2019 CVEs (page 119)
Page 119 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-0989 | Medium | 4.2 | 2019-06-12 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |
CVE-2019-0988 | High | 7.5 | 2019-06-12 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt m… |
CVE-2019-0986 | Medium | 6.3 | 2019-06-12 | An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks. An attacker who successfully exploi… |
CVE-2019-0985 | High | 7.8 | 2019-06-12 | A remote code execution vulnerability exists when the Microsoft Speech API (SAPI) improperly handles text-to-speech (TTS) input. The vulnerability could corrup… |
CVE-2019-0984 | High | 7.0 | 2019-06-12 | An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who succ… |
CVE-2019-0983 | High | 7.8 | 2019-06-12 | An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations. An attacker who successfully exploited this vulnera… |
CVE-2019-0977 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-0974 | High | 7.8 | 2019-06-12 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited… |
CVE-2019-0973 | High | 7.8 | 2019-06-12 | An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure libr… |
CVE-2019-0972 | Medium | 6.5 | 2019-06-12 | This security update corrects a denial of service in the Local Security Authority Subsystem Service (LSASS) caused when an authenticated attacker sends a speci… |
CVE-2019-0968 | Medium | 5.5 | 2019-06-12 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-0960 | High | 7.0 | 2019-06-12 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully ex… |
CVE-2019-0959 | High | 7.0 | 2019-06-12 | An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who succ… |
CVE-2019-0948 | Medium | 4.7 | 2019-06-12 | An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an exte… |
CVE-2019-0943 | High | 7.8 | 2019-06-12 | An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC). An attacker who successfully expl… |
CVE-2019-0941 | Medium | 4.4 | 2019-06-12 | A denial of service exists in Microsoft IIS Server when the optional request filtering feature improperly handles requests. An attacker who successfully exploi… |
CVE-2019-0920 | Medium | 4.3 | 2019-06-12 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt m… |
CVE-2019-0909 | High | 7.5 | 2019-06-12 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited… |
CVE-2019-0908 | High | 7.8 | 2019-06-12 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited… |
CVE-2019-0907 | High | 7.8 | 2019-06-12 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited… |
CVE-2019-0906 | High | 7.8 | 2019-06-12 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited… |
CVE-2019-0905 | High | 7.8 | 2019-06-12 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited… |
CVE-2019-0904 | High | 7.8 | 2019-06-12 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited… |
CVE-2019-0888 | High | 8.8 | 2019-06-12 | A remote code execution vulnerability exists in the way that ActiveX Data Objects (ADO) handle objects in memory. An attacker who successfully exploited the vu… |
CVE-2019-0722 | High | 8.8 | 2019-06-12 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2019-0713 | Medium | 6.8 | 2019-06-12 | A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating s… |
CVE-2019-0711 | Medium | 6.8 | 2019-06-12 | A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating s… |
CVE-2019-0710 | Medium | 6.8 | 2019-06-12 | A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating s… |
CVE-2019-0709 | High | 7.6 | 2019-06-12 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2019-0620 | High | 7.6 | 2019-06-12 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2019-12795 | High | 7.8 | 2019-06-11 | daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configu… |
CVE-2019-12149 | Critical | 9.8 | 2019-06-11 | SQL injection vulnerability in silverstripe/restfulserver module 1.0.x before 1.0.9, 2.0.x before 2.0.4, and 2.1.x before 2.1.2 and silverstripe/registry modul… |
CVE-2019-0197 | Medium | 4.2 | 2019-06-11 | A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an… |
CVE-2019-0196 | Medium | 5.3 | 2019-06-11 | A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory… |
CVE-2019-12154 | Critical | 9.1 | 2019-06-11 | XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources… |
CVE-2019-12153 | Critical | 10.0 | 2019-06-11 | Lack of validation in the HTML parser in RealObjects PDFreactor before 10.1.10722 leads to SSRF, allowing attackers to access network or file resources on beha… |
CVE-2019-12146 | Critical | 9.1 | 2019-06-11 | A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a flaw… |
CVE-2019-12145 | High | 7.5 | 2019-06-11 | A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An attacker can supply a string using spec… |
CVE-2019-12144 | Critical | 9.8 | 2019-06-11 | An issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a path traversal vulnerab… |
CVE-2019-12143 | Medium | 5.3 | 2019-06-11 | A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An attacker can supply a string using spec… |
CVE-2019-0220 | Medium | 5.3 | 2019-06-11 | A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directiv… |
CVE-2019-3413 | Medium | 5.4 | 2019-06-11 | All versions up to V20.18.40.R7.B1of ZTE NetNumen DAP product have an XSS vulnerability. Due to the lack of correct validation of client data in WEB applicatio… |
CVE-2019-3412 | Critical | 9.8 | 2019-06-11 | All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by command execution vulnerability. Due to some interfaces do not adequately verify parameters… |
CVE-2019-3411 | High | 7.5 | 2019-06-11 | All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by information leak vulnerability. Due to some interfaces can obtain the WebUI login password… |
CVE-2019-3410 | Medium | 4.6 | 2019-06-11 | All versions up to UKBB_WF820+_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability,which stems from the fac… |
CVE-2019-3409 | Critical | 9.0 | 2019-06-11 | All versions up to UKBB_WF820+_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by command injection vulnerability. Due to inadequate parameter veri… |
CVE-2019-12766 | Medium | 6.1 | 2019-06-11 | An issue was discovered in Joomla! before 3.9.7. The subform fieldtype does not sufficiently filter or validate input of subfields. This leads to XSS attack ve… |
CVE-2019-12765 | Critical | 9.8 | 2019-06-11 | An issue was discovered in Joomla! before 3.9.7. The CSV export of com_actionslogs is vulnerable to CSV injection. |
CVE-2019-12764 | Medium | 6.5 | 2019-06-11 | An issue was discovered in Joomla! before 3.9.7. The update server URL of com_joomlaupdate can be manipulated by non Super-Admin users. |
CVE-2019-11334 | Low | 3.7 | 2019-06-11 | An authentication bypass in website post requests in the Tzumi Electronics Klic Lock application 1.0.9 for mobile devices allows attackers to access resources… |
CVE-2019-12794 | Medium | 6.6 | 2019-06-11 | An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins (organization admins have the inherent ability to reset pa… |
CVE-2019-12749 | High | 7.1 | 2019-06-11 | dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, us… |
CVE-2019-10339 | High | 8.8 | 2019-06-11 | A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users with Overall/Read acce… |
CVE-2019-10338 | High | 8.8 | 2019-06-11 | A cross-site request forgery vulnerability in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed attackers to… |
CVE-2019-10337 | High | 7.5 | 2019-06-11 | An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file fo… |
CVE-2019-10336 | Medium | 6.1 | 2019-06-11 | A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlo… |
CVE-2019-10335 | Medium | 5.4 | 2019-06-11 | A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jenkins or control the… |
CVE-2019-10334 | Medium | 6.5 | 2019-06-11 | Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartUtility.java is used… |
CVE-2019-10333 | Medium | 4.3 | 2019-06-11 | Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access to obtain informati… |
CVE-2019-10332 | Medium | 4.3 | 2019-06-11 | A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with Overall/Read access to connect… |
CVE-2019-10331 | Medium | 4.3 | 2019-06-11 | A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed attackers to connect to a… |
CVE-2019-10226 | Medium | 5.4 | 2019-06-10 | HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor dispu… |
CVE-2019-11881 | Medium | 4.7 | 2019-06-10 | A vulnerability exists in Rancher before 2.2.4 in the login component, where the errorMsg parameter can be tampered to display arbitrary content, filtering tag… |
CVE-2019-12790 | High | 7.8 | 2019-06-10 | In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_lang_parsechar function of egg_lang.c. This allows remote attackers to cause a de… |
CVE-2019-12788 | High | 7.8 | 2019-06-10 | An issue was discovered in Photodex ProShow Producer v9.0.3797 (an application that runs with Administrator privileges). It is possible to perform a buffer ove… |
CVE-2019-11027 | Critical | 9.8 | 2019-06-10 | Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers… |
CVE-2019-9881 | Medium | 5.3 | 2019-06-10 | The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment'… |
CVE-2019-9880 | Critical | 9.1 | 2019-06-10 | An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to ret… |
CVE-2019-9879 | Critical | 9.8 | 2019-06-10 | The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. Thi… |
CVE-2019-12787 | High | 8.8 | 2019-06-10 | An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of… |
CVE-2019-12786 | High | 8.8 | 2019-06-10 | An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of… |
CVE-2019-11517 | Medium | 6.5 | 2019-06-10 | WampServer before 3.1.9 has CSRF in add_vhost.php because the synchronizer pattern implemented as remediation of CVE-2018-8817 was incomplete. An attacker coul… |
CVE-2019-6241 | High | 7.5 | 2019-06-10 | In Bevywise MQTTRoute 1.1 build 1018-002, a connect packet combined with a malformed unsubscribe request packet can be used to cause a Denial of Service attack… |
CVE-2019-11877 | Medium | 6.1 | 2019-06-10 | XSS on the PIX-Link Repeater/Router LV-WR09 with firmware v28K.MiniRouter.20180616 allows attackers to steal credentials without being connected to the network… |
CVE-2019-12780 | Critical | 9.8 | 2019-06-10 | The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action. A simple POST reque… |
CVE-2019-5243 | Medium | 4.3 | 2019-06-10 | There is a Clickjacking vulnerability in Huawei HG255s product. An attacker may trick user to click a link and affect the integrity of a device by exploiting t… |
CVE-2019-12387 | Medium | 6.1 | 2019-06-10 | In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF. |
CVE-2019-9087 | Critical | 9.8 | 2019-06-07 | HotelDruid before v2.3.1 has SQL Injection via the /tab_tariffe.php numtariffa1 parameter. |
CVE-2019-9086 | Critical | 9.8 | 2019-06-07 | HotelDruid before v2.3.1 has SQL Injection via the /visualizza_tabelle.php anno parameter. |
CVE-2019-9084 | Medium | 4.9 | 2019-06-07 | In Hoteldruid before 2.3.1, a division by zero was discovered in $num_tabelle in tab_tariffe.php (aka the numtariffa1 parameter) due to the mishandling of non-… |
CVE-2019-3957 | High | 7.4 | 2019-06-07 | Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating RsaSigna… |
CVE-2019-3956 | High | 7.4 | 2019-06-07 | Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating CltDHPub… |
CVE-2019-12506 | High | 8.8 | 2019-06-07 | Due to unencrypted and unauthenticated data communication, the wireless presenter Logitech R700 Laser Presentation Remote R-R0010 is prone to keystroke injecti… |
CVE-2019-12505 | High | 8.8 | 2019-06-07 | Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP1001 v1.3C is prone to keystroke injection attacks. Thus, an attack… |
CVE-2019-12504 | High | 8.8 | 2019-06-07 | Due to unencrypted and unauthenticated data communication, the wireless presenter Inateck WP2002 is prone to keystroke injection attacks. Thus, an attacker is… |
CVE-2019-3955 | High | 7.5 | 2019-06-07 | Dameware Remote Mini Control version 12.1.0.34 and prior contains a unauthenticated remote heap overflow due to the server not properly validating RsaPubKeyLen… |
CVE-2019-2102 | High | 8.8 | 2019-06-07 | In the Bluetooth Low Energy (BLE) specification, there is a provided example Long Term Key (LTK). If a BLE device were to use this as a hardcoded LTK, it is th… |
CVE-2019-2101 | Medium | 5.5 | 2019-06-07 | In uvc_parse_standard_control of uvc_driver.c, there is a possible out-of-bound read due to improper input validation. This could lead to local information dis… |
CVE-2019-2099 | High | 7.8 | 2019-06-07 | In nfa_rw_store_ndef_rx_buf of nfa_rw_act.cc, there is a possible out-of-bound write due to a missing bounds check. This could lead to local escalation of priv… |
CVE-2019-2098 | High | 7.8 | 2019-06-07 | In areNotificationsEnabledForPackage of NotificationManagerService.java, there is a possible permissions bypass due to a missing permissions check. This could… |
CVE-2019-2097 | Critical | 9.8 | 2019-06-07 | In HAliasAnalyzer.Query of hydrogen-alias-analysis.h, there is possible memory corruption due to type confusion. This could lead to remote code execution from… |
CVE-2019-2096 | High | 7.8 | 2019-06-07 | In EffectRelease of EffectBundle.cpp, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege in the audio… |
CVE-2019-2095 | High | 7.0 | 2019-06-07 | In callGenIDChangeListeners and related functions of SkPixelRef.cpp, there is a possible use after free due to a race condition. This could lead to remote code… |
CVE-2019-2094 | High | 7.8 | 2019-06-07 | In parseMPEGCCData of NuPlayerCCDecoder.cpp, there is a possible out of bounds write due to missing bounds checks. This could lead to remote code execution wit… |
CVE-2019-2093 | High | 8.8 | 2019-06-07 | In huff_dec_1D of nlc_dec.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no addition… |
CVE-2019-2092 | High | 7.8 | 2019-06-07 | In isSeparateProfileChallengeAllowed of DevicePolicyManagerService.java, there is a possible permissions bypass due to a missing permission check. This could l… |
CVE-2019-2091 | High | 7.8 | 2019-06-07 | In GetPermittedAccessibilityServicesForUser of DevicePolicyManagerService.java, there is a possible permissions bypass due to a missing permission check. This… |
CVE-2019-2090 | High | 7.8 | 2019-06-07 | In isPackageDeviceAdminOnAnyUser of PackageManagerService.java, there is a possible permissions bypass due to a missing permissions check. This could lead to l… |
CVE-2019-12779 | High | 7.1 | 2019-06-07 | libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) withou… |
CVE-2019-12601 | Critical | 9.8 | 2019-06-07 | SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 3 of 3). |