2019 CVEs (page 113)
Page 113 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-7261 | Critical | 9.8 | 2019-07-02 | Linear eMerge E3-Series devices have Hard-coded Credentials. |
CVE-2019-7260 | Critical | 9.8 | 2019-07-02 | Linear eMerge E3-Series devices have Cleartext Credentials in a Database. |
CVE-2019-7259 | High | 8.8 | 2019-07-02 | Linear eMerge E3-Series devices allow Authorization Bypass with Information Disclosure. |
CVE-2019-7270 | High | 8.8 | 2019-07-02 | Linear eMerge 50P/5000P devices allow Cross-Site Request Forgery (CSRF). |
CVE-2019-7269 | Critical | 9.8 | 2019-07-02 | Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution. |
CVE-2019-7268 | Critical | 10.0 | 2019-07-02 | Linear eMerge 50P/5000P devices allow Unauthenticated File Upload. |
CVE-2019-7267 | Critical | 9.8 | 2019-07-02 | Linear eMerge 50P/5000P devices allow Cookie Path Traversal. |
CVE-2019-7266 | Critical | 9.8 | 2019-07-02 | Linear eMerge 50P/5000P devices allow Authentication Bypass. |
CVE-2019-7265 | Critical | 9.8 | 2019-07-02 | Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH). |
CVE-2019-7264 | Critical | 9.8 | 2019-07-02 | Linear eMerge E3-Series devices allow a Stack-based Buffer Overflow on the ARM platform. |
CVE-2019-7263 | Critical | 9.8 | 2019-07-02 | Linear eMerge E3-Series devices have a Version Control Failure. |
CVE-2019-12594 | Critical | 9.8 | 2019-07-02 | DOSBox 0.74-2 has Incorrect Access Control. |
CVE-2019-13056 | High | 8.8 | 2019-07-02 | An issue was discovered in CyberPanel through 1.8.4. On the user edit page, an attacker can edit the administrator's e-mail and password because of the lack of… |
CVE-2019-4292 | High | 8.8 | 2019-07-02 | IBM Security Guardium 10.5 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable… |
CVE-2019-4260 | Medium | 5.3 | 2019-07-02 | IBM Daeja ViewONE Professional, Standard & Virtual 5.0 through 5.0.5 could allow an unauthorized user to download server files resulting in sensitive informati… |
CVE-2019-4140 | High | 7.1 | 2019-07-02 | IBM Tivoli Storage Manager Server (IBM Spectrum Protect 7.1 and 8.1) could allow a local user to replace existing databases by restoring old data. IBM X-Force… |
CVE-2019-4134 | Medium | 6.1 | 2019-07-02 | IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2019-4129 | Medium | 5.3 | 2019-07-02 | IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to obtain sensitive information, caused by an error message containing a stack… |
CVE-2019-4088 | High | 7.8 | 2019-07-02 | IBM Spectrum Protect Servers 7.1 and 8.1 and Storage Agents could allow a local attacker to gain elevated privileges on the system, caused by loading a special… |
CVE-2019-4087 | Critical | 9.8 | 2019-07-02 | IBM Spectrum Protect Servers 7.1 and 8.1 and Storage Agents are vulnerable to a stack-based buffer overflow, caused by improper bounds checking by servers and… |
CVE-2019-13155 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the IP… |
CVE-2019-13154 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the TCP… |
CVE-2019-13153 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the Pri… |
CVE-2019-13152 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the IP… |
CVE-2019-13151 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the act… |
CVE-2019-13150 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication). The comman… |
CVE-2019-13149 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the key… |
CVE-2019-13148 | High | 8.8 | 2019-07-02 | An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the UDP… |
CVE-2019-13147 | Medium | 6.5 | 2019-07-02 | In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attack… |
CVE-2019-9703 | High | 7.8 | 2019-07-01 | Symantec Endpoint Encryption, prior to SEE 11.3.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to g… |
CVE-2019-9702 | High | 7.8 | 2019-07-01 | Symantec Endpoint Encryption, prior to SEE 11.3.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to g… |
CVE-2019-7274 | Critical | 9.8 | 2019-07-01 | Optergy Proton/Enterprise devices allow Authenticated File Upload with Code Execution as root. |
CVE-2019-7273 | High | 8.8 | 2019-07-01 | Optergy Proton/Enterprise devices allow Cross-Site Request Forgery (CSRF). |
CVE-2019-7272 | Medium | 5.3 | 2019-07-01 | Optergy Proton/Enterprise devices allow Username Disclosure. |
CVE-2019-7271 | Critical | 9.8 | 2019-07-01 | Nortek Linear eMerge 50P/5000P devices have Default Credentials. |
CVE-2019-6642 | High | 8.8 | 2019-07-01 | In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Man… |
CVE-2019-5497 | Critical | 9.8 | 2019-07-01 | NetApp AFF A700s Baseboard Management Controller (BMC) firmware versions 1.22 and higher were shipped with a default account enabled that could allow unauthori… |
CVE-2019-10979 | Critical | 9.8 | 2019-07-01 | SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password. |
CVE-2019-7278 | Medium | 6.5 | 2019-07-01 | Optergy Proton/Enterprise devices have an Unauthenticated SMS Sending Service. |
CVE-2019-7277 | Medium | 5.3 | 2019-07-01 | Optergy Proton/Enterprise devices allow Unauthenticated Internal Network Information Disclosure. |
CVE-2019-7276 | Critical | 9.8 | 2019-07-01 | Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console. |
CVE-2019-7275 | Medium | 6.1 | 2019-07-01 | Optergy Proton/Enterprise devices allow Open Redirect. |
CVE-2019-3962 | Low | 3.3 | 2019-07-01 | Content Injection vulnerability in Tenable Nessus prior to 8.5.0 may allow an authenticated, local attacker to exploit this vulnerability by convincing another… |
CVE-2019-13137 | Medium | 6.5 | 2019-07-01 | ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadPSImage in coders/ps.c. |
CVE-2019-13136 | High | 7.8 | 2019-07-01 | ImageMagick before 7.0.8-50 has an integer overflow vulnerability in the function TIFFSeekCustomStream in coders/tiff.c. |
CVE-2019-13135 | High | 8.8 | 2019-07-01 | ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c. |
CVE-2019-13134 | Medium | 5.5 | 2019-07-01 | ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in coders/viff.c. |
CVE-2019-13133 | Medium | 5.5 | 2019-07-01 | ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c. |
CVE-2019-7670 | High | 7.2 | 2019-07-01 | Prima Systems FlexAir, Versions 2.3.38 and prior. The application incorrectly neutralizes special elements that could modify the intended OS command when it is… |
CVE-2019-7669 | High | 8.8 | 2019-07-01 | Prima Systems FlexAir, Versions 2.3.38 and prior. Improper validation of file extensions when uploading files could allow a remote authenticated attacker to up… |
CVE-2019-7668 | Critical | 9.8 | 2019-07-01 | Prima Systems FlexAir devices have Default Credentials. |
CVE-2019-7667 | Critical | 9.8 | 2019-07-01 | Prima Systems FlexAir, Versions 2.3.38 and prior. The application generates database backup files with a predictable name, and an attacker can use brute force… |
CVE-2019-7666 | High | 8.8 | 2019-07-01 | Prima Systems FlexAir, Versions 2.3.38 and prior. The application allows improper authentication using the MD5 hash value of the password, which may allow an a… |
CVE-2019-7281 | High | 8.8 | 2019-07-01 | Prima Systems FlexAir, Versions 2.3.38 and prior. An unauthenticated user can send unverified HTTP requests, which may allow the attacker to perform certain ac… |
CVE-2019-7280 | High | 8.8 | 2019-07-01 | Prima Systems FlexAir, Versions 2.3.38 and prior. The session-ID is of an insufficient length and can be exploited by brute force, which may allow a remote att… |
CVE-2019-7279 | High | 7.3 | 2019-07-01 | Optergy Proton/Enterprise devices have Hard-coded Credentials. |
CVE-2019-1578 | Medium | 6.1 | 2019-07-01 | Cross-site scripting vulnerability in Palo Alto Networks MineMeld version 0.9.60 and earlier may allow a remote attacker able to convince an authenticated Mine… |
CVE-2019-1577 | Medium | 6.3 | 2019-07-01 | Code injection vulnerability in Palo Alto Networks Traps 5.0.5 and earlier may allow an authenticated attacker to inject arbitrary JavaScript or HTML. |
CVE-2019-13024 | High | 8.8 | 2019-07-01 | Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "… |
CVE-2019-12826 | High | 8.8 | 2019-07-01 | A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers t… |
CVE-2019-13131 | Critical | 9.8 | 2019-07-01 | Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRPE. |
CVE-2019-4410 | Medium | 5.4 | 2019-07-01 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arb… |
CVE-2019-4386 | Medium | 6.5 | 2019-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow an authenticated user to execute a function that would cause the server to c… |
CVE-2019-4383 | Medium | 6.7 | 2019-07-01 | When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle or MongoDB databases, a redirected restore operation may result in an escalat… |
CVE-2019-4357 | Medium | 6.7 | 2019-07-01 | When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle, DB2 or MongoDB databases, a redirected restore operation specifying a target… |
CVE-2019-4337 | Medium | 5.3 | 2019-07-01 | IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite node… |
CVE-2019-4336 | Critical | 9.8 | 2019-07-01 | IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to brute force account… |
CVE-2019-4322 | High | 7.8 | 2019-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authentica… |
CVE-2019-4299 | Medium | 5.5 | 2019-07-01 | IBM Robotic Process Automation with Automation Anywhere 11 could allow a local user to obtain highly sensitive information from log files when debugging is ena… |
CVE-2019-4298 | High | 7.1 | 2019-07-01 | IBM Robotic Process Automation with Automation Anywhere 11 uses a high privileged PostgreSQL account for database access which could allow a local user to perf… |
CVE-2019-4297 | Medium | 5.4 | 2019-07-01 | IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially craft… |
CVE-2019-4296 | Low | 3.3 | 2019-07-01 | IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-mail contents from the client debug log… |
CVE-2019-4295 | Medium | 4.9 | 2019-07-01 | IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker with specialized access to obtain highly sensitive from the credential vault… |
CVE-2019-4237 | Medium | 5.4 | 2019-07-01 | A Cross-Frame Scripting vulnerability in IBM InfoSphere Information Server 11.3, 11.5, and 11.7 can allow an attacker to load the vulnerable application inside… |
CVE-2019-4154 | High | 7.8 | 2019-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authentica… |
CVE-2019-4102 | Medium | 5.9 | 2019-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.0 uses weaker than expected cryptographic algorithms that could allow… |
CVE-2019-4101 | Medium | 5.5 | 2019-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 is vulnerable to a denial of service. Users that have both EXECUTE on PD… |
CVE-2019-4057 | Medium | 6.7 | 2019-07-01 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow malicious user with access to the DB2 instance account… |
CVE-2019-13129 | High | 7.5 | 2019-07-01 | On the Motorola router CX2L MWR04L 1.01, there is a stack consumption (infinite recursion) issue in scopd via TCP port 8010 and UDP port 8080. It is caused by… |
CVE-2019-13128 | High | 8.8 | 2019-07-01 | An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. There is a command injection in HNAP1 (exploitable with Authentication) via shell met… |
CVE-2019-13127 | Medium | 6.1 | 2019-07-01 | An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products. Improper input vali… |
CVE-2019-13125 | High | 7.8 | 2019-07-01 | HaboMalHunter through 2.0.0.3 in Tencent Habo allows attackers to evade dynamic malware analysis via PIE compilation. |
CVE-2019-12781 | Medium | 5.3 | 2019-07-01 | An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROX… |
CVE-2019-12970 | Medium | 6.1 | 2019-07-01 | XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitizat… |
CVE-2019-13118 | Medium | 5.3 | 2019-07-01 | In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination coul… |
CVE-2019-13117 | Medium | 5.3 | 2019-07-01 | In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow… |
CVE-2019-13114 | Medium | 6.5 | 2019-06-30 | http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted res… |
CVE-2019-13113 | Medium | 6.5 | 2019-06-30 | Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to assertion failure) via an invalid data location in a CRW image file. |
CVE-2019-13112 | Medium | 6.5 | 2019-06-30 | A PngChunk::parseChunkContent uncontrolled memory allocation in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (crash due to an std::bad_… |
CVE-2019-13111 | Medium | 5.5 | 2019-06-30 | A WebPImage::decodeChunks integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (large heap allocation followed by a very lo… |
CVE-2019-13110 | Medium | 6.5 | 2019-06-30 | A CiffDirectory::readDirectory integer overflow and out-of-bounds read in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a… |
CVE-2019-13109 | Medium | 6.5 | 2019-06-30 | An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetad… |
CVE-2019-13108 | Medium | 6.5 | 2019-06-30 | An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because PngImage::readMetad… |
CVE-2019-13107 | Critical | 9.8 | 2019-06-30 | Multiple integer overflows exist in MATIO before 1.5.16, related to mat.c, mat4.c, mat5.c, mat73.c, and matvar_struct.c |
CVE-2019-13086 | Critical | 9.8 | 2019-06-30 | core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrf_… |
CVE-2019-13085 | High | 7.8 | 2019-06-30 | XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000030ecfa. |
CVE-2019-13084 | High | 7.8 | 2019-06-30 | XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000026b739. |
CVE-2019-13083 | High | 7.8 | 2019-06-30 | XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000384e2a. |
CVE-2019-13082 | Critical | 9.8 | 2019-06-30 | Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. It extracts a ZIP archive before checking… |
CVE-2019-11829 | High | 7.3 | 2019-06-30 | OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to execute arbitrary commands… |