2019 CVEs (page 111)
Page 111 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-13379 | High | 8.8 | 2019-07-07 | On AVTECH Room Alert 3E devices before 2.2.5, an attacker with access to the device's web interface may escalate privileges from an unauthenticated user to adm… |
CVE-2019-13183 | High | 8.8 | 2019-07-07 | Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings. |
CVE-2019-13375 | Critical | 9.8 | 2019-07-06 | A SQL Injection was discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 in PayAction.class.php with the index.php/Pay/passcodeAuth param… |
CVE-2019-13374 | Medium | 6.1 | 2019-07-06 | A cross-site scripting (XSS) vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remot… |
CVE-2019-13373 | Critical | 9.8 | 2019-07-06 | An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validated and arbitrary SQL statements can be e… |
CVE-2019-13372 | Critical | 9.8 | 2019-07-06 | /web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arbitrary PHP code via… |
CVE-2019-13370 | High | 8.8 | 2019-07-06 | index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator. |
CVE-2019-13362 | High | 7.8 | 2019-07-06 | Codedoc v3.2 has a stack-based buffer overflow in add_variable in codedoc.c, related to codedoc_strlcpy. |
CVE-2019-1933 | Medium | 5.8 | 2019-07-06 | A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacke… |
CVE-2019-1932 | Medium | 6.7 | 2019-07-06 | A vulnerability in Cisco Advanced Malware Protection (AMP) for Endpoints for Windows could allow an authenticated, local attacker with administrator privileges… |
CVE-2019-1931 | Medium | 6.1 | 2019-07-06 | Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated… |
CVE-2019-1930 | Medium | 6.1 | 2019-07-06 | Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated… |
CVE-2019-1922 | Medium | 5.3 | 2019-07-06 | A vulnerability in Cisco SIP IP Phone Software for Cisco IP Phone 7800 Series and 8800 Series could allow an unauthenticated, remote attacker to cause a denial… |
CVE-2019-1921 | Medium | 5.8 | 2019-07-06 | A vulnerability in the attachment scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker t… |
CVE-2019-1911 | Medium | 5.3 | 2019-07-06 | A vulnerability in the CLI of Cisco Unified Communications Domain Manager (Cisco Unified CDM) Software could allow an authenticated, local attacker to escape t… |
CVE-2019-1909 | Medium | 6.8 | 2019-07-06 | A vulnerability in the implementation of Border Gateway Protocol (BGP) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker t… |
CVE-2019-1894 | High | 7.2 | 2019-07-06 | A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with administrator privileges to overwrit… |
CVE-2019-1893 | High | 7.8 | 2019-07-06 | A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to execute arbitrary commands on the under… |
CVE-2019-1892 | High | 7.5 | 2019-07-06 | A vulnerability in the Secure Sockets Layer (SSL) input packet processor of Cisco Small Business 200, 300, and 500 Series Managed Switches could allow an unaut… |
CVE-2019-1891 | High | 7.5 | 2019-07-06 | A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Managed Switches could allow an unauthenticated, remote attacker to cause… |
CVE-2019-1887 | High | 8.6 | 2019-07-06 | A vulnerability in the Session Initiation Protocol (SIP) protocol implementation of Cisco Unified Communications Manager could allow an unauthenticated, remote… |
CVE-2019-10639 | High | 7.5 | 2019-07-05 | The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Speci… |
CVE-2019-10638 | Medium | 6.5 | 2019-07-05 | In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP an… |
CVE-2019-13358 | High | 7.5 | 2019-07-05 | lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a… |
CVE-2019-13352 | Critical | 9.8 | 2019-07-05 | WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature. By knowing this sta… |
CVE-2019-13351 | High | 8.1 | 2019-07-05 | posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 (as distributed with alsa-plugins 1.1.7 and later) has a "double file descriptor close" issue dur… |
CVE-2019-12971 | Critical | 9.8 | 2019-07-05 | BKS EBK Ethernet-Buskoppler Pro before 3.01 allows Unrestricted Upload of a File with a Dangerous Type. |
CVE-2019-13345 | Medium | 6.1 | 2019-07-05 | The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter. |
CVE-2019-13344 | Medium | 5.3 | 2019-07-05 | An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings. Th… |
CVE-2019-13341 | Medium | 4.8 | 2019-07-05 | In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie. |
CVE-2019-13340 | Medium | 4.8 | 2019-07-05 | In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. An attacker can use it to get a user's cookie. This is different from CVE… |
CVE-2019-13339 | Medium | 4.8 | 2019-07-05 | In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a user's cookie. |
CVE-2019-5984 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in Custom CSS Pro 1.0.3 and earlier allows remote attackers to hijack the authentication of administrators via… |
CVE-2019-5983 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in HTML5 Maps 1.6.5.6 and earlier allows remote attackers to hijack the authentication of administrators via un… |
CVE-2019-5982 | High | 7.5 | 2019-07-05 | Improper download file verification vulnerability in VAIO Update 7.3.0.03150 and earlier allows remote attackers to conduct a man-in-the-middle attack via a ma… |
CVE-2019-5981 | High | 7.8 | 2019-07-05 | Improper authorization vulnerability in VAIO Update 7.3.0.03150 and earlier allows an attackers to execute arbitrary executable file with administrative privil… |
CVE-2019-5980 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in Related YouTube Videos versions prior to 1.9.9 allows remote attackers to hijack the authentication of admin… |
CVE-2019-5979 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in Personalized WooCommerce Cart Page 2.4 and earlier allows remote attackers to hijack the authentication of a… |
CVE-2019-5974 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentication of administrat… |
CVE-2019-5973 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to hijack the authentication of administrato… |
CVE-2019-5972 | Medium | 6.1 | 2019-07-05 | Cross-site scripting vulnerability in Online Lesson Booking 0.8.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified ve… |
CVE-2019-5971 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in Attendance Manager 0.5.6 and earlier allows remote attackers to hijack the authentication of administrators… |
CVE-2019-5970 | Medium | 6.1 | 2019-07-05 | Cross-site scripting vulnerability in Attendance Manager 0.5.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vecto… |
CVE-2019-5969 | Medium | 6.1 | 2019-07-05 | Open redirect vulnerability in GROWI v3.4.6 and earlier allows remote attackersto redirect users to arbitrary web sites and conduct phishing attacks via the pr… |
CVE-2019-5968 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in GROWI v3.4.6 and earlier allows remote attackers to hijack the authentication of administrators via updating… |
CVE-2019-5967 | Medium | 6.1 | 2019-07-05 | Cross-site scripting vulnerability in Joruri CMS 2017 Release2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vecto… |
CVE-2019-5966 | Medium | 5.4 | 2019-07-05 | Joruri Mail 2.1.4 and earlier does not properly manage sessions, which allows remote attackers to impersonate an arbitrary user and alter/disclose the informat… |
CVE-2019-5965 | Medium | 6.1 | 2019-07-05 | Open redirect vulnerability in Joruri Mail 2.1.4 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via… |
CVE-2019-5964 | High | 8.8 | 2019-07-05 | iDoors Reader 2.10.17 and earlier allows an attacker on the same network segment to bypass authentication to access the management console and operate the prod… |
CVE-2019-5963 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to hijack the authentication of administrators via un… |
CVE-2019-5962 | Medium | 6.1 | 2019-07-05 | Cross-site scripting vulnerability in Zoho SalesIQ 1.0.8 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2019-5961 | High | 7.4 | 2019-07-05 | The Android App 'Tootdon for Mastodon' version 3.4.1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers… |
CVE-2019-5960 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in WP Open Graph 1.6.1 and earlier allows remote attackers to hijack the authentication of administrators via u… |
CVE-2019-13314 | High | 7.8 | 2019-07-05 | virt-bootstrap 1.1.0 allows local users to discover a root password by listing a process, because this password may be present in the --root-password option to… |
CVE-2019-13313 | High | 7.8 | 2019-07-05 | libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are passed to osinfo-install-script via the command line. |
CVE-2019-13144 | Critical | 9.8 | 2019-07-05 | myTinyTodo 1.3.3 through 1.4.3 allows CSV Injection. This is fixed in 1.5. |
CVE-2019-13312 | High | 8.8 | 2019-07-05 | block_cmp() in libavcodec/zmbvenc.c in FFmpeg 4.1.3 has a heap-based buffer over-read. |
CVE-2019-13311 | Medium | 6.5 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error. |
CVE-2019-13310 | Medium | 6.5 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in MagickWand/mogrify.c. |
CVE-2019-13309 | Medium | 6.5 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage error in CLIListOperatorImages in MagickWand/operation… |
CVE-2019-13308 | High | 8.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow in MagickCore/fourier.c in ComplexImage. |
CVE-2019-13307 | High | 7.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows. |
CVE-2019-13306 | High | 7.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors. |
CVE-2019-13305 | High | 7.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error. |
CVE-2019-13304 | High | 7.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment. |
CVE-2019-13303 | High | 8.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/composite.c in CompositeImage. |
CVE-2019-13302 | High | 8.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/fourier.c in ComplexImages. |
CVE-2019-13301 | Medium | 6.5 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error. |
CVE-2019-13300 | High | 8.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns. |
CVE-2019-13299 | High | 8.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/pixel-accessor.h in GetPixelChannel. |
CVE-2019-13298 | High | 8.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/pixel-accessor.h in SetPixelViaPixelInfo because of a MagickCore/enhance.c error. |
CVE-2019-13297 | High | 8.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled. |
CVE-2019-13296 | Medium | 6.5 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has direct memory leaks in AcquireMagickMemory because of an error in CLIListOperatorImages in MagickWand/operation.c for a NULL value. |
CVE-2019-13295 | High | 8.8 | 2019-07-05 | ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled. |
CVE-2019-13294 | Critical | 9.8 | 2019-07-04 | AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session control. Therefore an unauthenticated user… |
CVE-2019-13292 | Critical | 9.8 | 2019-07-04 | A SQL Injection issue was discovered in webERP 4.15. Payments.php accepts payment data in base64 format. After this is decoded, it is deserialized. Then, this… |
CVE-2019-13291 | Medium | 5.5 | 2019-07-04 | In Xpdf 4.01.01, there is a heap-based buffer over-read in the function DCTStream::readScan() located at Stream.cc. It can, for example, be triggered by sendin… |
CVE-2019-13290 | High | 7.8 | 2019-07-04 | Artifex MuPDF 1.15.0 has a heap-based buffer overflow in fz_append_display_node located at fitz/list-device.c, allowing remote attackers to execute arbitrary c… |
CVE-2019-13289 | High | 7.8 | 2019-07-04 | In Xpdf 4.01.01, there is a use-after-free vulnerability in the function JBIG2Stream::close() located at JBIG2Stream.cc. It can, for example, be triggered by s… |
CVE-2019-13288 | Medium | 5.5 | 2019-07-04 | In Xpdf 4.01.01, the Parser::getObj() function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS atta… |
CVE-2019-13287 | Medium | 5.5 | 2019-07-04 | In Xpdf 4.01.01, there is an out-of-bounds read vulnerability in the function SplashXPath::strokeAdjust() located at splash/SplashXPath.cc. It can, for example… |
CVE-2019-13286 | Medium | 5.5 | 2019-07-04 | In Xpdf 4.01.01, there is a heap-based buffer over-read in the function JBIG2Stream::readTextRegionSeg() located at JBIG2Stream.cc. It can, for example, be tri… |
CVE-2019-1890 | Medium | 6.5 | 2019-07-04 | A vulnerability in the fabric infrastructure VLAN connection establishment of the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch… |
CVE-2019-1889 | High | 7.2 | 2019-07-04 | A vulnerability in the REST API for software device management in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an authenticat… |
CVE-2019-1886 | High | 8.6 | 2019-07-04 | A vulnerability in the HTTPS decryption feature of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to cause a denial of serv… |
CVE-2019-1884 | High | 7.7 | 2019-07-04 | A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker t… |
CVE-2019-1855 | High | 7.3 | 2019-07-04 | A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Jabber for Windows could allow an authenticated, local attacker to perform… |
CVE-2019-13283 | High | 7.8 | 2019-07-04 | In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in strncpy from FoFiType1::parse in fofi/FoFiType1.cc because it does not ensure the source s… |
CVE-2019-13282 | High | 7.8 | 2019-07-04 | In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in SampledFunction::transform in Function.cc when using a large index for samples. It can, fo… |
CVE-2019-13281 | High | 7.8 | 2019-07-04 | In Xpdf 4.01.01, a heap-based buffer overflow could be triggered in DCTStream::decodeImage() in Stream.cc when writing to frameBuf memory. It can, for example… |
CVE-2019-13275 | Critical | 9.8 | 2019-07-04 | An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plu… |
CVE-2019-13262 | High | 7.8 | 2019-07-04 | XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x00000000003283eb. |
CVE-2019-13261 | High | 7.8 | 2019-07-04 | XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000328384. |
CVE-2019-13260 | High | 7.8 | 2019-07-04 | XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000327a07. |
CVE-2019-13259 | High | 7.8 | 2019-07-04 | XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000032e566. |
CVE-2019-13258 | High | 7.8 | 2019-07-04 | XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000328165. |
CVE-2019-13257 | High | 7.8 | 2019-07-04 | XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x00000000003273aa. |
CVE-2019-13256 | High | 7.8 | 2019-07-04 | XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000032e849. |
CVE-2019-13255 | High | 7.8 | 2019-07-04 | XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000327464. |
CVE-2019-13254 | High | 7.8 | 2019-07-04 | XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000032e808. |