2019 CVEs (page 12)
Page 12 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-11556 | Medium | 6.1 | 2020-09-25 | Pagure before 5.6 allows XSS via the templates/blame.html blame view. |
CVE-2019-7178 | High | 7.2 | 2020-09-25 | Pexip Infinity before 20.1 allows privilege escalation by restoring a system backup. |
CVE-2019-7177 | High | 7.2 | 2020-09-25 | Pexip Infinity before 20.1 allows Code Injection onto nodes via an admin. |
CVE-2019-1983 | Medium | 5.3 | 2020-09-23 | A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) and Cisco Content Security Management… |
CVE-2019-1947 | High | 8.6 | 2020-09-23 | A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remot… |
CVE-2019-1888 | High | 7.2 | 2020-09-23 | A vulnerability in the Administration Web Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to uplo… |
CVE-2019-1736 | Medium | 6.6 | 2020-09-23 | A vulnerability in the firmware of the Cisco UCS C-Series Rack Servers could allow an authenticated, physical attacker to bypass Unified Extensible Firmware In… |
CVE-2019-16028 | Critical | 9.8 | 2020-09-23 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to bypass auth… |
CVE-2019-16025 | Medium | 4.8 | 2020-09-23 | A vulnerability in the web framework of Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack… |
CVE-2019-16023 | High | 7.5 | 2020-09-23 | Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unaut… |
CVE-2019-16021 | High | 7.5 | 2020-09-23 | Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unaut… |
CVE-2019-16019 | High | 8.6 | 2020-09-23 | Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unaut… |
CVE-2019-16017 | Medium | 6.8 | 2020-09-23 | A vulnerability in the Operations, Administration, Maintenance and Provisioning (OAMP) OpsConsole Server for Cisco Unified Customer Voice Portal (CVP) could al… |
CVE-2019-16009 | High | 8.8 | 2020-09-23 | A vulnerability in the web UI of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (C… |
CVE-2019-16007 | High | 7.1 | 2020-09-23 | A vulnerability in the inter-service communication of Cisco AnyConnect Secure Mobility Client for Android could allow an unauthenticated, local attacker to per… |
CVE-2019-16004 | Medium | 6.5 | 2020-09-23 | A vulnerability in the REST API endpoint of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on a… |
CVE-2019-16000 | Medium | 4.4 | 2020-09-23 | A vulnerability in the automatic update process of Cisco Umbrella Roaming Client for Windows could allow an authenticated, local attacker to install arbitrary… |
CVE-2019-15993 | Medium | 5.3 | 2020-09-23 | A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vuln… |
CVE-2019-15992 | High | 7.2 | 2020-09-23 | A vulnerability in the implementation of the Lua interpreter integrated in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense… |
CVE-2019-15974 | Medium | 6.1 | 2020-09-23 | A vulnerability in the web interface of Cisco Managed Services Accelerator (MSX) could allow an unauthenticated, remote attacker to redirect a user to a malici… |
CVE-2019-15969 | Medium | 6.1 | 2020-09-23 | A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct cross-si… |
CVE-2019-15963 | Medium | 6.5 | 2020-09-23 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive i… |
CVE-2019-15959 | Medium | 6.6 | 2020-09-23 | A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vu… |
CVE-2019-15957 | High | 7.2 | 2020-09-23 | A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker with admi… |
CVE-2019-15289 | High | 7.5 | 2020-09-23 | Multiple vulnerabilities in the video service of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an unauthenticated, remot… |
CVE-2019-15287 | High | 7.8 | 2020-09-23 | Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to… |
CVE-2019-15285 | High | 7.8 | 2020-09-23 | Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to… |
CVE-2019-15283 | High | 7.8 | 2020-09-23 | Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to… |
CVE-2019-20919 | Medium | 4.7 | 2020-09-17 | An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly t… |
CVE-2019-4671 | Medium | 6.3 | 2020-09-15 | IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow th… |
CVE-2019-14761 | Medium | 4.4 | 2020-09-14 | An issue was discovered in KaiOS 2.5. The pre-installed Note application is vulnerable to HTML and JavaScript injection attacks. A local attacker can inject ar… |
CVE-2019-14760 | Medium | 4.4 | 2020-09-14 | An issue was discovered in KaiOS 2.5. The pre-installed Recorder application is vulnerable to HTML and JavaScript injection attacks. A local attacker can injec… |
CVE-2019-14759 | Medium | 4.4 | 2020-09-14 | An issue was discovered in KaiOS 1.0, 2.5, and 2.5.1. The pre-installed Radio application is vulnerable to HTML and JavaScript injection attacks. A local attac… |
CVE-2019-14758 | Medium | 6.1 | 2020-09-14 | An issue was discovered in KaiOS 2.5 and 2.5.1. The pre-installed File Manager application is vulnerable to HTML and JavaScript injection attacks. An attacker… |
CVE-2019-14757 | Medium | 6.1 | 2020-09-14 | An issue was discovered in KaiOS 2.5 and 2.5.1. The pre-installed Contacts application is vulnerable to HTML and JavaScript injection attacks. An attacker can… |
CVE-2019-14756 | Medium | 6.1 | 2020-09-14 | An issue was discovered in KaiOS 1.0, 2.5, and 2.5.12.5. The pre-installed Email application is vulnerable to HTML and JavaScript injection attacks. An attacke… |
CVE-2019-0233 | High | 7.5 | 2020-09-14 | An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload. |
CVE-2019-0230 | Critical | 9.8 | 2020-09-14 | Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. |
CVE-2019-20918 | Medium | 6.5 | 2020-09-11 | An issue was discovered in InspIRCd 3 before 3.1.0. The silence module contains a use after free vulnerability. This vulnerability can be used for remote crash… |
CVE-2019-20917 | Medium | 6.5 | 2020-09-11 | An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connect… |
CVE-2019-14119 | High | 7.0 | 2020-09-08 | u'While processing SMCInvoke asynchronous message header, message count is modified leading to a TOCTOU race condition and lead to memory corruption' in Snapdr… |
CVE-2019-14117 | High | 7.8 | 2020-09-08 | u'Whenever the page list is updated via privileged user, the previous list elements are freed but are not deleted from the list which results in a use after fr… |
CVE-2019-14115 | Medium | 5.5 | 2020-09-08 | u'Information disclosure issue occurs as in current logic as secure touch is released without clearing the display session which can result in user reading the… |
CVE-2019-14089 | High | 7.8 | 2020-09-08 | u'Keymaster attestation key and device IDs provisioning which is a one time process is incorrectly allowed to be re-provisioned after a user data erase or a fa… |
CVE-2019-14074 | High | 7.8 | 2020-09-08 | u'Heap overflow in diag command handler due to lack of check of packet length received from user' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivi… |
CVE-2019-14065 | High | 7.8 | 2020-09-08 | u'Pointer double free in HavenSvc due to not setting the pointer to NULL after freeing it' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Sna… |
CVE-2019-14056 | High | 7.8 | 2020-09-08 | u'Possible integer overflow in API due to lack of check on large oid range count in cert extension field' in Snapdragon Auto, Snapdragon Compute, Snapdragon Co… |
CVE-2019-14052 | Critical | 9.8 | 2020-09-08 | u'Accessing an uninitialized data structure could result in partially copying of contents and thus incorrect processing' in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-14025 | Medium | 5.5 | 2020-09-08 | u'When a new session is created, Object is returned that contains TZ addresses and it get passed to HLOS as an handle to refer to a particular session and can… |
CVE-2019-13999 | High | 7.8 | 2020-09-08 | u'Lack of check for integer overflow for round up and addition operations result into memory corruption and potential information leakage' in Snapdragon Auto… |
CVE-2019-13998 | High | 7.8 | 2020-09-08 | u'Lack of check that the TX FIFO write and read indices that are read from shared RAM are less than the FIFO size results into memory corruption and potential… |
CVE-2019-13995 | High | 7.8 | 2020-09-08 | u'Lack of integer overflow check for addition of fragment size and remaining size that are read from shared memory can lead to memory corruption and potential… |
CVE-2019-13994 | High | 7.8 | 2020-09-08 | u'Lack of check that the current received data fragment size of a particular packet that are read from shared memory are less than the actual packet size can l… |
CVE-2019-13992 | High | 7.8 | 2020-09-08 | u'Out of bound memory access if stack push and pop operation are performed without doing a bound check on stack top' in Snapdragon Auto, Snapdragon Compute, Sn… |
CVE-2019-10629 | High | 7.8 | 2020-09-08 | u'User Process can potentially corrupt kernel virtual page by passing a crafted page in API' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, S… |
CVE-2019-10628 | High | 7.8 | 2020-09-08 | u'Memory can be potentially corrupted if random index is allowed to manipulate TLB entries in Kernel from user library' in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-10615 | High | 7.8 | 2020-09-08 | u'Possibility of integer overflow in keymaster 4 while allocating memory due to multiplication of large numcerts value and size of keymaster bob which can lead… |
CVE-2019-10596 | High | 7.8 | 2020-09-08 | u'Improper access control can lead signed process to guess pid of other processes and access their address space' in Snapdragon Auto, Snapdragon Compute, Snapd… |
CVE-2019-10562 | High | 7.8 | 2020-09-08 | u'Improper authentication and signature verification of debug polices in secure boot loader will allow unverified debug policies to be loaded into secure memor… |
CVE-2019-10527 | High | 7.8 | 2020-09-08 | u'SMEM partition can be manipulated in case of any compromise on HLOS, thus resulting in access to memory outside of SMEM address range which could lead to mem… |
CVE-2019-20916 | High | 7.5 | 2020-09-04 | The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../… |
CVE-2019-3881 | High | 7.8 | 2020-09-04 | Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home d… |
CVE-2019-11928 | Medium | 6.1 | 2020-09-03 | An input validation issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed cross-site scripting upon clicking on a link from a specially craf… |
CVE-2019-10679 | High | 7.8 | 2020-09-03 | Thomson Reuters Eikon 4.0.42144 allows all local users to modify the service executable file because of weak %PROGRAMFILES(X86)%\Thomson Reuters\Eikon permissi… |
CVE-2019-5645 | High | 7.5 | 2020-09-01 | By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When e… |
CVE-2019-4579 | Medium | 4.3 | 2020-08-28 | IBM Resilient SOAR 38 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the… |
CVE-2019-4533 | Medium | 4.3 | 2020-08-28 | IBM Resilient SOAR V38.0 users may experience a denial of service of the SOAR Platform due to a insufficient input validation. IBM X-Force ID: 165589. |
CVE-2019-19499 | Medium | 6.5 | 2020-08-28 | Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source… |
CVE-2019-5321 | High | 8.8 | 2020-08-26 | Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 2930M, 2920, 5400R, and 3810M with firmware 16.08.* before 16.08.0009, 16.09.* before 16.09.0007, 16.10… |
CVE-2019-5320 | Medium | 6.1 | 2020-08-26 | Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 2930M, 2920, 5400R, and 3810M with firmware 16.08.* before 16.08.0009, 16.09.* before 16.09.0007, 16.10… |
CVE-2019-4695 | Low | 3.3 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 1719… |
CVE-2019-4713 | High | 8.8 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a speci… |
CVE-2019-4701 | Medium | 5.3 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is deployed with active debugging code that can create unintended entry points. IBM X-Force ID: 171936. |
CVE-2019-4699 | Low | 2.7 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated… |
CVE-2019-4698 | High | 7.5 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to… |
CVE-2019-4697 | Medium | 6.5 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID… |
CVE-2019-4694 | Critical | 9.8 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound… |
CVE-2019-4693 | Medium | 4.4 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by a local privileged user. IBM X-Force ID… |
CVE-2019-4692 | Medium | 5.3 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks… |
CVE-2019-4691 | Medium | 5.4 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i… |
CVE-2019-4689 | High | 7.5 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTT… |
CVE-2019-4688 | Medium | 4.3 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get… |
CVE-2019-4686 | Medium | 5.3 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get… |
CVE-2019-18847 | Critical | 9.8 | 2020-08-26 | Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1. |
CVE-2019-14904 | High | 7.3 | 2020-08-26 | A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checke… |
CVE-2019-11862 | High | 8.1 | 2020-08-21 | The SSH service on ALEOS before 4.12.0, 4.9.5, 4.4.9 allows traffic proxying. |
CVE-2019-11859 | Medium | 6.0 | 2020-08-21 | A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root. |
CVE-2019-11858 | Medium | 5.7 | 2020-08-21 | Multiple buffer overflow vulnerabilities exist in the AceManager Web API of ALEOS before 4.13.0, 4.9.5, and 4.4.9. |
CVE-2019-11857 | Critical | 9.1 | 2020-08-21 | Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system information. |
CVE-2019-11856 | Low | 3.3 | 2020-08-21 | A nonce reuse vulnerability exists in the ACEView service of ALEOS before 4.13.0, 4.9.5, and 4.4.9 allowing message replay. Captured traffic to the ACEView ser… |
CVE-2019-11855 | High | 8.1 | 2020-08-21 | An RPC server is enabled by default on the gateway's LAN of ALEOS before 4.12.0, 4.9.5, and 4.4.9. |
CVE-2019-11853 | Low | 3.9 | 2020-08-21 | Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0, and 4.9.4. |
CVE-2019-11852 | Low | 3.7 | 2020-08-21 | An out-of-bounds reads vulnerability exists in the ACEView Service of ALEOS before 4.13.0, 4.9.5, and 4.4.9. Sensitive information may be disclosed via the ACE… |
CVE-2019-11850 | Medium | 6.3 | 2020-08-21 | A stack overflow vulnerabiltity exist in the AT command interface of ALEOS before 4.11.0. The vulnerability may allow code execution |
CVE-2019-11849 | Medium | 6.3 | 2020-08-21 | A stack overflow vulnerabiltity exists in the AT command APIs of ALEOS before 4.11.0. The vulnerability may allow code execution. |
CVE-2019-11848 | Medium | 4.1 | 2020-08-21 | An API abuse vulnerability exists in the AT command API of ALEOS before 4.13.0, 4.9.5, 4.4.9 due to lack of length checking when handling certain user-provided… |
CVE-2019-11847 | High | 7.3 | 2020-08-21 | An improper privilege management vulnerabitlity exists in ALEOS before 4.11.0, 4.9.4 and 4.4.9. An authenticated user can escalate to root via the command shel… |
CVE-2019-20152 | Medium | 6.1 | 2020-08-20 | An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input, malicious JavaScript can be executed throu… |
CVE-2019-20151 | Medium | 6.1 | 2020-08-20 | An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input, malicious JavaScript can be executed by th… |
CVE-2019-20150 | Medium | 6.5 | 2020-08-20 | In TreasuryXpress 19191105, a logged-in user can discover saved credentials, even though the UI hides them. Using functionality within the application and a ma… |