2019 CVEs (page 114)
Page 114 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-11828 | Medium | 5.5 | 2019-06-30 | Cross-site scripting (XSS) vulnerability in Chart in Synology Office before 3.1.4-2771 allows remote authenticated users to inject arbitrary web script or HTML… |
CVE-2019-11827 | Medium | 6.5 | 2019-06-30 | Cross-site scripting (XSS) vulnerability in SYNO.NoteStation.Shard in Synology Note Station before 2.5.3-0863 allows remote attackers to inject arbitrary web s… |
CVE-2019-11826 | High | 8.0 | 2019-06-30 | Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users to upload arbitrary… |
CVE-2019-11825 | Medium | 6.5 | 2019-06-30 | Cross-site scripting (XSS) vulnerability in Event Editor in Synology Calendar before 2.3.0-0615 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2019-11822 | Medium | 4.3 | 2019-06-30 | Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to upl… |
CVE-2019-11821 | High | 7.3 | 2019-06-30 | SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to execute arbi… |
CVE-2019-13075 | Medium | 5.3 | 2019-06-30 | Tor Browser through 8.5.3 has an information exposure vulnerability. It allows remote attackers to detect the browser's language via vectors involving an IFRAM… |
CVE-2019-13072 | Medium | 5.4 | 2019-06-30 | Stored XSS in the Filters page (Name field) in ZoneMinder 1.32.3 allows a malicious user to embed and execute JavaScript code in the browser of any user who na… |
CVE-2019-13068 | Medium | 5.4 | 2019-06-30 | public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field). |
CVE-2019-13067 | Critical | 9.8 | 2019-06-30 | njs through 0.3.3, used in NGINX, has a buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c. This issue occurs after the fix for CVE-2019-12207 is in place. |
CVE-2019-13055 | Medium | 6.5 | 2019-06-29 | Certain Logitech Unifying devices allow attackers to dump AES keys and addresses, leading to the capability of live decryption of Radio Frequency transmissions… |
CVE-2019-13054 | Medium | 6.5 | 2019-06-29 | The Logitech R500 presentation clicker allows attackers to determine the AES key, leading to keystroke injection. On Windows, any text may be injected by using… |
CVE-2019-13053 | Medium | 6.5 | 2019-06-29 | Logitech Unifying devices allow keystroke injection, bypassing encryption. The attacker must press a "magic" key combination while sniffing cryptographic data… |
CVE-2019-13052 | Medium | 6.5 | 2019-06-29 | Logitech Unifying devices allow live decryption if the pairing of a keyboard to a receiver is sniffed. |
CVE-2019-13050 | High | 7.5 | 2019-06-29 | Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver confi… |
CVE-2019-13049 | High | 7.8 | 2019-06-29 | An integer wrap in kernel/sys/syscall.c in ToaruOS 1.10.10 allows users to map arbitrary kernel pages into userland process space via TOARU_SYS_FUNC_MMAP, lead… |
CVE-2019-13048 | Medium | 5.5 | 2019-06-29 | kernel/sys/syscall.c in ToaruOS through 1.10.9 allows a denial of service upon a critical error in certain sys_sbrk allocation patterns (involving PAGE_SIZE, a… |
CVE-2019-13047 | High | 7.8 | 2019-06-29 | kernel/sys/syscall.c in ToaruOS through 1.10.9 has incorrect access control in sys_sysfunc case 9 for TOARU_SYS_FUNC_SETHEAP, allowing arbitrary kernel pages t… |
CVE-2019-13046 | High | 7.8 | 2019-06-29 | linker/linker.c in ToaruOS through 1.10.9 has insecure LD_LIBRARY_PATH handling in setuid applications. |
CVE-2019-13045 | High | 8.1 | 2019-06-29 | Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server. |
CVE-2019-13038 | Medium | 6.1 | 2019-06-29 | mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL. |
CVE-2019-13035 | High | 7.8 | 2019-06-29 | Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\PandoraFMS and its sub-folders, allowing standar… |
CVE-2019-13032 | Medium | 5.5 | 2019-06-28 | An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() or GetRelativePathsToXhtmlDocuments() whe… |
CVE-2019-13031 | High | 8.1 | 2019-06-28 | LemonLDAP::NG before 1.9.20 has an XML External Entity (XXE) issue when submitting a notification to the notification server. By default, the notification serv… |
CVE-2019-13028 | High | 8.8 | 2019-06-28 | An incorrect implementation of a local web server in eID client (Windows version before 3.1.2, Linux version before 3.0.3) allows remote attackers to execute a… |
CVE-2019-10993 | Critical | 9.8 | 2019-06-28 | In WebAccess/SCADA Versions 8.3.5 and prior, multiple untrusted pointer dereference vulnerabilities may allow a remote attacker to execute arbitrary code. |
CVE-2019-10991 | Critical | 9.8 | 2019-06-28 | In WebAccess/SCADA, Versions 8.3.5 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of u… |
CVE-2019-10989 | Critical | 9.8 | 2019-06-28 | In WebAccess/SCADA Versions 8.3.5 and prior, multiple heap-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of use… |
CVE-2019-10987 | High | 8.8 | 2019-06-28 | In WebAccess/SCADA Versions 8.3.5 and prior, multiple out-of-bounds write vulnerabilities are caused by a lack of proper validation of the length of user-suppl… |
CVE-2019-10985 | Critical | 9.1 | 2019-06-28 | In WebAccess/SCADA, Versions 8.3.5 and prior, a path traversal vulnerability is caused by a lack of proper validation of a user-supplied path prior to use in f… |
CVE-2019-10983 | High | 7.5 | 2019-06-28 | In WebAccess/SCADA Versions 8.3.5 and prior, an out-of-bounds read vulnerability is caused by a lack of proper validation of user-supplied data. Exploitation o… |
CVE-2019-10964 | High | 7.1 | 2019-06-28 | Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters… |
CVE-2019-10175 | Medium | 6.5 | 2019-06-28 | A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the req… |
CVE-2019-9843 | High | 7.5 | 2019-06-28 | In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP… |
CVE-2019-12932 | Medium | 6.1 | 2019-06-28 | A stored XSS vulnerability was found in SeedDMS 5.1.11 due to poorly escaping the search result in the autocomplete search form placed in the header of out/out… |
CVE-2019-4269 | High | 7.5 | 2019-06-28 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console could allow a remote attacker to obtain sensitive information when a specially crafted ur… |
CVE-2019-9846 | High | 8.8 | 2019-06-28 | RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause… |
CVE-2019-13012 | High | 7.5 | 2019-06-28 | The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and… |
CVE-2019-12997 | High | 8.8 | 2019-06-28 | In Loopchain through 2.2.1.3, an attacker can escalate privileges from a low-privilege shell by changing the environment (aka injection in the DEFAULT_SCORE_HO… |
CVE-2019-12995 | High | 7.5 | 2019-06-28 | Istio before 1.2.2 mishandles certain access tokens, leading to "Epoch 0 terminated with an error" in Envoy. This is related to a jwt_authenticator.cc segmenta… |
CVE-2019-3632 | High | 8.8 | 2019-06-27 | Directory Traversal vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to gain elevated pr… |
CVE-2019-3631 | High | 7.2 | 2019-06-27 | Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary… |
CVE-2019-3630 | High | 7.2 | 2019-06-27 | Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary… |
CVE-2019-3629 | Medium | 6.5 | 2019-06-27 | Application protection bypass vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows unauthenticated user to impe… |
CVE-2019-10177 | Medium | 6.5 | 2019-06-27 | A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly… |
CVE-2019-7225 | High | 8.8 | 2019-06-27 | The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These credentials allow the p… |
CVE-2019-5840 | Medium | 4.3 | 2019-06-27 | Incorrect security UI in popup blocker in Google Chrome on iOS prior to 75.0.3770.80 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2019-5839 | Medium | 4.3 | 2019-06-27 | Excessive data validation in URL parser in Google Chrome prior to 75.0.3770.80 allowed a remote attacker who convinced a user to input a URL to bypass website… |
CVE-2019-5838 | Medium | 4.3 | 2019-06-27 | Insufficient policy enforcement in extensions API in Google Chrome prior to 75.0.3770.80 allowed an attacker who convinced a user to install a malicious extens… |
CVE-2019-5837 | Medium | 6.5 | 2019-06-27 | Resource size information leakage in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-5836 | High | 8.8 | 2019-06-27 | Heap buffer overflow in ANGLE in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-5835 | Medium | 6.5 | 2019-06-27 | Object lifecycle issue in SwiftShader in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a… |
CVE-2019-5834 | Medium | 6.5 | 2019-06-27 | Insufficient data validation in Blink in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-5833 | Medium | 4.3 | 2019-06-27 | Incorrect dialog box scoping in browser in Google Chrome on Android prior to 75.0.3770.80 allowed a remote attacker to display misleading security UI via a cra… |
CVE-2019-5832 | Medium | 6.5 | 2019-06-27 | Insufficient policy enforcement in XMLHttpRequest in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2019-5831 | High | 8.8 | 2019-06-27 | Object lifecycle issue in V8 in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-5830 | Medium | 6.5 | 2019-06-27 | Insufficient policy enforcement in CORS in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-5829 | High | 8.8 | 2019-06-27 | Integer overflow in download manager in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via a… |
CVE-2019-5828 | High | 8.8 | 2019-06-27 | Object lifecycle issue in ServiceWorker in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially perform out of bounds memory access via… |
CVE-2019-5827 | High | 8.8 | 2019-06-27 | Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2019-5824 | High | 8.8 | 2019-06-27 | Parameter passing error in media in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2019-5823 | Medium | 5.4 | 2019-06-27 | Insufficient policy enforcement in service workers in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass navigation restrictions via a cr… |
CVE-2019-5822 | High | 8.8 | 2019-06-27 | Inappropriate implementation in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass same origin policy via a crafted HTML page. |
CVE-2019-5821 | High | 8.8 | 2019-06-27 | Integer overflow in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2019-5820 | High | 8.8 | 2019-06-27 | Integer overflow in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2019-5819 | High | 7.8 | 2019-06-27 | Insufficient data validation in developer tools in Google Chrome on OS X prior to 74.0.3729.108 allowed a local attacker to execute arbitrary code via a crafte… |
CVE-2019-5818 | Medium | 6.5 | 2019-06-27 | Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2019-5817 | High | 8.8 | 2019-06-27 | Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2019-5816 | High | 8.8 | 2019-06-27 | Process lifetime issue in Chrome in Google Chrome on Android prior to 74.0.3729.108 allowed a remote attacker to potentially persist an exploited process via a… |
CVE-2019-5814 | Medium | 6.5 | 2019-06-27 | Insufficient policy enforcement in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-5813 | High | 8.8 | 2019-06-27 | Use after free in V8 in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-5812 | Medium | 6.5 | 2019-06-27 | Inadequate security UI in iOS UI in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-5811 | High | 8.8 | 2019-06-27 | Incorrect handling of CORS in ServiceWorker in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass same origin policy via a crafted HTML p… |
CVE-2019-5810 | Medium | 6.5 | 2019-06-27 | Information leak in autofill in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2019-5809 | High | 8.8 | 2019-06-27 | Use after free in file chooser in Google Chrome prior to 74.0.3729.108 allowed a remote attacker who had compromised the renderer process to perform privilege… |
CVE-2019-5808 | High | 8.8 | 2019-06-27 | Use after free in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-5807 | High | 8.8 | 2019-06-27 | Object lifetime issue in V8 in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-5806 | High | 8.8 | 2019-06-27 | Integer overflow in ANGLE in Google Chrome on Windows prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2019-5805 | Medium | 6.5 | 2019-06-27 | Use-after-free in PDFium in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2019-5786 | Medium | 6.5 | 2019-06-27 | Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a craft… |
CVE-2019-5785 | Medium | 6.5 | 2019-06-27 | Incorrect convexity calculations in Skia in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform an out of bounds memory write via a crafte… |
CVE-2019-5784 | Medium | 6.5 | 2019-06-27 | Incorrect handling of deferred code in V8 in Google Chrome prior to 72.0.3626.96 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2019-3628 | High | 8.8 | 2019-06-27 | Privilege escalation in McAfee Enterprise Security Manager (ESM) 11.x prior to 11.2.0 allows authenticated user to gain access to a core system component via i… |
CVE-2019-7227 | High | 7.3 | 2019-06-27 | In the ABB IDAL FTP server, an authenticated attacker can traverse to arbitrary directories on the hard disk with "CWD ../" and then use the FTP server functio… |
CVE-2019-7226 | High | 8.8 | 2019-06-27 | The ABB IDAL HTTP server CGI interface contains a URL that allows an unauthenticated attacker to bypass authentication and gain access to privileged functions… |
CVE-2019-7228 | High | 8.8 | 2019-06-27 | The ABB IDAL HTTP server mishandles format strings in a username or cookie during the authentication process. Attempting to authenticate with the username %25s… |
CVE-2019-12581 | Medium | 6.1 | 2019-06-27 | A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote atta… |
CVE-2019-4252 | High | 7.5 | 2019-06-27 | IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 could allow a remote attacker to traverse directories on the system. An attacker could send… |
CVE-2019-4250 | Medium | 5.4 | 2019-06-27 | IBM Jazz Foundation products (IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1) is vulnerable to cross-site scripting. This vulnerability al… |
CVE-2019-4249 | Medium | 5.4 | 2019-06-27 | IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J… |
CVE-2019-4084 | Medium | 4.3 | 2019-06-27 | IBM Jazz Foundation products (IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1) could allow an authenticated user to obtain sensitive inform… |
CVE-2019-4083 | Medium | 5.4 | 2019-06-27 | IBM Jazz Foundation products (IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1) is vulnerable to cross-site scripting. This vulnerability al… |
CVE-2019-12887 | High | 8.1 | 2019-06-27 | KeyIdentity LinOTP before 2.10.5.3 has Incorrect Access Control (issue 1 of 2). |
CVE-2019-12583 | Critical | 9.1 | 2019-06-27 | Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by direct… |
CVE-2019-1622 | Medium | 5.3 | 2019-06-27 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve s… |
CVE-2019-1621 | High | 7.5 | 2019-06-27 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to gain acces… |
CVE-2019-1620 | Critical | 9.8 | 2019-06-27 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to upload arb… |
CVE-2019-1619 | Critical | 9.8 | 2019-06-27 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass aut… |
CVE-2019-9039 | Critical | 9.8 | 2019-06-26 | In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements and extract sensiti… |
CVE-2019-10154 | High | 7.5 | 2019-06-26 | A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations. |