2019 CVEs (page 120)
Page 120 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-12600 | Critical | 9.8 | 2019-06-07 | SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 2 of 3). |
CVE-2019-12599 | Critical | 9.8 | 2019-06-07 | SuiteCRM 7.10.x before 7.10.17 and 7.11.x before 7.11.5 allows SQL Injection. |
CVE-2019-12598 | Critical | 9.8 | 2019-06-07 | SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 1 of 3). |
CVE-2019-10160 | Critical | 9.8 | 2019-06-07 | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and… |
CVE-2019-3477 | Medium | 6.1 | 2019-06-07 | Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect. |
CVE-2019-12777 | High | 7.8 | 2019-06-07 | An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They replace secure and pr… |
CVE-2019-12776 | Critical | 9.8 | 2019-06-07 | An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They include a hard-coded… |
CVE-2019-12775 | High | 8.8 | 2019-06-07 | An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They allow high-privileged… |
CVE-2019-12774 | Medium | 6.1 | 2019-06-07 | A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 70044_update_05032019-482 that could allow… |
CVE-2019-8283 | Medium | 6.5 | 2019-06-07 | Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it. |
CVE-2019-8282 | Medium | 5.3 | 2019-06-07 | Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs. This allows at… |
CVE-2019-4070 | Medium | 5.4 | 2019-06-07 | IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScrip… |
CVE-2019-4069 | High | 8.8 | 2019-06-07 | IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not properly validate file types, allowing an attacker to upload malicious content. IBM X-Forc… |
CVE-2019-4068 | High | 7.5 | 2019-06-07 | IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to brute force into the system. IBM X-Force… |
CVE-2019-4067 | High | 7.5 | 2019-06-07 | IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not require that users should have strong passwords by default, which makes it easier for atta… |
CVE-2019-4066 | High | 8.8 | 2019-06-07 | IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 could allow an authenciated user to create arbitrary users which could cause ID management issues a… |
CVE-2019-12477 | Medium | 5.5 | 2019-06-07 | Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without any authentication… |
CVE-2019-6532 | High | 7.8 | 2019-06-07 | Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user triggering incompatible type errors b… |
CVE-2019-6530 | High | 7.8 | 2019-06-07 | Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user causing heap-based buffer overflows… |
CVE-2019-12771 | Critical | 9.8 | 2019-06-07 | Command injection is possible in ThinStation through 6.1.1 via shell metacharacters after the cgi-bin/CdControl.cgi action= substring, or after the cgi-bin/Vol… |
CVE-2019-12763 | High | 7.5 | 2019-06-07 | The Security Camera CZ application through 1.6.8 for Android stores potentially sensitive recorded video in external data storage, which is readable by any app… |
CVE-2019-4257 | Medium | 4.3 | 2019-06-06 | IBM InfoSphere Information Server 11.5 and 11.7 is affected by an information disclosure vulnerability. Sensitive information in an error message may be used t… |
CVE-2019-4219 | Medium | 5.3 | 2019-06-06 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 generates an error message that includes sensitive information that could be used in further atta… |
CVE-2019-4218 | Low | 3.3 | 2019-06-06 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Forc… |
CVE-2019-4217 | Medium | 6.1 | 2019-06-06 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim… |
CVE-2019-4162 | High | 7.5 | 2019-06-06 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 is missing the HTTP Strict Transport Security header. Users can navigate by mistake to the unencr… |
CVE-2019-4161 | Low | 3.3 | 2019-06-06 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 discloses sensitive information to unauthorized users. The information can be used to mount furth… |
CVE-2019-12762 | Medium | 4.2 | 2019-06-06 | Xiaomi Mi 5s Plus devices allow attackers to trigger touchscreen anomalies via a radio signal between 198 kHz and 203 kHz, as demonstrated by a transmitter and… |
CVE-2019-12492 | Medium | 6.5 | 2019-06-06 | Gallagher Command Centre before 7.80.939, 7.90.x before 7.90.961, and 8.x before 8.00.1128 allows arbitrary event creation and information disclosure via the F… |
CVE-2019-11523 | Critical | 9.8 | 2019-06-06 | Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. No authentication/encryption is done. Attackers can fully interact w… |
CVE-2019-6452 | High | 8.8 | 2019-06-06 | Kyocera Command Center RX TASKalfa4501i and TASKalfa5052ci allows remote attackers to abuse the Test button in the machine address book to obtain a cleartext F… |
CVE-2019-6451 | High | 7.5 | 2019-06-06 | On SOYAL AR-727H and AR-829Ev5 devices, all CGI programs allow unauthenticated POST access. |
CVE-2019-5525 | High | 8.8 | 2019-06-06 | VMware Workstation (15.x before 15.1.0) contains a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) backend. A malicious user with… |
CVE-2019-5522 | High | 7.1 | 2019-06-06 | VMware Tools for Windows update addresses an out of bounds read vulnerability in vm3dmp driver which is installed with vmtools in Windows guest machines. This… |
CVE-2019-3790 | Medium | 6.1 | 2019-06-06 | The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, con… |
CVE-2019-3723 | Critical | 9.1 | 2019-06-06 | Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain a web parameter tampering vulnerability. A remote unauth… |
CVE-2019-3722 | High | 7.5 | 2019-06-06 | Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain an XML external entity (XXE) injection vulnerability. A… |
CVE-2019-3579 | Medium | 5.3 | 2019-06-06 | MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the co… |
CVE-2019-3578 | Medium | 6.1 | 2019-06-06 | MyBB 1.8.19 has XSS in the resetpassword function. |
CVE-2019-12761 | High | 7.5 | 2019-06-06 | A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIR… |
CVE-2019-12760 | Low | 3.3 | 2019-06-06 | A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that… |
CVE-2019-6989 | High | 8.8 | 2019-06-06 | TP-Link TL-WR940N is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the ipAddrDispose function. By sending specially crafte… |
CVE-2019-9929 | High | 8.8 | 2019-06-06 | Northern.tech CFEngine Enterprise 3.12.1 has Insecure Permissions. |
CVE-2019-7215 | Medium | 6.5 | 2019-06-06 | Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid o… |
CVE-2019-12291 | High | 7.5 | 2019-06-06 | HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by… |
CVE-2019-12135 | Critical | 9.8 | 2019-06-06 | An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier allows remote attacker… |
CVE-2019-7554 | Medium | 6.1 | 2019-06-06 | An issue was discovered in PHP Scripts Mall API Based Travel Booking 3.4.7. There is Reflected XSS via the flight-results.php d2 parameter. |
CVE-2019-7553 | Medium | 5.4 | 2019-06-06 | PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field. |
CVE-2019-7552 | Medium | 5.4 | 2019-06-06 | An issue was discovered in PHP Scripts Mall Investment MLM Software 2.0.2. Stored XSS was found in the the My Profile Section. This is due to lack of sanitizat… |
CVE-2019-7311 | High | 7.8 | 2019-06-06 | An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. A lack of encryption in how the user login cookie (admin-auth) is stored on a victim's comp… |
CVE-2019-7220 | Medium | 6.1 | 2019-06-06 | X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter. |
CVE-2019-12303 | High | 8.8 | 2019-06-06 | In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container. |
CVE-2019-12274 | High | 8.8 | 2019-06-06 | In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver opt… |
CVE-2019-8320 | High | 7.4 | 2019-06-06 | A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-c… |
CVE-2019-5305 | Medium | 5.5 | 2019-06-06 | The image processing module of some Huawei Mate 10 smartphones versions before ALP-L29 9.0.0.159(C185) has a memory double free vulnerability. An attacker tric… |
CVE-2019-5295 | Medium | 6.4 | 2019-06-06 | Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.125(C00E125R2P14T8) have an authorization bypass vulnerability. Due to improper authoriz… |
CVE-2019-5242 | High | 7.8 | 2019-06-06 | There is a code execution vulnerability in Huawei PCManager versions earlier than PCManager 9.0.1.50. The attacker can tricking a user to install and run a mal… |
CVE-2019-5241 | High | 7.8 | 2019-06-06 | There is a privilege escalation vulnerability in Huawei PCManager versions earlier than PCManager 9.0.1.50. The attacker can tricking a user to install and run… |
CVE-2019-5219 | Medium | 5.5 | 2019-06-06 | There is a double free vulnerability on certain drivers of Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0.0.181(C00E87R2P20T8). An attacker tric… |
CVE-2019-5216 | High | 7.0 | 2019-06-06 | There is a race condition vulnerability on Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.156(C00E156R2P14T8), Honor 10 smartphones ver… |
CVE-2019-5214 | Medium | 5.5 | 2019-06-06 | There is a use after free vulnerability on certain driver component in Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0.0.167(C00E85R2P20T8). An a… |
CVE-2019-12732 | Medium | 4.7 | 2019-06-06 | The Chartkick gem through 3.1.0 for Ruby allows XSS. |
CVE-2019-12134 | High | 8.8 | 2019-06-06 | CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in Workday through 32 via a value (provided by a low-privileged use… |
CVE-2019-11080 | High | 8.8 | 2019-06-06 | Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with neces… |
CVE-2019-4220 | Medium | 5.5 | 2019-06-06 | IBM InfoSphere Information Server 11.7.1.0 stores a common hard coded encryption key that could be used to decrypt sensitive information. IBM X-Force ID: 15922… |
CVE-2019-4201 | Medium | 6.1 | 2019-06-06 | IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persua… |
CVE-2019-4185 | High | 8.3 | 2019-06-06 | IBM InfoSphere Information Server 11.7.1 containers are vulnerable to privilege escalation due to an insecurely configured component. IBM X-Force ID: 158975. |
CVE-2019-4056 | Medium | 4.3 | 2019-06-06 | IBM Maximo Asset Management 7.6 Work Centers' application does not validate file type upon upload, allowing attackers to upload malicious files. IBM X-Force ID… |
CVE-2019-4048 | Low | 2.1 | 2019-06-06 | IBM Maximo Asset Management 7.6 could allow a physical user of the system to obtain sensitive information from a previous user of the same machine. IBM X-Force… |
CVE-2019-9158 | Medium | 5.7 | 2019-06-05 | Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control. |
CVE-2019-9157 | Medium | 5.7 | 2019-06-05 | Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure. |
CVE-2019-9156 | High | 8.0 | 2019-06-05 | Gemalto DS3 Authentication Server 2.6.1-SP01 allows OS Command Injection. |
CVE-2019-8385 | Critical | 9.8 | 2019-06-05 | An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and local file inclusion vulnerability in the T… |
CVE-2019-7672 | High | 8.8 | 2019-06-05 | Prima Systems FlexAir, Versions 2.3.38 and prior. The flash version of the web interface contains a hard-coded username and password, which may allow an authen… |
CVE-2019-7671 | Critical | 9.0 | 2019-06-05 | Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being returned to the user, which may allow an a… |
CVE-2019-6800 | High | 7.5 | 2019-06-05 | In TitanHQ SpamTitan through 7.03, a vulnerability exists in the spam rule update function. Updates are downloaded over HTTP, including scripts which are subse… |
CVE-2019-12494 | High | 8.5 | 2019-06-05 | In Gardener before 0.20.0, incorrect access control in seed clusters allows information disclosure by sending HTTP GET requests from one's own shoot clusters t… |
CVE-2019-9189 | High | 8.8 | 2019-06-05 | Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller… |
CVE-2019-9187 | High | 7.5 | 2019-06-05 | ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190228 allows SSRF via the aggregate plugin. The impact also includes reading local files via fi… |
CVE-2019-5394 | Medium | 5.1 | 2019-06-05 | The HPE Nonstop Maintenance Entity family of products are vulnerable to local disclosure of information, such as system layout and configuration. |
CVE-2019-12276 | High | 7.5 | 2019-06-05 | A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to r… |
CVE-2019-12196 | Critical | 9.8 | 2019-06-05 | A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary… |
CVE-2019-11988 | Critical | 9.8 | 2019-06-05 | A Remote Unauthorized Access vulnerability was identified in HPE Smart Update Manager (SUM) earlier than version 8.3.5. |
CVE-2019-11987 | High | 7.8 | 2019-06-05 | A security vulnerability in HPE Smart Update Manager (SUM) prior to v8.4 could allow local unauthorized elevation of privilege. |
CVE-2019-11226 | Medium | 5.4 | 2019-06-05 | CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News. |
CVE-2019-9642 | Critical | 9.8 | 2019-06-05 | An issue was discovered in proxy.php in pydio-core in Pydio through 8.2.2. Through an unauthenticated request, it possible to evaluate malicious PHP code by pl… |
CVE-2019-9548 | Critical | 10.0 | 2019-06-05 | Citrix Application Delivery Management (ADM) 12.1.x before 12.1.50.33 has Incorrect Access Control. |
CVE-2019-1882 | Medium | 5.4 | 2019-06-05 | A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cross-site scripting (XSS) attacks. The vu… |
CVE-2019-1881 | Medium | 4.7 | 2019-06-05 | A vulnerability in the web-based management interface of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to conduct a c… |
CVE-2019-1880 | Medium | 4.4 | 2019-06-05 | A vulnerability in the BIOS upgrade utility of Cisco Unified Computing System (UCS) C-Series Rack Servers could allow an authenticated, local attacker to insta… |
CVE-2019-1872 | Medium | 5.3 | 2019-06-05 | A vulnerability in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Series software could allow an unauthenticated, remote attacker to… |
CVE-2019-1870 | Medium | 6.1 | 2019-06-05 | A vulnerability in the web-based management interface of Cisco Enterprise Chat and Email (ECE) Center could allow an unauthenticated, remote attacker to conduc… |
CVE-2019-1868 | High | 7.5 | 2019-06-05 | A vulnerability in the web-based management interface of Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to access sensitive system… |
CVE-2019-1861 | High | 7.2 | 2019-06-05 | A vulnerability in the software update feature of Cisco Industrial Network Director could allow an authenticated, remote attacker to execute arbitrary code. Th… |
CVE-2019-1845 | High | 8.6 | 2019-06-05 | A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, Cisco TelePresence Vid… |
CVE-2019-1842 | Medium | 5.4 | 2019-06-05 | A vulnerability in the Secure Shell (SSH) authentication function of Cisco IOS XR Software could allow an authenticated, remote attacker to successfully log in… |
CVE-2019-12555 | High | 7.5 | 2019-06-05 | In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the SubStr function (provided by the scripting engine) allow… |
CVE-2019-12554 | High | 7.5 | 2019-06-05 | In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the WSubStr function (provided by the scripting engine) allo… |
CVE-2019-12553 | Critical | 9.8 | 2019-06-05 | In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the StrCat function (provided by the scripting engine) allow… |
CVE-2019-11983 | High | 7.0 | 2019-06-05 | A remote buffer overflow vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (… |