2019 CVEs (page 118)
Page 118 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-0177 | Medium | 4.4 | 2019-06-13 | Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via loca… |
CVE-2019-0175 | Medium | 4.4 | 2019-06-13 | Insufficient password protection in the attestation database for Open CIT may allow an authenticated user to potentially enable information disclosure via loca… |
CVE-2019-0174 | Low | 3.3 | 2019-06-13 | Logic condition in specific microprocessors may allow an authenticated user to potentially enable partial physical address information disclosure via local acc… |
CVE-2019-0164 | High | 7.3 | 2019-06-13 | Improper permissions in the installer for Intel(R) Turbo Boost Max Technology 3.0 driver version 1.0.0.1035 and before may allow an authenticated user to poten… |
CVE-2019-0157 | Medium | 5.5 | 2019-06-13 | Insufficient input validation in the Intel(R) SGX driver for Linux may allow an authenticated user to potentially enable a denial of service via local access. |
CVE-2019-0136 | High | 7.4 | 2019-06-13 | Insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver before version 21.10 may allow an unauthenticated user to potentially enable d… |
CVE-2019-0130 | High | 7.4 | 2019-06-13 | Reflected XSS in web interface for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an unauthenticated user to potenti… |
CVE-2019-0128 | High | 7.8 | 2019-06-13 | Improper permissions in the installer for Intel(R) Chipset Device Software (INF Update Utility) before version 10.1.1.45 may allow an authenticated user to esc… |
CVE-2019-0315 | High | 7.5 | 2019-06-12 | Under certain conditions the PI Integration Builder Web UI of SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.5… |
CVE-2019-0314 | Medium | 5.5 | 2019-06-12 | SAP Work Manager, versions: 6.3, 6.4, 6.5 and SAP Inventory Manager, version 4.3, allows an attacker to prevent legitimate users from accessing a service, eith… |
CVE-2019-0312 | Medium | 5.3 | 2019-06-12 | Several web pages provided SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 and SAP_XITOOL: 7.10 to 7.11, 7.3… |
CVE-2019-0311 | Medium | 6.1 | 2019-06-12 | Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600, 602, 603, 604, 605, 606, 616, 617) does not sufficiently encode user-controlled inpu… |
CVE-2019-7845 | High | 8.8 | 2019-06-12 | Adobe Flash Player versions 32.0.0.192 and earlier, 32.0.0.192 and earlier, and 32.0.0.192 and earlier have an use after free vulnerability. Successful exploit… |
CVE-2019-7840 | Critical | 9.8 | 2019-06-12 | ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a deserialization of untrusted data vulnerability. Successful e… |
CVE-2019-7839 | Critical | 9.8 | 2019-06-12 | ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a command injection vulnerability. Successful exploitation coul… |
CVE-2019-7838 | Critical | 9.8 | 2019-06-12 | ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a file extension blacklist bypass vulnerability. Successful exp… |
CVE-2019-5442 | High | 7.5 | 2019-06-12 | XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is… |
CVE-2019-10971 | High | 7.8 | 2019-06-12 | The application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an untrusted search path that could execute a mal… |
CVE-2019-9676 | High | 7.8 | 2019-06-12 | Buffer overflow vulnerability found in some Dahua IP Camera devices IPC-HFW1XXX,IPC-HDW1XXX,IPC-HFW2XXX Build before 2018/11. The vulnerability exits in the fu… |
CVE-2019-3947 | Critical | 9.8 | 2019-06-12 | Fuji Electric V-Server before 6.0.33.0 stores database credentials in project files as plaintext. An attacker that can gain access to the project file can reco… |
CVE-2019-3946 | High | 7.5 | 2019-06-12 | Fuji Electric V-Server before 6.0.33.0 is vulnerable to denial of service via a crafted UDP message sent to port 8005. An unauthenticated, remote attacker can… |
CVE-2019-11269 | Medium | 5.4 | 2019-06-12 | Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could… |
CVE-2019-0308 | Medium | 6.8 | 2019-06-12 | An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to ze… |
CVE-2019-0307 | Low | 2.4 | 2019-06-12 | Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secu… |
CVE-2019-0306 | Medium | 4.3 | 2019-06-12 | SAP HANA Extended Application Services (advanced model), version 1, allows authenticated low privileged XS Advanced Platform users such as SpaceAuditors to exe… |
CVE-2019-0305 | Medium | 4.3 | 2019-06-12 | Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restri… |
CVE-2019-0304 | Critical | 9.8 | 2019-06-12 | FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EX… |
CVE-2019-6584 | High | 8.8 | 2019-06-12 | A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy… |
CVE-2019-6582 | High | 7.1 | 2019-06-12 | A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions < V12.1a), Siveillance VMS 2018 R… |
CVE-2019-6581 | High | 8.8 | 2019-06-12 | A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions < V12.1a), Siveillance VMS 2018 R… |
CVE-2019-6580 | Critical | 9.8 | 2019-06-12 | A vulnerability has been identified in Siveillance VMS 2017 R2 (All versions < V11.2a), Siveillance VMS 2018 R1 (All versions < V12.1a), Siveillance VMS 2018 R… |
CVE-2019-6571 | High | 7.5 | 2019-06-12 | A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and V1.81.xx), SIEMENS LOGO!8 (6ED1052-xyy… |
CVE-2019-6567 | Medium | 5.5 | 2019-06-12 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All Versions < V5.2.4), SCALANCE X-200IRT switch family (incl… |
CVE-2019-3888 | Critical | 9.8 | 2019-06-12 | A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeR… |
CVE-2019-3875 | Medium | 6.5 | 2019-06-12 | A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL lis… |
CVE-2019-3873 | Medium | 6.4 | 2019-06-12 | It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker coul… |
CVE-2019-3872 | Medium | 5.4 | 2019-06-12 | It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x. An attacke… |
CVE-2019-10926 | Medium | 5.3 | 2019-06-12 | A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). Communication with the device is not encrypted. Data transmitted between t… |
CVE-2019-10925 | High | 7.1 | 2019-06-12 | A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). An authenticated attacker could escalate privileges by sending specially c… |
CVE-2019-1081 | Medium | 4.2 | 2019-06-12 | An information disclosure vulnerability exists when affected Microsoft browsers improperly handle objects in memory. An attacker who successfully exploited thi… |
CVE-2019-1080 | High | 7.5 | 2019-06-12 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt m… |
CVE-2019-1069 | High | 7.8 | 2019-06-12 | An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited… |
CVE-2019-1065 | High | 7.8 | 2019-06-12 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this… |
CVE-2019-1064 | High | 7.8 | 2019-06-12 | An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully explo… |
CVE-2019-1055 | High | 7.5 | 2019-06-12 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt m… |
CVE-2019-1054 | Medium | 5.0 | 2019-06-12 | A security feature bypass vulnerability exists in Edge that allows for bypassing Mark of the Web Tagging (MOTW). Failing to set the MOTW means that a large num… |
CVE-2019-1053 | Medium | 6.3 | 2019-06-12 | An elevation of privilege vulnerability exists when the Windows Shell fails to validate folder shortcuts. An attacker who successfully exploited the vulnerabil… |
CVE-2019-1052 | Medium | 4.2 | 2019-06-12 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |
CVE-2019-1051 | Medium | 4.2 | 2019-06-12 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |
CVE-2019-1050 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1049 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1048 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1047 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1046 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1045 | High | 7.8 | 2019-06-12 | An elevation of privilege vulnerability exists in the way that the Windows Network File System (NFS) handles objects in memory. An attacker who successfully ex… |
CVE-2019-1044 | Medium | 5.3 | 2019-06-12 | A security feature bypass vulnerability exists when Windows Secure Kernel Mode fails to properly handle objects in memory. To exploit the vulnerability, a loca… |
CVE-2019-1043 | Medium | 6.4 | 2019-06-12 | A remote code execution vulnerability exists in the way that comctl32.dll handles objects in memory. The vulnerability could corrupt memory in such a way that… |
CVE-2019-1041 | High | 7.0 | 2019-06-12 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this… |
CVE-2019-1040 | Medium | 5.3 | 2019-06-12 | A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) p… |
CVE-2019-1039 | Medium | 5.5 | 2019-06-12 | An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory. To exploit this vulnerability, an authenticate… |
CVE-2019-1038 | High | 7.5 | 2019-06-12 | A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that… |
CVE-2019-1036 | Medium | 5.4 | 2019-06-12 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2019-1035 | High | 7.8 | 2019-06-12 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploi… |
CVE-2019-1034 | High | 7.8 | 2019-06-12 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploi… |
CVE-2019-1033 | Medium | 5.4 | 2019-06-12 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2019-1032 | Medium | 5.4 | 2019-06-12 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2019-1031 | Medium | 5.4 | 2019-06-12 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2019-1029 | Medium | 5.9 | 2019-06-12 | A denial of service vulnerability exists in Skype for Business. An attacker who successfully exploited the vulnerability could cause Skype for Business to stop… |
CVE-2019-1028 | High | 7.8 | 2019-06-12 | An elevation of privilege exists in Windows Audio Service. An attacker who successfully exploited the vulnerability could run arbitrary code with elevated priv… |
CVE-2019-1027 | High | 7.8 | 2019-06-12 | An elevation of privilege exists in Windows Audio Service. An attacker who successfully exploited the vulnerability could run arbitrary code with elevated priv… |
CVE-2019-1026 | High | 7.8 | 2019-06-12 | An elevation of privilege exists in Windows Audio Service. An attacker who successfully exploited the vulnerability could run arbitrary code with elevated priv… |
CVE-2019-1025 | Medium | 6.5 | 2019-06-12 | A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could caus… |
CVE-2019-1024 | Medium | 4.2 | 2019-06-12 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |
CVE-2019-1023 | Medium | 6.5 | 2019-06-12 | An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge. An attacker who successf… |
CVE-2019-1022 | High | 7.8 | 2019-06-12 | An elevation of privilege exists in Windows Audio Service. An attacker who successfully exploited the vulnerability could run arbitrary code with elevated priv… |
CVE-2019-1021 | High | 7.8 | 2019-06-12 | An elevation of privilege exists in Windows Audio Service. An attacker who successfully exploited the vulnerability could run arbitrary code with elevated priv… |
CVE-2019-1019 | High | 8.5 | 2019-06-12 | A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages. To exploit this vulnerability, an… |
CVE-2019-1018 | High | 7.0 | 2019-06-12 | An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited this vulnerability cou… |
CVE-2019-1017 | High | 7.0 | 2019-06-12 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully ex… |
CVE-2019-1016 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-10157 | Medium | 4.7 | 2019-06-12 | It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An… |
CVE-2019-10155 | Low | 3.1 | 2019-06-12 | The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the… |
CVE-2019-10150 | Medium | 5.9 | 2019-06-12 | It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds. A… |
CVE-2019-1015 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1014 | High | 7.0 | 2019-06-12 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully ex… |
CVE-2019-1013 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1012 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1011 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1010 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1009 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1007 | High | 7.8 | 2019-06-12 | An elevation of privilege exists in Windows Audio Service. An attacker who successfully exploited the vulnerability could run arbitrary code with elevated priv… |
CVE-2019-1005 | High | 7.5 | 2019-06-12 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt m… |
CVE-2019-1003 | Medium | 4.2 | 2019-06-12 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |
CVE-2019-1002 | Medium | 4.2 | 2019-06-12 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |
CVE-2019-0998 | High | 7.8 | 2019-06-12 | An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations. An attacker who successfully exploited this vulnera… |
CVE-2019-0996 | Medium | 6.5 | 2019-06-12 | A spoofing vulnerability exists in Azure DevOps Server when it improperly handles requests to authorize applications, resulting in a cross-site request forgery… |
CVE-2019-0993 | Medium | 4.2 | 2019-06-12 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |
CVE-2019-0992 | Medium | 4.2 | 2019-06-12 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |
CVE-2019-0991 | Medium | 4.2 | 2019-06-12 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |
CVE-2019-0990 | Medium | 6.5 | 2019-06-12 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |