2019 CVEs (page 123)
Page 123 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-12310 | Critical | 9.8 | 2019-06-03 | ExaGrid appliances with firmware version v4.8.1.1044.P50 have a /monitor/data/Upgrade/ directory traversal vulnerability, which allows remote attackers to view… |
CVE-2019-10147 | High | 7.7 | 2019-06-03 | rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are not limited by cgroups du… |
CVE-2019-10145 | High | 7.7 | 2019-06-03 | rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` do not have seccomp filtering… |
CVE-2019-10144 | High | 7.7 | 2019-06-03 | rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are given all capabilities du… |
CVE-2019-9883 | High | 8.8 | 2019-06-03 | Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via useradmin/cf_new.cg… |
CVE-2019-9882 | High | 8.8 | 2019-06-03 | Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist via user/save_list… |
CVE-2019-6739 | High | 8.8 | 2019-06-03 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Antimalware 3.6.1.2711. User interaction is re… |
CVE-2019-6738 | High | 8.8 | 2019-06-03 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is require… |
CVE-2019-6737 | High | 8.8 | 2019-06-03 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is require… |
CVE-2019-6736 | High | 8.8 | 2019-06-03 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is require… |
CVE-2019-12593 | High | 7.5 | 2019-06-03 | IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal. |
CVE-2019-12308 | Medium | 6.1 | 2019-06-03 | An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWi… |
CVE-2019-11646 | High | 8.8 | 2019-06-03 | Remote unauthorized command execution and unauthorized disclosure of information in Micro Focus Service Manager, versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9… |
CVE-2019-3802 | Medium | 5.3 | 2019-06-03 | This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatc… |
CVE-2019-3397 | Critical | 9.1 | 2019-06-03 | Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.13.x), from 5.14.0 before 5.14.4 (fixed… |
CVE-2019-11580 | Critical | 9.8 | 2019-06-03 | Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or au… |
CVE-2019-12591 | Medium | 6.8 | 2019-06-03 | NETGEAR Insight Cloud with firmware before Insight 5.6 allows remote authenticated users to achieve command injection. |
CVE-2019-12589 | High | 8.8 | 2019-06-03 | In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the… |
CVE-2019-12585 | Critical | 9.8 | 2019-06-03 | Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php. |
CVE-2019-12584 | Medium | 6.1 | 2019-06-03 | Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php. |
CVE-2019-12569 | High | 7.8 | 2019-06-03 | A vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to execute arbitrary commands on a targeted system. This vulnerability is… |
CVE-2019-12566 | Medium | 5.4 | 2019-06-03 | The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor r… |
CVE-2019-12564 | Critical | 9.8 | 2019-06-03 | In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for data/backup/DyyyymmddThhmmss… |
CVE-2019-12530 | Critical | 9.8 | 2019-06-02 | Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue.php, load.php, mem.php, traf.php, and… |
CVE-2019-12515 | High | 7.1 | 2019-06-02 | There is an out-of-bounds read vulnerability in the function FlateStream::getChar() located at Stream.cc in Xpdf 4.01.01. It can, for example, be triggered by… |
CVE-2019-9653 | Critical | 9.8 | 2019-05-31 | NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands via shell metacharacters to handle_load… |
CVE-2019-9106 | Critical | 9.8 | 2019-05-31 | The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to execute or include local .php file… |
CVE-2019-9105 | High | 7.5 | 2019-05-31 | The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to make several types of API calls wi… |
CVE-2019-6725 | Critical | 9.8 | 2019-05-31 | The rpWLANRedirect.asp ASP page is accessible without authentication on ZyXEL P-660HN-T1 V2 (2.00(AAKK.3)) devices. After accessing the page, the admin user's… |
CVE-2019-5678 | High | 7.8 | 2019-05-31 | NVIDIA GeForce Experience versions prior to 3.19 contains a vulnerability in the Web Helper component, in which an attacker with local system access can craft… |
CVE-2019-10123 | Critical | 9.8 | 2019-05-31 | SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous attacker to execute… |
CVE-2019-10069 | Critical | 9.8 | 2019-05-31 | In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly. |
CVE-2019-10049 | High | 7.3 | 2019-05-31 | It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an administrator user into opening a link shared… |
CVE-2019-10048 | High | 7.2 | 2019-05-31 | The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation and sanitization of user supplied input… |
CVE-2019-10047 | Medium | 5.4 | 2019-05-31 | A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of… |
CVE-2019-10046 | Medium | 5.3 | 2019-05-31 | An unauthenticated attacker can obtain information about the Pydio 8.2.2 configuration including session timeout, libraries, and license information. |
CVE-2019-10045 | Medium | 6.5 | 2019-05-31 | The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access… |
CVE-2019-10038 | High | 7.8 | 2019-05-31 | Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as the /Applications/Calculator.a… |
CVE-2019-9891 | Critical | 9.8 | 2019-05-31 | The function getopt_simple as described in Advanced Bash Scripting Guide (ISBN 978-1435752184) allows privilege escalation and execution of commands when used… |
CVE-2019-9875 | High | 8.8 | 2019-05-31 | Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a seria… |
CVE-2019-9874 | Critical | 9.8 | 2019-05-31 | Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unau… |
CVE-2019-10981 | High | 7.8 | 2019-05-31 | In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an authenticated local user access to Citect u… |
CVE-2019-9871 | Critical | 9.8 | 2019-05-31 | Jector Smart TV FM-K75 devices allow remote code execution because there is an adb open port with root permission. |
CVE-2019-10330 | High | 7.5 | 2019-05-31 | Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles eve… |
CVE-2019-10329 | High | 8.8 | 2019-05-31 | Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by user… |
CVE-2019-10328 | Critical | 9.9 | 2019-05-31 | Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypas… |
CVE-2019-10327 | High | 8.1 | 2019-05-31 | An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary direc… |
CVE-2019-10326 | Medium | 4.3 | 2019-05-31 | A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset warning counts for future builds. |
CVE-2019-10325 | Medium | 5.4 | 2019-05-31 | A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScr… |
CVE-2019-10324 | Medium | 6.5 | 2019-05-31 | A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenRe… |
CVE-2019-10323 | Medium | 4.3 | 2019-05-31 | A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall/Read access t… |
CVE-2019-10322 | Medium | 4.3 | 2019-05-31 | A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Rea… |
CVE-2019-10321 | Medium | 4.3 | 2019-05-31 | A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users… |
CVE-2019-12507 | Medium | 6.1 | 2019-05-31 | An XSS vulnerability exists in PHPRelativePath (aka Relative Path) through 1.0.2 via the RelativePath.Example1.php path parameter. |
CVE-2019-12502 | High | 8.8 | 2019-05-31 | There is a lack of CSRF countermeasures on MOBOTIX S14 MX-V4.2.1.61 cameras, as demonstrated by adding an admin account via the /admin/access URI. |
CVE-2019-12500 | Medium | 6.5 | 2019-05-31 | The Xiaomi M365 scooter 2019-02-12 before 1.5.1 allows spoofing of "suddenly accelerate" commands. This occurs because Bluetooth Low Energy commands have no se… |
CVE-2019-12499 | High | 8.1 | 2019-05-31 | Firejail before 0.9.60 allows truncation (resizing to length 0) of the firejail binary on the host by running exploit code inside a firejail sandbox and having… |
CVE-2019-12496 | High | 7.5 | 2019-05-31 | An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default. |
CVE-2019-12495 | Medium | 5.5 | 2019-05-31 | An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. Compiling a crafted source file leads to a one-byte out-of-bounds write in the gsym_addr… |
CVE-2019-12493 | High | 7.1 | 2019-05-31 | A stack-based buffer over-read exists in PostScriptFunction::transform in Function.cc in Xpdf 4.01.01 because GfxSeparationColorSpace and GfxDeviceNColorSpace… |
CVE-2019-12483 | High | 7.8 | 2019-05-30 | An issue was discovered in GPAC 0.7.1. There is a heap-based buffer overflow in the function ReadGF_IPMPX_RemoveToolNotificationListener in odf/ipmpx_code.c in… |
CVE-2019-12482 | High | 7.5 | 2019-05-30 | An issue was discovered in GPAC 0.7.1. There is a NULL pointer dereference in the function gf_isom_get_original_format_type at isomedia/drm_sample.c in libgpac… |
CVE-2019-12481 | Medium | 5.5 | 2019-05-30 | An issue was discovered in GPAC 0.7.1. There is a NULL pointer dereference in the function GetESD at isomedia/track.c in libgpac.a, as demonstrated by MP4Box. |
CVE-2019-12480 | High | 7.5 | 2019-05-30 | BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in AtomicWriteFile, Atom… |
CVE-2019-9723 | High | 7.1 | 2019-05-30 | LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and the creation of directories, in the cl… |
CVE-2019-8457 | Critical | 9.8 | 2019-05-30 | SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables. |
CVE-2019-11091 | Medium | 5.6 | 2019-05-30 | Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may allow an authentica… |
CVE-2019-12461 | Medium | 6.1 | 2019-05-30 | Web Port 1.19.1 allows XSS via the /log type parameter. |
CVE-2019-12460 | Medium | 6.1 | 2019-05-30 | Web Port 1.19.1 allows XSS via the /access/setup type parameter. |
CVE-2019-12459 | Medium | 5.3 | 2019-05-30 | FileRun 2019.05.21 allows customizables/plugins/audio_player Directory Listing. This issue has been fixed in FileRun 2019.06.01. |
CVE-2019-12458 | Medium | 5.3 | 2019-05-30 | FileRun 2019.05.21 allows css/ext-ux Directory Listing. This issue has been fixed in FileRun 2019.06.01. |
CVE-2019-12457 | Medium | 5.3 | 2019-05-30 | FileRun 2019.05.21 allows images/extjs Directory Listing. This issue has been fixed in FileRun 2019.06.01. |
CVE-2019-12456 | High | 7.8 | 2019-05-30 | An issue was discovered in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux kernel through 5.1.5. It allows local use… |
CVE-2019-12455 | Medium | 5.5 | 2019-05-30 | An issue was discovered in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c in the Linux kernel through 5.1.5. There is an unchecked kstrndup of derived_n… |
CVE-2019-12454 | High | 7.8 | 2019-05-30 | An issue was discovered in wcd9335_codec_enable_dec in sound/soc/codecs/wcd9335.c in the Linux kernel through 5.1.5. It uses kstrndup instead of kmemdup_nul, w… |
CVE-2019-9670 | Critical | 9.8 | 2019-05-29 | mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Au… |
CVE-2019-6981 | Medium | 6.5 | 2019-05-29 | Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component. |
CVE-2019-6980 | Critical | 9.8 | 2019-05-29 | Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component. |
CVE-2019-11896 | High | 7.1 | 2019-05-29 | A potential incorrect privilege assignment vulnerability exists in the 3rd party pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.907 that… |
CVE-2019-11895 | Medium | 5.3 | 2019-05-29 | A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in a… |
CVE-2019-11894 | Medium | 5.7 | 2019-05-29 | A potential improper access control vulnerability exists in the backup mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in una… |
CVE-2019-6322 | Medium | 6.8 | 2019-05-29 | HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI Firmware) where the runtime BIOS code could be tampered with if the TPM… |
CVE-2019-6321 | High | 7.2 | 2019-05-29 | HP has identified a security vulnerability with some versions of Workstation BIOS (UEFI Firmware) where the runtime BIOS code could be tampered with if the TPM… |
CVE-2019-11893 | High | 8.0 | 2019-05-29 | A potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home Controller (SHC) before 9.8.905 that m… |
CVE-2019-11892 | High | 8.0 | 2019-05-29 | A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in r… |
CVE-2019-11891 | High | 8.0 | 2019-05-29 | A potential incorrect privilege assignment vulnerability exists in the app pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may r… |
CVE-2019-6958 | Critical | 9.1 | 2019-05-29 | A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Confi… |
CVE-2019-6957 | Critical | 9.8 | 2019-05-29 | A recently discovered security vulnerability affects all Bosch Video Management System (BVMS) versions 9.0 and below, DIVAR IP 2000, 3000, 5000 and 7000, Video… |
CVE-2019-12452 | High | 7.5 | 2019-05-29 | types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access… |
CVE-2019-12347 | Medium | 6.1 | 2019-05-29 | In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php acti… |
CVE-2019-11872 | High | 8.8 | 2019-05-29 | The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. Succ… |
CVE-2019-7129 | Medium | 6.1 | 2019-05-29 | Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive info… |
CVE-2019-9866 | Medium | 6.5 | 2019-05-29 | An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.7.7 and 11.8.x before 11.8.3. It allows Information Disclosure. |
CVE-2019-9865 | High | 8.1 | 2019-05-29 | When RPC is enabled in Wind River VxWorks 6.9 prior to 6.9.1, a specially crafted RPC request can trigger an integer overflow leading to an out-of-bounds memor… |
CVE-2019-9858 | High | 8.8 | 2019-05-29 | Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Horde/Form/Type.php contains a vulnerable class that handles image upload in… |
CVE-2019-9732 | Critical | 9.8 | 2019-05-29 | An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 1… |
CVE-2019-9485 | Critical | 9.8 | 2019-05-29 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions. |
CVE-2019-9221 | Medium | 5.5 | 2019-05-29 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Cont… |
CVE-2019-12450 | Critical | 9.8 | 2019-05-29 | file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instea… |
CVE-2019-12449 | Medium | 5.7 | 2019-05-29 | An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with… |