2019 CVEs (page 112)

Page 112 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.

All CVEs published in 2019 — newest first (page 112 of 161)
CVESeverityScorePublishedSummary
CVE-2019-13253High7.82019-07-04XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000385474.
CVE-2019-13252High7.82019-07-04ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE_ACDStd!IEP_SetColorProfile+0x00000000001172b0.
CVE-2019-13251High7.82019-07-04ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE_ACDStd!IEP_SetColorProfile+0x00000000000c47ff.
CVE-2019-13250High7.82019-07-04ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE_ACDStd!IEP_SetColorProfile+0x00000000000b9c2f.
CVE-2019-13249High7.82019-07-04ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE_ACDStd!IEP_SetColorProfile+0x00000000000b9e7a.
CVE-2019-13248High7.82019-07-04ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE_ACDStd!JPEGTransW+0x0000000000002450.
CVE-2019-13247High7.82019-07-04ACDSee Free 1.1.21 has a User Mode Write AV starting at IDE_ACDStd!JPEGTransW+0x00000000000024ed.
CVE-2019-13246High7.82019-07-04FastStone Image Viewer 7.0 has a User Mode Write AV starting at image00400000+0x00000000001a9601.
CVE-2019-13245High7.82019-07-04FastStone Image Viewer 7.0 has a User Mode Write AV starting at image00400000+0x00000000001a95b1.
CVE-2019-13244High7.82019-07-04FastStone Image Viewer 7.0 has a User Mode Write AV starting at image00400000+0x0000000000002d7d.
CVE-2019-13243High7.82019-07-04IrfanView 4.52 has a User Mode Write AV starting at image00400000+0x00000000000249c6.
CVE-2019-13242High7.82019-07-04IrfanView 4.52 has a User Mode Write AV starting at image00400000+0x0000000000013a98.
CVE-2019-13241High7.82019-07-04FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive ent…
CVE-2019-13239Medium6.12019-07-04inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture.
CVE-2019-13238High7.52019-07-04An issue was discovered in Bento4 1.5.1.0. A memory allocation failure is unhandled in Core/Ap4SdpAtom.cpp and leads to crashes. When parsing input video, the…
CVE-2019-13233High7.02019-07-04In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry because of a race condition between modify_l…
CVE-2019-13232Low3.32019-07-04Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a "better zip bomb" iss…
CVE-2019-13229Medium5.52019-07-04deepin-clone before 1.1.3 uses a fixed path /tmp/partclone.log in the Helper::getPartitionSizeInfo() function to write a log file as root, and follows symlinks…
CVE-2019-13228Medium4.72019-07-04deepin-clone before 1.1.3 uses a fixed path /tmp/repo.iso in the BootDoctor::fix() function to download an ISO file, and follows symlinks there. An unprivilege…
CVE-2019-13227Medium5.52019-07-04In GUI mode, deepin-clone before 1.1.3 creates a log file at the fixed path /tmp/.deepin-clone.log as root, and follows symlinks there. An unprivileged user ca…
CVE-2019-13226High7.02019-07-04deepin-clone before 1.1.3 uses a predictable path /tmp/.deepin-clone/mount/<block-dev-basename> in the Helper::temporaryMountDevice() function to temporarily m…
CVE-2019-13208High7.32019-07-03WavesSysSvc in Waves MAXX Audio allows privilege escalation because the General registry key has Full Control access for the Users group, leading to DLL side l…
CVE-2019-9827Critical9.82019-07-03Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the ini…
CVE-2019-13074High7.52019-07-03A vulnerability in the FTP daemon on MikroTik routers through 6.44.3 could allow remote attackers to exhaust all available memory, causing the device to reboot…
CVE-2019-13207Critical9.82019-07-03nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer Overflow in the dname_concatenate() function in dname.c.
CVE-2019-12852Critical9.82019-07-03An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168.
CVE-2019-12846Medium4.32019-07-03A user without the required permissions could gain access to some JetBrains TeamCity settings. The issue was fixed in TeamCity 2018.2.2.
CVE-2019-12845Medium5.32019-07-03The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3.
CVE-2019-12844Medium6.12019-07-03A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.3.
CVE-2019-12843Medium6.12019-07-03A possible stored JavaScript injection requiring a deliberate server administrator action was detected. The issue was fixed in JetBrains TeamCity 2018.2.3.
CVE-2019-12842Medium6.12019-07-03A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.2.
CVE-2019-12841High7.52019-07-03Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity. The issue was fixed in TeamCity 2018.2.2.
CVE-2019-10103High8.12019-07-03JetBrains IntelliJ IDEA projects created using the Kotlin (JS Client/JVM Server) IDE Template were resolving Gradle artifacts using an http connection, potenti…
CVE-2019-10102High8.12019-07-03JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build proce…
CVE-2019-10101High8.12019-07-03JetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack.
CVE-2019-9873Critical9.82019-07-03In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record of the server cred…
CVE-2019-9872High8.12019-07-03In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a cleartext unencrypted reco…
CVE-2019-9823Critical9.82019-07-03In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext record of the server…
CVE-2019-9186Critical9.82019-07-03In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configu…
CVE-2019-6641Medium6.52019-07-03On BIG-IP 12.1.0-12.1.4.1, undisclosed requests can cause iControl REST processes to crash. The attack can only come from an authenticated user; all roles are…
CVE-2019-6640Medium5.32019-07-03On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, SNMP exposes sensitive configuration objects ov…
CVE-2019-6639Medium4.82019-07-03On BIG-IP (AFM, PEM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, an undisclosed TMUI pages for AFM an…
CVE-2019-6638Medium6.52019-07-03On BIG-IP 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, Malformed http requests made to an undisclosed iControl REST endpoint can lead to infinite loop of the restjavad…
CVE-2019-6637Medium6.52019-07-03On BIG-IP (ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead to instability of…
CVE-2019-6636High8.42019-07-03On BIG-IP (AFM, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnerability in AFM fe…
CVE-2019-6635Medium4.42019-07-03On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, when the BIG-IP system is licensed for Applianc…
CVE-2019-6634Medium6.52019-07-03On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, a high volume of malformed analytics report requests leads to instability in re…
CVE-2019-6632Medium5.52019-07-03On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, under certain circumstances, attackers can decrypt configuration items that are…
CVE-2019-5602High8.82019-07-03In FreeBSD 12.0-STABLE before r349628, 12.0-RELEASE before 12.0-RELEASE-p7, 11.3-PRERELEASE before r349629, 11.3-RC3 before 11.3-RC3-p1, and 11.2-RELEASE befor…
CVE-2019-5601Medium6.52019-07-03In FreeBSD 12.0-STABLE before r347474, 12.0-RELEASE before 12.0-RELEASE-p7, 11.2-STABLE before r347475, and 11.2-RELEASE before 11.2-RELEASE-p11, a bug in the…
CVE-2019-5600Critical9.82019-07-03In FreeBSD 12.0-STABLE before r349622, 12.0-RELEASE before 12.0-RELEASE-p7, 11.3-PRERELEASE before r349624, 11.3-RC3 before 11.3-RC3-p1, and 11.2-RELEASE befor…
CVE-2019-5052High8.82019-07-03An exploitable integer overflow vulnerability exists when loading a PCX file in SDL2_image 2.0.4. A specially crafted file can cause an integer overflow, resul…
CVE-2019-5051High8.82019-07-03An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buff…
CVE-2019-12867Critical9.82019-07-03Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168.
CVE-2019-12866Critical9.82019-07-03An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4…
CVE-2019-12851High8.82019-07-03A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852.
CVE-2019-12850Critical9.82019-07-03A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168.
CVE-2019-12847High7.22019-07-03In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. It is only relevant in case…
CVE-2019-10104Critical9.82019-07-03In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin, or CloudBees) with the default setting…
CVE-2019-10100Critical9.82019-07-03In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue mac…
CVE-2019-7165Critical9.82019-07-03A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.
CVE-2019-6633Medium4.42019-07-03On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, when the BIG-IP system is licensed with Appliance mode, user a…
CVE-2019-6631High7.52019-07-03On BIG-IP 11.5.1-11.6.4, iRules performing HTTP header manipulation may cause an interruption to service when processing traffic handled by a Virtual Server wi…
CVE-2019-6630High7.52019-07-03On F5 SSL Orchestrator 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, undisclosed traffic flow may cause TMM to restart under certain circumstances.
CVE-2019-6629High7.52019-07-03On BIG-IP 14.1.0-14.1.0.5, undisclosed SSL traffic to a virtual server configured with a Client SSL profile may cause TMM to fail and restart. The Client SSL p…
CVE-2019-6628High7.52019-07-03On BIG-IP PEM 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, under certain conditions, the TMM process may terminate and restart while processing BIG-IP PEM traffic with…
CVE-2019-6627Medium5.92019-07-03On F5 SSL Orchestrator 14.1.0-14.1.0.5, on rare occasions, specific to a certain race condition, TMM may restart when SSL Forward Proxy enforces the bypass act…
CVE-2019-6626Medium6.12019-07-03On BIG-IP (AFM, Analytics, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.3.4, A reflected cross-site scripting (XSS) v…
CVE-2019-6625Medium6.12019-07-03On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a reflected cross-site scripting (XSS) vulnerability exists in a…
CVE-2019-12570High8.82019-07-03A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to execute arbitrary S…
CVE-2019-5630Medium5.92019-07-03A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attac…
CVE-2019-13186Medium6.12019-07-03In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box. An attacker can use it to get a user's cookie. This is different from CVE-20…
CVE-2019-10721Medium6.12019-07-03BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, logi…
CVE-2019-10717High7.12019-07-03BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter.
CVE-2019-3619Medium6.82019-07-03Information Disclosure vulnerability in the Agent Handler in McAfee ePolicy Orchestrator (ePO) 5.9.x and 5.10.0 prior to 5.10.0 update 4 allows remote unauthen…
CVE-2019-13164High7.82019-07-03qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the…
CVE-2019-10183Low3.22019-07-03Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option acce…
CVE-2019-13179High7.52019-07-02Calamares versions 3.1 through 3.2.10 copies a LUKS encryption keyfile from /crypto_keyfile.bin (mode 0600 owned by root) to /boot within a globally readable i…
CVE-2019-13178High8.12019-07-02modules/luksbootkeyfile/main.py in Calamares versions 3.1 through 3.2.10 has a race condition between the time when the LUKS encryption keyfile is created and…
CVE-2019-6623High7.52019-07-02On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, undisclosed traffic sent to BIG-IP iSession virtual server may cause the Traffi…
CVE-2019-13177Critical9.82019-07-02verification.py in django-rest-registration (aka Django REST Registration library) before 0.5.0 relies on a static string for signatures (i.e., the Django Sign…
CVE-2019-6624High7.52019-07-02On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, an undisclosed traffic pattern sent to a BIG-IP UDP virtual server may lead to…
CVE-2019-6622High7.22019-07-02On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, an undisclosed iControl REST worker is vulnerable to command i…
CVE-2019-6621High7.22019-07-02On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, 11.6.1-11.6.3.4, and 11.5.2-11.5.8 and BIG-IQ 7.0.0-7.1.0.2, 6.0.0-6.1.0, and 5.1…
CVE-2019-6620High7.22019-07-02On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.5, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4 and BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, an undisclosed iControl…
CVE-2019-5599High7.52019-07-02In FreeBSD 12.0-STABLE before r349197 and 12.0-RELEASE before 12.0-RELEASE-p6, a bug in the non-default RACK TCP stack can allow an attacker to cause several l…
CVE-2019-13175Medium6.12019-07-02Read the Docs before 3.5.1 has an Open Redirect if certain user-defined redirects are used. This affects private instances of Read the Docs (in addition to the…
CVE-2019-13173High7.52019-07-02fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a f…
CVE-2019-10975Medium6.62019-07-02An out-of-bounds read vulnerability has been identified in Fuji Electric Alpha7 PC Loader Versions 1.1 and prior, which may crash the system.
CVE-2019-10137High8.12019-07-02A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated at…
CVE-2019-10136Medium4.32019-07-02It was found that Spacewalk, all versions through 2.9, did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set…
CVE-2019-7258High8.82019-07-02Linear eMerge E3-Series devices allow Privilege Escalation.
CVE-2019-7257Critical10.02019-07-02Linear eMerge E3-Series devices allow Unrestricted File Upload.
CVE-2019-7256Critical9.82019-07-02Linear eMerge E3-Series devices allow Command Injections.
CVE-2019-7255Medium6.12019-07-02Linear eMerge E3-Series devices allow XSS.
CVE-2019-7254High7.52019-07-02Linear eMerge E3-Series devices allow File Inclusion.
CVE-2019-7253Critical9.82019-07-02Linear eMerge E3-Series devices allow Directory Traversal.
CVE-2019-7252Critical9.82019-07-02Linear eMerge E3-Series devices have Default Credentials.
CVE-2019-5443High7.82019-07-02A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automaticall…
CVE-2019-7262High8.82019-07-02Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).