2019 CVEs (page 13)
Page 13 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-6258 | Critical | 9.8 | 2020-08-18 | D-Link DIR-822 Rev.Bx devices with firmware v.202KRb06 and older allow a buffer overflow via long MacAddress data in a /HNAP1/SetClientInfo HNAP protocol messa… |
CVE-2019-5591 | Medium | 6.5 | 2020-08-14 | A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating t… |
CVE-2019-19643 | High | 7.5 | 2020-08-14 | ise smart connect KNX Vaillant 1.2.839 contain a Denial of Service. |
CVE-2019-7410 | Medium | 6.1 | 2020-08-14 | There is stored cross site scripting (XSS) in Galileo CMS v0.042. Remote authenticated users could inject arbitrary web script or HTML via $page_title in /lib/… |
CVE-2019-6112 | Medium | 6.1 | 2020-08-14 | A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary w… |
CVE-2019-20383 | High | 7.8 | 2020-08-13 | ABBYY network license server in ABBYY FineReader 15 before Release 4 (aka 15.0.112.2130) allows escalation of privileges by local users via manipulations invol… |
CVE-2019-16374 | Critical | 9.8 | 2020-08-13 | Pega Platform 8.2.1 allows LDAP injection because a username can contain a * character and can be of unlimited length. An attacker can specify four characters… |
CVE-2019-4582 | Medium | 4.3 | 2020-08-13 | IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL… |
CVE-2019-14620 | Medium | 6.5 | 2020-08-13 | Insufficient control flow management for some Intel(R) Wireless Bluetooth(R) products may allow an unprivileged user to potentially enable denial of service vi… |
CVE-2019-14630 | Medium | 4.6 | 2020-08-13 | Reliance on untrusted inputs in a security decision in some Intel(R) Thunderbolt(TM) controllers may allow unauthenticated user to potentially enable informati… |
CVE-2019-17339 | Medium | 6.8 | 2020-08-11 | The VirtualRouter component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that theoretically allows an attacker to inject scripts via U… |
CVE-2019-19704 | High | 7.5 | 2020-08-08 | In JetBrains Upsource before 2020.1, information disclosure is possible because of an incorrect user matching algorithm. |
CVE-2019-7005 | High | 7.5 | 2020-08-07 | A vulnerability was discovered in the web interface component of IP Office that may potentially allow a remote, unauthenticated user with network access to gai… |
CVE-2019-20001 | High | 7.8 | 2020-08-04 | An issue was discovered in RICOH Streamline NX Client Tool and RICOH Streamline NX PC Client that allows attackers to escalate local privileges. |
CVE-2019-19455 | High | 7.8 | 2020-08-03 | Wowza Streaming Engine before 4.8.5 has Insecure Permissions which may allow a local attacker to escalate privileges in / usr / local / WowzaStreamingEngine /… |
CVE-2019-19453 | Medium | 5.4 | 2020-08-03 | Wowza Streaming Engine before 4.8.5 allows XSS (issue 1 of 2). An authenticated user, with access to the proxy license editing is able to insert a malicious pa… |
CVE-2019-4589 | Medium | 4.3 | 2020-08-03 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to privlege escalation where the "My schedules and subscriptions" page is visible and accessible to a less pri… |
CVE-2019-4366 | Medium | 5.3 | 2020-08-03 | IBM Cognos Analytics 11.0 and 11.1 is susceptible to an information disclosure vulnerability where an attacker could gain access to cached browser data. IBM X-… |
CVE-2019-11286 | Critical | 9.1 | 2020-07-31 | VMware GemFire versions prior to 9.10.0, 9.9.1, 9.8.5, and 9.7.5, and VMware Tanzu GemFire for VMs versions prior to 1.11.0, 1.10.1, 1.9.2, and 1.8.2, contain… |
CVE-2019-14130 | High | 7.8 | 2020-07-30 | Memory corruption can occurs in trusted application if offset size from HLOS is more than actual mapped buffer size in Snapdragon Auto, Snapdragon Compute, Sna… |
CVE-2019-14124 | High | 7.8 | 2020-07-30 | Memory failure in content protection module due to not having pointer within the scope in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile, Snapdragon Wi… |
CVE-2019-14123 | High | 7.8 | 2020-07-30 | Possible buffer overflow and over read possible due to missing bounds checks for fixed limits if we consider widevine HLOS client as non-trustable in Snapdrago… |
CVE-2019-14101 | High | 7.1 | 2020-07-30 | Out of bounds read can happen in diag event set mask command handler when user provided length in the command request is less than expected length in Snapdrago… |
CVE-2019-14100 | High | 7.8 | 2020-07-30 | Register write via debugfs is disabled by default to prevent register writing via debugfs. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Sna… |
CVE-2019-14099 | High | 7.8 | 2020-07-30 | Device misbehavior may be observed when incorrect offset, length or number of buffers is passed by user space in Snapdragon Auto, Snapdragon Compute, Snapdrago… |
CVE-2019-14093 | High | 7.8 | 2020-07-30 | Array out of bound access can occur in display module due to lack of bound check on input parcel received in Snapdragon Auto, Snapdragon Connectivity, Snapdrag… |
CVE-2019-14037 | High | 7.8 | 2020-07-30 | Close and bind operations done on a socket can lead to a Use-After-Free condition. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon… |
CVE-2019-10580 | High | 7.8 | 2020-07-30 | When kernel thread unregistered listener, Use after free issue happened as the listener client`s private data has been already freed in Snapdragon Auto, Snapdr… |
CVE-2019-20033 | Critical | 9.8 | 2020-07-29 | On Aspire-derived NEC PBXes, including all versions of SV8100 devices, a set of documented, static login credentials may be used to access the DIM interface. |
CVE-2019-20032 | Medium | 6.5 | 2020-07-29 | An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derived NEC PBXes, including all versions of SV8100, S… |
CVE-2019-20031 | Critical | 9.1 | 2020-07-29 | NEC UM8000, UM4730 and prior non-InMail voicemail systems with all known software versions may permit an infinite number of login attempts in the telephone use… |
CVE-2019-20030 | High | 7.8 | 2020-07-29 | An attacker with knowledge of the modem access number on a NEC UM8000 voicemail system may use SSH tunneling or standard Linux utilities to gain access to the… |
CVE-2019-20029 | High | 8.8 | 2020-07-29 | An exploitable privilege escalation vulnerability exists in the WebPro functionality of Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1… |
CVE-2019-20028 | High | 7.5 | 2020-07-29 | Aspire-derived NEC PBXes operating InMail software, including all versions of SV8100, SV9100, SL1100 and SL2100 devices allow unauthenticated read-only access… |
CVE-2019-20027 | Critical | 9.8 | 2020-07-29 | Aspire-derived NEC PBXes, including the SV8100, SV9100, SL1100 and SL2100 with software releases 7.0 or higher contain the possibility if incorrectly configure… |
CVE-2019-20026 | High | 7.5 | 2020-07-29 | The WebPro interface in NEC SV9100 software releases 7.0 or higher allows unauthenticated remote attackers to reset all existing usernames and passwords to def… |
CVE-2019-20025 | Critical | 9.8 | 2020-07-29 | Certain builds of NEC SV9100 software could allow an unauthenticated, remote attacker to log into a device running an affected release with a hardcoded usernam… |
CVE-2019-4731 | Medium | 5.5 | 2020-07-28 | IBM MQ Appliance 9.1.4.CD could allow a local attacker to obtain highly sensitive information by inclusion of sensitive data within trace. IBM X-Force ID: 1726… |
CVE-2019-18834 | Medium | 6.1 | 2020-07-23 | Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Detai… |
CVE-2019-11252 | Medium | 5.9 | 2020-07-23 | The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for Azu… |
CVE-2019-16244 | Critical | 9.8 | 2020-07-22 | OMERO.server before 5.6.1 allows attackers to bypass the security filters and access hidden objects via a crafted query. |
CVE-2019-18619 | High | 7.8 | 2020-07-22 | Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) allows a local user to… |
CVE-2019-18618 | Medium | 6.0 | 2020-07-22 | Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash (all versions prior to 2019-11-15) allows… |
CVE-2019-12000 | Medium | 6.6 | 2020-07-17 | HPE has found a potential Remote Access Restriction Bypass in HPE MSE Msg Gw application E-LTU prior to version 3.2 when HTTPS is used between the USSD and an… |
CVE-2019-4091 | Medium | 5.4 | 2020-07-17 | "HCL Marketing Platform is vulnerable to cross-site scripting during addition of new users and also while searching for users in Dashboard, potentially giving… |
CVE-2019-4090 | Medium | 5.4 | 2020-07-17 | "HCL Campaign is vulnerable to cross-site scripting when a user provides XSS scripts in Campaign Description field." |
CVE-2019-20915 | High | 8.1 | 2020-07-16 | An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in bit_write_TF in bits.c. |
CVE-2019-20914 | Critical | 9.8 | 2020-07-16 | An issue was discovered in GNU LibreDWG through 0.9.3. There is a NULL pointer dereference in the function dwg_encode_common_entity_handle_data in common_entit… |
CVE-2019-20913 | High | 8.1 | 2020-07-16 | An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in dwg_encode_entity in common_entity_data.spec. |
CVE-2019-20912 | High | 8.8 | 2020-07-16 | An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a stack overflow in bits.c, possibly related to bit_read_TF. |
CVE-2019-20911 | Medium | 6.5 | 2020-07-16 | An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to denial of service in bit_calc_CRC in bits.c, related to a for loop. |
CVE-2019-20910 | High | 8.1 | 2020-07-16 | An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to a heap-based buffer over-read in decode_R13_R2000 in decode.c, a different vu… |
CVE-2019-20909 | High | 7.5 | 2020-07-16 | An issue was discovered in GNU LibreDWG through 0.9.3. There is a NULL pointer dereference in the function dwg_encode_LWPOLYLINE in dwg.spec. |
CVE-2019-4748 | Medium | 5.4 | 2020-07-16 | IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2019-4747 | Medium | 5.4 | 2020-07-16 | IBM Team Concert (RTC) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering th… |
CVE-2019-20908 | Medium | 6.7 | 2020-07-15 | An issue was discovered in drivers/firmware/efi/efi.c in the Linux kernel before 5.4. Incorrect access permissions for the efivar_ssdt ACPI variable could be u… |
CVE-2019-17639 | Medium | 5.3 | 2020-07-15 | In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destinati… |
CVE-2019-19326 | Medium | 5.9 | 2020-07-15 | Silverstripe CMS sites through 4.4.4 which have opted into HTTP Cache Headers on responses served by the framework's HTTP layer can be vulnerable to web cache… |
CVE-2019-17637 | High | 7.1 | 2020-07-15 | In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be exploited to send the c… |
CVE-2019-12784 | High | 8.8 | 2020-07-14 | An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the login form can accept submissions from external websites. In conjunction with CVE… |
CVE-2019-12783 | Medium | 6.1 | 2020-07-14 | An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the rd parameter can accept a URL, to which users will be redirected after a successf… |
CVE-2019-12773 | Medium | 6.1 | 2020-07-14 | An issue was discovered in Verint Impact 360 15.1. At wfo/help/help_popup.jsp, the helpURL parameter can be changed to embed arbitrary content inside of an iFr… |
CVE-2019-19338 | Medium | 5.5 | 2020-07-13 | A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of inst… |
CVE-2019-4591 | High | 7.8 | 2020-07-13 | IBM Maximo Asset Management 7.6.0 and 7.6.1 does not invalidate session after logout which could allow a local user to impersonate another user on the system… |
CVE-2019-20907 | High | 7.5 | 2020-07-13 | In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pa… |
CVE-2019-20901 | Medium | 6.1 | 2020-07-13 | The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different websi… |
CVE-2019-20900 | Medium | 4.8 | 2020-07-13 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulne… |
CVE-2019-20899 | Medium | 5.3 | 2020-07-13 | The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certa… |
CVE-2019-20898 | High | 7.5 | 2020-07-13 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global per… |
CVE-2019-20897 | Medium | 6.5 | 2020-07-13 | The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service via a crafted PNG… |
CVE-2019-17638 | Critical | 9.4 | 2020-07-09 | In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error… |
CVE-2019-19417 | High | 7.5 | 2020-07-08 | The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the… |
CVE-2019-19416 | High | 7.5 | 2020-07-08 | The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the… |
CVE-2019-19415 | High | 7.5 | 2020-07-08 | The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the… |
CVE-2019-20896 | Critical | 9.8 | 2020-07-07 | WebChess 1.0 allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter. |
CVE-2019-19935 | Medium | 6.1 | 2020-07-07 | Froala Editor before 3.2.3 allows XSS. |
CVE-2019-4324 | Medium | 6.1 | 2020-07-07 | "HCL AppScan Enterprise is susceptible to Cross-Site Scripting while importing a specially crafted test policy." |
CVE-2019-4323 | Medium | 4.3 | 2020-07-07 | "HCL AppScan Enterprise advisory API documentation is susceptible to clickjacking, which could allow an attacker to embed the contents of untrusted web pages i… |
CVE-2019-14900 | Medium | 6.5 | 2020-07-06 | A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit u… |
CVE-2019-8252 | Medium | 5.5 | 2020-07-06 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-8251 | Medium | 5.5 | 2020-07-06 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-8250 | High | 7.8 | 2020-07-06 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-8249 | High | 7.8 | 2020-07-06 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-8066 | High | 7.8 | 2020-07-06 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-20419 | High | 7.8 | 2020-07-03 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerability in Tomcat. The af… |
CVE-2019-20418 | Medium | 6.5 | 2020-07-03 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Application Denial of Ser… |
CVE-2019-20894 | High | 7.5 | 2020-07-02 | Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERR_BAD_SSL_CLIENT_AUTH_CERT shou… |
CVE-2019-15312 | High | 8.8 | 2020-07-01 | An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is a Zolo Halo DNS rebinding attack. The device was found to be vulnerable to DNS… |
CVE-2019-15311 | Critical | 9.8 | 2020-07-01 | An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN remote code execution. The Zolo Halo Bluetooth speaker had a GoA… |
CVE-2019-15310 | Critical | 9.8 | 2020-07-01 | An issue was discovered on various devices via the Linkplay firmware. There is WAN remote code execution without user interaction. An attacker could retrieve t… |
CVE-2019-4706 | Low | 2.7 | 2020-07-01 | IBM Security Identity Manager Virtual Appliance 7.0.2 writes information to log files which can be of a sensitive nature and give valuable guidance to an attac… |
CVE-2019-4705 | Low | 2.7 | 2020-07-01 | IBM Security Identity Manager Virtual Appliance 7.0.2 discloses sensitive information to unauthorized users. The information can be used to mount further attac… |
CVE-2019-4704 | Medium | 4.3 | 2020-07-01 | IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to ge… |
CVE-2019-4676 | High | 7.8 | 2020-07-01 | IBM Security Identity Manager Virtual Appliance 7.0.2 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171512. |
CVE-2019-20408 | Medium | 5.3 | 2020-07-01 | The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via… |
CVE-2019-19163 | High | 7.5 | 2020-06-30 | A Vulnerability in the firmware of COMMAX WallPad(CDP-1020MB) allow an unauthenticated adjacent attacker to execute arbitrary code, because of a using the old… |
CVE-2019-19161 | High | 7.2 | 2020-06-30 | CyMiInstaller322 ActiveX which runs MIPLATFORM downloads files required to run applications. A vulnerability in downloading files by CyMiInstaller322 ActiveX c… |
CVE-2019-20893 | Critical | 9.8 | 2020-06-30 | An issue was discovered in Activision Infinity Ward Call of Duty Modern Warfare 2 through 2019-12-11. PartyHost_HandleJoinPartyRequest has a buffer overflow vu… |
CVE-2019-20416 | Medium | 4.8 | 2020-06-30 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulne… |
CVE-2019-20415 | Medium | 4.3 | 2020-06-30 | Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site request forgery (C… |