2019 CVEs (page 117)
Page 117 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-12881 | High | 7.8 | 2019-06-18 | i915_gem_userptr_get_pages in drivers/gpu/drm/i915/i915_gem_userptr.c in the Linux kernel 4.15.0 on Ubuntu 18.04.2 allows local users to cause a denial of serv… |
CVE-2019-12133 | High | 7.8 | 2019-06-18 | Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub… |
CVE-2019-12592 | Medium | 6.1 | 2019-06-18 | A universal Cross-site scripting (UXSS) vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackers to run arbitrary w… |
CVE-2019-12875 | Medium | 6.5 | 2019-06-18 | Alpine Linux abuild through 3.4.0 allows an unprivileged member of the abuild group to add an untrusted package via a --keys-dir option that causes acceptance… |
CVE-2019-12874 | Critical | 9.8 | 2019-06-18 | An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while pars… |
CVE-2019-4142 | High | 8.8 | 2019-06-18 | IBM Cloud Private 2.1.0, 3.1.0, 3.1.1, and 3.1.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorize… |
CVE-2019-7588 | Medium | 6.7 | 2019-06-18 | A vulnerability in the exacqVision Enterprise System Manager (ESM) v5.12.2 application whereby unauthorized privilege escalation can potentially be achieved. T… |
CVE-2019-12872 | High | 7.2 | 2019-06-18 | dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the role Publisher via view_unpushed_bundles.jsp. |
CVE-2019-7159 | High | 7.5 | 2019-06-18 | OX App Suite 7.10.1 and earlier allows Information Exposure. |
CVE-2019-6965 | Medium | 6.1 | 2019-06-18 | An XSS issue was discovered in i-doit Open 1.12 via the src/tools/php/qr/qr.php url parameter. |
CVE-2019-12823 | Medium | 6.1 | 2019-06-18 | Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS. |
CVE-2019-10998 | Medium | 6.8 | 2019-06-18 | An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046568) before 2019.0 LTS devices. Unlimite… |
CVE-2019-12868 | High | 7.2 | 2019-06-18 | app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled… |
CVE-2019-12865 | Medium | 5.5 | 2019-06-17 | In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free for the ms command. |
CVE-2019-5017 | Medium | 5.3 | 2019-06-17 | An exploitable information disclosure vulnerability exists in the KCodes NetUSB.ko kernel module that enables the ReadySHARE Printer functionality of at least… |
CVE-2019-5016 | Critical | 9.1 | 2019-06-17 | An exploitable arbitrary memory read vulnerability exists in the KCodes NetUSB.ko kernel module which enables the ReadySHARE Printer functionality of at least… |
CVE-2019-8323 | High | 7.5 | 2019-06-17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefor… |
CVE-2019-8322 | High | 7.5 | 2019-06-17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore… |
CVE-2019-8321 | High | 7.5 | 2019-06-17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is po… |
CVE-2019-7158 | Critical | 9.8 | 2019-06-17 | OX App Suite 7.10.0 and earlier has Incorrect Access Control. |
CVE-2019-8325 | High | 7.5 | 2019-06-17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is… |
CVE-2019-8324 | High | 8.8 | 2019-06-17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could in… |
CVE-2019-7579 | High | 7.5 | 2019-06-17 | An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. An ability exists for an unauthenticated user to browse a confidential ui/1.0.99.187766/dyn… |
CVE-2019-7315 | High | 7.5 | 2019-06-17 | Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.x are vulnerable to directory traversal via the web interface, as demonstrated… |
CVE-2019-11410 | High | 7.2 | 2019-06-17 | app/backup/index.php in the Backup Module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation, which allows aut… |
CVE-2019-11409 | High | 8.8 | 2019-06-17 | app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation th… |
CVE-2019-12801 | Medium | 6.1 | 2019-06-17 | out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Name. |
CVE-2019-12476 | Medium | 6.8 | 2019-06-17 | An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physica… |
CVE-2019-12248 | Medium | 4.3 | 2019-06-17 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.7, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5… |
CVE-2019-11408 | Medium | 6.1 | 2019-06-17 | XSS in app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 allows remote unauthenticated attackers to inject arbitrary JavaScript… |
CVE-2019-11407 | High | 7.2 | 2019-06-17 | app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 suffers from an information disclosure vulnerability due to excessive debug in… |
CVE-2019-10997 | Medium | 5.9 | 2019-06-17 | An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.1046568) before 2019.0 LTS devices. Protocol… |
CVE-2019-12789 | Medium | 6.8 | 2019-06-17 | An issue was discovered on Actiontec T2200H T2200H-31.128L.08 devices, as distributed by Telus. By attaching a UART adapter to the UART pins on the system boar… |
CVE-2019-12550 | Critical | 9.8 | 2019-06-17 | WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to login via SSH and TE… |
CVE-2019-12549 | Critical | 9.8 | 2019-06-17 | WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded private keys for the SSH daemon. The fingerprint of the SSH… |
CVE-2019-12497 | Medium | 5.3 | 2019-06-17 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5… |
CVE-2019-6327 | Critical | 9.8 | 2019-06-17 | HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an… |
CVE-2019-6326 | High | 7.2 | 2019-06-17 | HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have emb… |
CVE-2019-6325 | High | 8.8 | 2019-06-17 | HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an… |
CVE-2019-6324 | Medium | 4.8 | 2019-06-17 | HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an… |
CVE-2019-6323 | Medium | 6.1 | 2019-06-17 | HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an… |
CVE-2019-12181 | High | 8.8 | 2019-06-17 | A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux. |
CVE-2019-4177 | Low | 3.3 | 2019-06-17 | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-F… |
CVE-2019-4176 | Medium | 5.3 | 2019-06-17 | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to bypass security restrictions, caused by an error related to i… |
CVE-2019-4174 | Low | 3.3 | 2019-06-17 | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-F… |
CVE-2019-4173 | Medium | 6.5 | 2019-06-17 | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 could allow a remote attacker to obtain sensitive information, caused by a flaw in the HTTP OP… |
CVE-2019-4136 | Medium | 5.4 | 2019-06-17 | IBM Cognos Controller 10.2.0, 10.2.1, 10.3.0, 10.3.1, and 10.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Java… |
CVE-2019-4103 | High | 8.0 | 2019-06-17 | IBM Tivoli Netcool/Impact 7.1.0 allows for remote execution of command by low privileged User. Remote code execution allow to execute arbitrary code on system… |
CVE-2019-12855 | High | 7.4 | 2019-06-16 | In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connec… |
CVE-2019-12840 | High | 8.8 | 2019-06-15 | In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to upda… |
CVE-2019-12839 | High | 8.8 | 2019-06-15 | In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows authenticated atta… |
CVE-2019-12835 | Critical | 9.8 | 2019-06-15 | formats/xml.cpp in Leanify 0.4.3 allows for a controlled out-of-bounds write in xml_memory_writer::write via characters that require escaping. |
CVE-2019-12831 | High | 7.2 | 2019-06-15 | In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database… |
CVE-2019-12830 | High | 8.7 | 2019-06-15 | In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to [video] BBCode persistent XSS to take over a… |
CVE-2019-12829 | High | 7.5 | 2019-06-15 | radare2 through 3.5.1 mishandles the RParse API, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified ot… |
CVE-2019-12816 | High | 8.8 | 2019-06-15 | Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading a module with a cr… |
CVE-2019-9842 | High | 7.2 | 2019-06-14 | madskristensen MiniBlog through 2018-05-18 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesToDisk… |
CVE-2019-12828 | High | 8.8 | 2019-06-14 | An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to i… |
CVE-2019-0316 | Medium | 4.8 | 2019-06-14 | SAP NetWeaver Process Integration, versions: SAP_XIESR: 7.20, SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate user-controlled… |
CVE-2019-0303 | Medium | 6.1 | 2019-06-14 | SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter… |
CVE-2019-2259 | Critical | 9.8 | 2019-06-14 | Resource allocation error while playing the video whose dimensions are more than supported dimension in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect… |
CVE-2019-2257 | High | 7.8 | 2019-06-14 | Wrong permissions in configuration file can lead to unauthorized permission in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon In… |
CVE-2019-2256 | Critical | 9.8 | 2019-06-14 | An unprivileged user can craft a bitstream such that the payload encoded in the bitstream gains code execution in Snapdragon Auto, Snapdragon Compute, Snapdrag… |
CVE-2019-2255 | Critical | 9.8 | 2019-06-14 | An unprivileged user can craft a bitstream such that the payload encoded in the bitstream gains code execution in Snapdragon Auto, Snapdragon Compute, Snapdrag… |
CVE-2019-4403 | Medium | 5.4 | 2019-06-14 | IBM Connections 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the i… |
CVE-2019-4381 | Medium | 5.5 | 2019-06-14 | IBM i 7.27.3 Clustering could allow a local attacker to obtain sensitive information, caused by the use of advanced node failure detection using the REST API t… |
CVE-2019-4239 | Medium | 5.5 | 2019-06-14 | IBM MQ Advanced Cloud Pak (IBM Cloud Private 1.0.0 through 3.0.1) stores user credentials in plain in clear text which can be read by a local user. IBM X-Force… |
CVE-2019-12822 | High | 7.5 | 2019-06-14 | In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5.0.1, a header parsing vulnerability causes a memory assertion, out-of-bounds memory reference, and… |
CVE-2019-11770 | High | 8.1 | 2019-06-14 | In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over HTTP instead of HTTPS. Any of these art… |
CVE-2019-11582 | High | 8.8 | 2019-06-14 | An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers, in all versions prior to 3.1.3, allows remote attackers to gain remote… |
CVE-2019-10159 | Medium | 4.3 | 2019-06-14 | cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An… |
CVE-2019-10126 | Critical | 9.8 | 2019-06-14 | A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might le… |
CVE-2019-12819 | Medium | 5.5 | 2019-06-14 | An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in drivers/net/phy/mdio_bus.c calls put_device(), which will trigger… |
CVE-2019-12818 | High | 7.5 | 2019-06-14 | An issue was discovered in the Linux kernel before 4.20.15. The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller does not… |
CVE-2019-12813 | Medium | 5.9 | 2019-06-13 | An issue was discovered in Digital Persona U.are.U 4500 Fingerprint Reader v24. The key and salt used for obfuscating the fingerprint image exhibit cleartext w… |
CVE-2019-12802 | High | 7.8 | 2019-06-13 | In radare2 through 3.5.1, the rcc_context function of libr/egg/egg_lang.c mishandles changing context. This allows remote attackers to cause a denial of servic… |
CVE-2019-10962 | Medium | 5.3 | 2019-06-13 | BD Alaris Gateway versions, 1.0.13,1.1.3 Build 10,1.1.3 MR Build 11,1.1.5, and 1.1.6, The web browser user interface on the Alaris Gateway Workstation does not… |
CVE-2019-10959 | Critical | 10.0 | 2019-06-13 | BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impact the latest firmwa… |
CVE-2019-12799 | High | 8.8 | 2019-06-13 | In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in… |
CVE-2019-7321 | Critical | 9.8 | 2019-06-13 | Usage of an uninitialized variable in the function fz_load_jpeg in Artifex MuPDF 1.14 can result in a heap overflow vulnerability that allows an attacker to ex… |
CVE-2019-12798 | Critical | 9.8 | 2019-06-13 | An issue was discovered in Artifex MuJS 1.0.5. regcompx in regexp.c does not restrict regular expression program size, leading to an overflow of the parsed syn… |
CVE-2019-5439 | Medium | 6.5 | 2019-06-13 | A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit. |
CVE-2019-5286 | Medium | 6.1 | 2019-06-13 | There is a reflection XSS vulnerability in the HedEx products. Remote attackers send malicious links to users and trick users to click. Successfully exploit cl… |
CVE-2019-5245 | Medium | 5.3 | 2019-06-13 | HiSuite 9.1.0.300 versions and earlier contains a DLL hijacking vulnerability. This vulnerability exists due to some DLL file is loaded by HiSuite improperly… |
CVE-2019-11129 | Medium | 6.7 | 2019-06-13 | Out of bound read/write in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service an… |
CVE-2019-11128 | Medium | 6.7 | 2019-06-13 | Insufficient input validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of serv… |
CVE-2019-11127 | Medium | 6.7 | 2019-06-13 | Buffer overflow in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or inf… |
CVE-2019-11126 | Medium | 6.7 | 2019-06-13 | Pointer corruption in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or… |
CVE-2019-11125 | Medium | 6.7 | 2019-06-13 | Insufficient input validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of serv… |
CVE-2019-11124 | Medium | 6.7 | 2019-06-13 | Out of bound read/write in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service an… |
CVE-2019-11123 | Medium | 6.7 | 2019-06-13 | Insufficient session validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of se… |
CVE-2019-11119 | Critical | 9.8 | 2019-06-13 | Insufficient session validation in the service API for Intel(R) RWC3 version 4.186 and before may allow an unauthenticated user to potentially enable escalatio… |
CVE-2019-11117 | High | 7.8 | 2019-06-13 | Improper permissions in the installer for Intel(R) Omni-Path Fabric Manager GUI before version 10.9.2.1.1 may allow an authenticated user to potentially enable… |
CVE-2019-11092 | Medium | 4.4 | 2019-06-13 | Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via loca… |
CVE-2019-0183 | Low | 3.3 | 2019-06-13 | Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via loca… |
CVE-2019-0182 | Low | 3.3 | 2019-06-13 | Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via loca… |
CVE-2019-0181 | Medium | 6.7 | 2019-06-13 | Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via loca… |
CVE-2019-0180 | Medium | 4.4 | 2019-06-13 | Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via loca… |
CVE-2019-0179 | Medium | 4.4 | 2019-06-13 | Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via loca… |
CVE-2019-0178 | Low | 3.6 | 2019-06-13 | Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via loca… |