/*.html page. |
CVE-2019-12723 | Critical | 9.8 | 2019-07-10 | An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via container_id and old_order parameters to ajax/reorder.p… |
CVE-2019-10122 | Critical | 9.8 | 2019-07-10 | eQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices before 3.43.16 have buffer overflows in the ReGa ise GmbH HTTP-Server 2.0 component, aka HMCCU-179… |
CVE-2019-10121 | Critical | 9.8 | 2019-07-10 | eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.15 use session IDs for authentication but lack authorization checks. An attacker can obt… |
CVE-2019-10120 | High | 8.8 | 2019-07-10 | On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAutoLogin) can be achieved by continuing to… |
CVE-2019-10119 | Critical | 9.8 | 2019-07-10 | eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16 use session IDs for authentication but lack authorization checks. An attacker can obt… |
CVE-2019-13478 | Critical | 9.8 | 2019-07-09 | The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions. |
CVE-2019-13475 | High | 8.8 | 2019-07-09 | In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user… |
CVE-2019-13472 | Medium | 6.1 | 2019-07-09 | PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file. |
CVE-2019-9150 | Medium | 5.3 | 2019-07-09 | Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. This functionality can be tricked to either hide a key imp… |
CVE-2019-9149 | Medium | 6.5 | 2019-07-09 | Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL parameter in Mailvelope, an attacker i… |
CVE-2019-9148 | Medium | 4.3 | 2019-07-09 | Mailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope allows importing keys that contain users without a valid self-certificat… |
CVE-2019-9147 | Medium | 4.3 | 2019-07-09 | Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is intended to be accessible from web applicat… |
CVE-2019-13470 | Critical | 9.8 | 2019-07-09 | MatrixSSL before 4.2.1 has an out-of-bounds read during ASN.1 handling. |
CVE-2019-13380 | Medium | 6.1 | 2019-07-09 | KEYNTO Team Password Manager 1.5.0 allows XSS because data saved from websites is mishandled in the online vault. |
CVE-2019-13277 | High | 7.5 | 2019-07-09 | TRENDnet TEW-827DRU with firmware up to and including 2.04B03 allows an unauthenticated attacker to execute setup wizard functionality, giving this attacker th… |
CVE-2019-11512 | Critical | 9.8 | 2019-07-09 | Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5. |
CVE-2019-13338 | High | 7.5 | 2019-07-09 | In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page meta… |
CVE-2019-13337 | High | 7.5 | 2019-07-09 | In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token (this is the parameter used by the API)… |
CVE-2019-13464 | High | 7.5 | 2019-07-09 | An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PHP Script Uploads rules, becau… |
CVE-2019-13280 | High | 8.8 | 2019-07-09 | TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow while returning an error message to the user about failure… |
CVE-2019-13070 | Medium | 5.4 | 2019-07-09 | A stored XSS vulnerability in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows a privileged attacker to embed malicious JavaSc… |
CVE-2019-11991 | Critical | 9.8 | 2019-07-09 | HPE has identified a vulnerability in HPE 3PAR Service Processor (SP) version 4.1 through 4.4. HPE 3PAR Service Processor (SP) version 4.1 through 4.4 has a re… |
CVE-2019-8920 | Medium | 6.1 | 2019-07-09 | iart.php in XAMPP 1.7.0 has XSS, a related issue to CVE-2008-3569. |
CVE-2019-3950 | Critical | 9.8 | 2019-07-09 | Arlo Basestation firmware 1.12.0.1_27940 and prior contain a hardcoded username and password combination that allows root access to the device when an onboard… |
CVE-2019-3949 | Critical | 9.8 | 2019-07-09 | Arlo Basestation firmware 1.12.0.1_27940 and prior firmware contain a networking misconfiguration that allows access to restricted network interfaces. This cou… |
CVE-2019-13461 | High | 7.5 | 2019-07-09 | In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an Insecure Direct Object Reference vulnerability d… |
CVE-2019-13146 | Medium | 5.3 | 2019-07-09 | The field_test gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return an… |
CVE-2019-13142 | Medium | 5.5 | 2019-07-09 | The RzSurroundVADStreamingService (RzSurroundVADStreamingService.exe) in Razer Surround 1.1.63.0 runs as the SYSTEM user using an executable located in %PROGRA… |
CVE-2019-13454 | Medium | 6.5 | 2019-07-09 | ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c. |
CVE-2019-13397 | Medium | 6.1 | 2019-07-09 | Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via arbitrary file ex… |
CVE-2019-11020 | High | 7.5 | 2019-07-09 | Lack of authentication in file-viewing components in DDRT Dashcom Live 2019-05-09 allows anyone to remotely access all claim details by visiting easily guessab… |
CVE-2019-12782 | High | 8.1 | 2019-07-09 | An authorization bypass vulnerability in pinboard updates in ThoughtSpot 4.4.1 through 5.1.1 (before 5.1.2) allows a low-privilege user with write access to at… |
CVE-2019-11019 | High | 7.5 | 2019-07-09 | Lack of authentication in case-exporting components in DDRT Dashcom Live through 2019-05-08 allows anyone to remotely access all claim details by visiting easi… |
CVE-2019-12748 | Medium | 6.1 | 2019-07-09 | TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS. |
CVE-2019-12747 | High | 8.8 | 2019-07-09 | TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data. |
CVE-2019-11890 | High | 7.5 | 2019-07-09 | Sony Bravia Smart TV devices allow remote attackers to cause a denial of service (device hang or reboot) via a SYN flood attack over a wired or Wi-Fi LAN. |
CVE-2019-11889 | High | 7.5 | 2019-07-09 | Sony BRAVIA Smart TV devices allow remote attackers to cause a denial of service (device hang) via a crafted web page over HbbTV. |
CVE-2019-13450 | Medium | 6.5 | 2019-07-09 | In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active… |
CVE-2019-13449 | Medium | 6.5 | 2019-07-09 | In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service (continual focus grabs) via a sequence of invalid launch?action=join&c… |
CVE-2019-12927 | Medium | 6.1 | 2019-07-08 | MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. Because the session cookie did not use the HttpO… |
CVE-2019-12926 | High | 8.8 | 2019-07-08 | MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. As a result, it was possible to perform a number of act… |
CVE-2019-12925 | High | 8.1 | 2019-07-08 | MailEnable Enterprise Premium 10.23 was vulnerable to multiple directory traversal issues, with which authenticated users could add, remove, or potentially rea… |
CVE-2019-12924 | Critical | 9.8 | 2019-07-08 | MailEnable Enterprise Premium 10.23 was vulnerable to XML External Entity Injection (XXE) attacks that could be exploited by an unauthenticated user. It was po… |
CVE-2019-12923 | Medium | 6.5 | 2019-07-08 | In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not implemented correctly and it was possible… |
CVE-2019-12930 | Medium | 6.1 | 2019-07-08 | A cross-site scripting (XSS) vulnerability in noMenu() and noSubMenu() in core/navigation/MENU.php in WIKINDX prior to version 5.8.1 allows remote attackers to… |
CVE-2019-9630 | High | 7.5 | 2019-07-08 | Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images. |
CVE-2019-9629 | Critical | 9.8 | 2019-07-08 | Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials). |
CVE-2019-2119 | Medium | 5.5 | 2019-07-08 | In multiple functions of key_store_service.cpp, there is a possible Information Disclosure due to improper locking. This could lead to local information disclo… |
CVE-2019-2118 | Medium | 5.5 | 2019-07-08 | In various functions of Parcel.cpp, there are uninitialized or partially initialized stack variables. These could lead to local information disclosure with no… |
CVE-2019-2117 | Medium | 5.5 | 2019-07-08 | In checkQueryPermission of TelephonyProvider.java, there is a possible disclosure of secure data due to a missing permission check. This could lead to local in… |
CVE-2019-2116 | High | 7.5 | 2019-07-08 | In save_attr_seq of sdp_discovery.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to remote information disclosure wit… |
CVE-2019-2113 | Medium | 5.5 | 2019-07-08 | In setup wizard there is a bypass of some checks when wifi connection is skipped. This could lead to factory reset protection bypass with no additional privile… |
CVE-2019-2112 | High | 7.8 | 2019-07-08 | In several functions of alarm.cc, there is possible memory corruption due to a use after free. This could lead to local code execution with no additional execu… |
CVE-2019-2111 | Critical | 9.8 | 2019-07-08 | In loop of DnsTlsSocket.cpp, there is a possible heap memory corruption due to a use after free. This could lead to remote code execution in the netd server wi… |
CVE-2019-2109 | High | 8.8 | 2019-07-08 | In MakeMPEG4VideoCodecSpecificData of AVIExtractor.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote cod… |
CVE-2019-2107 | High | 8.8 | 2019-07-08 | In ihevcd_parse_pps of ihevcd_parse_headers.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution… |
CVE-2019-2106 | High | 8.8 | 2019-07-08 | In ihevcd_sao_shift_ctb of ihevcd_sao.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with n… |
CVE-2019-2105 | High | 8.8 | 2019-07-08 | In FileInputStream::Read of file_input_stream.cc, there is a possible memory corruption due to uninitialized data. This could lead to remote code execution in… |
CVE-2019-2104 | Medium | 5.5 | 2019-07-08 | In HIDL, safe_union, and other C++ structs/unions being sent to application processes, there are uninitialized fields. This could lead to local information dis… |
CVE-2019-10973 | High | 7.2 | 2019-07-08 | Quest KACE, all versions prior to version 8.0.x, 8.1.x, and 9.0.x, allows unintentional access to the appliance leveraging functions of the troubleshooting too… |
CVE-2019-13414 | Medium | 6.1 | 2019-07-08 | The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php. |
CVE-2019-13413 | Critical | 9.8 | 2019-07-08 | The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre_widget.php. |
CVE-2019-13354 | Critical | 9.8 | 2019-07-08 | The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, with… |
CVE-2019-12174 | High | 7.8 | 2019-07-08 | hide.me before 2.4.4 on macOS suffers from a privilege escalation vulnerability in the connectWithExecutablePath:configFilePath:configFileName method of the me… |
CVE-2019-12171 | High | 7.8 | 2019-07-08 | Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartext credentials in memory upon successful… |
CVE-2019-13404 | High | 7.8 | 2019-07-08 | The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code… |
CVE-2019-13402 | High | 8.8 | 2019-07-08 | /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset p… |
CVE-2019-13401 | High | 8.8 | 2019-07-08 | Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/. |
CVE-2019-13400 | Critical | 9.8 | 2019-07-08 | Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via… |
CVE-2019-13399 | Medium | 5.9 | 2019-07-08 | Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator's SSL conversation. |
CVE-2019-13398 | High | 7.2 | 2019-07-08 | Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed inject… |
CVE-2019-13391 | High | 8.8 | 2019-07-07 | In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels. |
CVE-2019-13390 | Medium | 6.5 | 2019-07-07 | In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c. |