2019 CVEs (page 130)
Page 130 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1782 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1781 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1779 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1778 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating… |
CVE-2019-1776 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating… |
CVE-2019-1775 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1774 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1773 | High | 7.8 | 2019-05-15 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2019-1772 | High | 7.8 | 2019-05-15 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2019-1771 | High | 7.8 | 2019-05-15 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2019-1770 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on… |
CVE-2019-1769 | Medium | 6.7 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on… |
CVE-2019-10111 | Medium | 5.4 | 2019-05-15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in t… |
CVE-2019-10110 | Medium | 6.5 | 2019-05-15 | An Insecure Permissions issue (issue 1 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 1… |
CVE-2019-10109 | Medium | 5.3 | 2019-05-15 | An Information Exposure issue (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 1… |
CVE-2019-10108 | Medium | 5.4 | 2019-05-15 | An Incorrect Access Control (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11… |
CVE-2019-1767 | Medium | 6.7 | 2019-05-15 | A vulnerability in the implementation of a specific CLI command for Cisco NX-OS Software could allow an authenticated, local attacker with administrator creden… |
CVE-2019-1735 | High | 7.8 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges on the u… |
CVE-2019-10640 | High | 7.5 | 2019-05-15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4. A regex input validation iss… |
CVE-2019-11224 | High | 8.8 | 2019-05-15 | HARMAN AMX MVP5150 v2.87.13 devices allow remote OS Command Injection. |
CVE-2019-1010258 | Medium | 6.5 | 2019-05-15 | nanosvg library nanosvg after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726 is affected by: Buffer Overflow. The impact is: Memory corruption leading to at l… |
CVE-2019-1733 | Medium | 5.4 | 2019-05-15 | A vulnerability in the NX API (NX-API) Sandbox interface for Cisco NX-OS Software could allow an authenticated, remote attacker to conduct a cross-site scripti… |
CVE-2019-1732 | Medium | 6.4 | 2019-05-15 | A vulnerability in the Remote Package Manager (RPM) subsystem of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentia… |
CVE-2019-1731 | Medium | 4.4 | 2019-05-15 | A vulnerability in the SSH CLI key management functionality of Cisco NX-OS Software could allow an authenticated, local attacker to expose a user's private SSH… |
CVE-2019-1730 | Medium | 6.7 | 2019-05-15 | A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to bypass the limited command set of the… |
CVE-2019-1729 | Medium | 6.0 | 2019-05-15 | A vulnerability in the CLI implementation of a specific command used for image maintenance for Cisco NX-OS Software could allow an authenticated, local attacke… |
CVE-2019-1728 | Medium | 6.7 | 2019-05-15 | A vulnerability in the Secure Configuration Validation functionality of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attack… |
CVE-2019-1727 | Medium | 6.7 | 2019-05-15 | A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and issue ar… |
CVE-2019-1726 | High | 7.8 | 2019-05-15 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to access internal services that should be restricted on an aff… |
CVE-2019-1717 | High | 7.5 | 2019-05-15 | A vulnerability in the web-based management interface of Cisco Video Surveillance Manager could allow an unauthenticated, remote attacker to access sensitive i… |
CVE-2019-8936 | High | 7.5 | 2019-05-15 | NTP through 4.2.8p12 has a NULL Pointer Dereference. |
CVE-2019-5598 | High | 7.5 | 2019-05-15 | In FreeBSD 11.3-PRERELEASE before r345378, 12.0-STABLE before r345377, 11.2-RELEASE before 11.2-RELEASE-p10, and 12.0-RELEASE before 12.0-RELEASE-p4, a bug in… |
CVE-2019-5597 | Critical | 9.1 | 2019-05-15 | In FreeBSD 11.3-PRERELEASE and 12.0-STABLE before r347591, 11.2-RELEASE before 11.2-RELEASE-p10, and 12.0-RELEASE before 12.0-RELEASE-p4, a bug in the pf IPv6… |
CVE-2019-5526 | High | 7.8 | 2019-05-15 | VMware Workstation (15.x before 15.1.0) contains a DLL hijacking issue because some DLL files are improperly loaded by the application. Successful exploitation… |
CVE-2019-3727 | Medium | 6.4 | 2019-05-15 | Dell EMC RecoverPoint versions prior to 5.1.3 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an OS command injection vulnerability in the installat… |
CVE-2019-3725 | Critical | 9.8 | 2019-05-15 | RSA Netwitness Platform versions prior to 11.2.1.1 and RSA Security Analytics versions prior to 10.6.6.1 are vulnerable to a Command Injection vulnerability du… |
CVE-2019-3724 | Medium | 6.5 | 2019-05-15 | RSA Netwitness Platform versions prior to 11.2.1.1 is vulnerable to an Authorization Bypass vulnerability. A remote low privileged attacker could potentially e… |
CVE-2019-3602 | Medium | 4.8 | 2019-05-15 | Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) Prior to 9.1 Update 5 allows an authenticated administrator to embed an XSS i… |
CVE-2019-3586 | High | 7.5 | 2019-05-15 | Protection Mechanism Failure in the Firewall in McAfee Endpoint Security (ENS) 10.x prior to 10.6.1 May 2019 update allows context-dependent attackers to circu… |
CVE-2019-11833 | Medium | 5.5 | 2019-05-15 | fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtai… |
CVE-2019-12101 | High | 7.5 | 2019-05-15 | coap_decode_option in coap.c in LibNyoci 0.07.00rc1 mishandles certain packets with "Uri-Path: (null)" and consequently allows remote attackers to cause a deni… |
CVE-2019-12099 | High | 8.8 | 2019-05-14 | In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and i… |
CVE-2019-11397 | Medium | 6.5 | 2019-05-14 | GetFile.aspx in Rapid4 RapidFlows Enterprise Application Builder 4.5M.23 (when used with .NET Framework 4.5) allows Local File Inclusion via the FileDesc param… |
CVE-2019-11328 | High | 8.8 | 2019-05-14 | An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerab… |
CVE-2019-0301 | High | 8.8 | 2019-05-14 | Under certain conditions, it is possible to request the modification of role or privilege assignments through SAP Identity Management REST Interface Version 2… |
CVE-2019-0298 | Medium | 6.1 | 2019-05-14 | SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. F… |
CVE-2019-0293 | Medium | 6.5 | 2019-05-14 | Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information on RFC destinations… |
CVE-2019-0291 | Medium | 5.5 | 2019-05-14 | Under certain conditions Solution Manager, version 7.2, allows an attacker to access information which would otherwise be restricted. |
CVE-2019-0289 | High | 7.1 | 2019-05-14 | Under certain conditions SAP BusinessObjects Business Intelligence platform (Analysis for OLAP), versions 4.2 and 4.3, allows an attacker to access information… |
CVE-2019-0287 | High | 7.6 | 2019-05-14 | Under certain conditions SAP BusinessObjects Business Intelligence platform (Central Management Server), versions 4.2 and 4.3, allows an attacker to access inf… |
CVE-2019-0280 | High | 8.8 | 2019-05-14 | SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary aut… |
CVE-2019-6578 | High | 7.5 | 2019-05-14 | A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions with option G28), S… |
CVE-2019-6577 | Medium | 5.4 | 2019-05-14 | A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All ve… |
CVE-2019-6576 | Medium | 6.5 | 2019-05-14 | A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All ve… |
CVE-2019-6574 | High | 7.5 | 2019-05-14 | A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions with option G21, G2… |
CVE-2019-6572 | Critical | 9.1 | 2019-05-14 | A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All ve… |
CVE-2019-3568 | Critical | 9.8 | 2019-05-14 | A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number… |
CVE-2019-11206 | Medium | 5.3 | 2019-05-14 | The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabiliti… |
CVE-2019-11205 | High | 8.8 | 2019-05-14 | The web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities tha… |
CVE-2019-11204 | High | 8.8 | 2019-05-14 | The web interface component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that might theoretically allow an authenticate… |
CVE-2019-10924 | High | 7.8 | 2019-05-14 | A vulnerability has been identified in LOGO! Soft Comfort (All versions < V8.3). The vulnerability could allow an attacker to execute arbitrary code if the att… |
CVE-2019-10922 | Critical | 9.8 | 2019-05-14 | A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 and newer (All versions), SIMATIC WinCC V7.2 and earli… |
CVE-2019-10921 | High | 7.5 | 2019-05-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Unencrypted storage of passwords in the project could allow an… |
CVE-2019-10920 | High | 7.5 | 2019-05-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Project data stored on the device, which is accessible via por… |
CVE-2019-10919 | Critical | 9.4 | 2019-05-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Attackers with access to port 10005/tcp could perform device r… |
CVE-2019-10918 | High | 8.8 | 2019-05-14 | A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC… |
CVE-2019-10917 | Medium | 5.5 | 2019-05-14 | A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC… |
CVE-2019-10916 | High | 8.8 | 2019-05-14 | A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC… |
CVE-2019-8978 | High | 8.1 | 2019-05-14 | An improper authentication vulnerability can be exploited through a race condition that occurs in Ellucian Banner Web Tailor 8.8.3, 8.8.4, and 8.9 and Banner E… |
CVE-2019-11419 | Medium | 5.5 | 2019-05-14 | vcodec2_hls_filter in libvoipCodec_v7a.so in the WeChat application through 7.0.3 for Android allows attackers to cause a denial of service (application crash)… |
CVE-2019-11846 | Medium | 6.1 | 2019-05-14 | /servlets/ajax_file_upload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection. |
CVE-2019-11845 | Medium | 6.1 | 2019-05-14 | An HTML Injection vulnerability has been discovered on the RICOH SP 4510DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter. |
CVE-2019-11844 | Medium | 6.1 | 2019-05-14 | An HTML Injection vulnerability has been discovered on the RICOH SP 4520DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn or entryDisplayNameI… |
CVE-2019-9861 | High | 8.1 | 2019-05-14 | Due to the use of an insecure RFID technology (MIFARE Classic), ABUS proximity chip keys (RFID tokens) of the ABUS Secvest FUAA50000 wireless alarm system can… |
CVE-2019-8923 | Critical | 9.8 | 2019-05-14 | XAMPP through 5.6.8 and previous allows SQL injection via the cds-fpdf.php jahr parameter. NOTE: This product is discontinued. |
CVE-2019-8404 | Medium | 6.5 | 2019-05-14 | An issue was discovered in Webiness Inventory 2.3. The ProductModel component allows Arbitrary File Upload via a crafted product image during the creation of a… |
CVE-2019-8391 | Medium | 6.1 | 2019-05-14 | qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter. |
CVE-2019-8390 | Medium | 6.1 | 2019-05-14 | qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter. |
CVE-2019-6516 | Medium | 5.8 | 2019-05-14 | An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to force the application to perform requests to the internal workstation (port-scanning)… |
CVE-2019-6515 | Medium | 5.3 | 2019-05-14 | An issue was discovered in WSO2 API Manager 2.6.0. Uploaded documents for API documentation are available to an unauthenticated user. |
CVE-2019-6514 | Medium | 4.8 | 2019-05-14 | An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to inject a JavaScript payload that will be stored in the database and then displayed an… |
CVE-2019-6512 | Medium | 4.1 | 2019-05-14 | An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation (SSRF port-scanning)… |
CVE-2019-11336 | High | 8.1 | 2019-05-14 | Sony Bravia Smart TV devices allow remote attackers to retrieve the static Wi-Fi password (used when the TV is acting as an access point) by using the Photo Sh… |
CVE-2019-12087 | Medium | 5.5 | 2019-05-14 | Samsung S9+, S10, and XCover 4 P(9.0) devices can become temporarily inoperable because of an unprotected intent in the ContainerAgent application. For example… |
CVE-2019-9618 | Critical | 9.8 | 2019-05-13 | The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter. |
CVE-2019-8952 | Medium | 6.5 | 2019-05-13 | A Path Traversal vulnerability located in the webserver affects several Bosch hardware and software products. The vulnerability potentially allows a remote aut… |
CVE-2019-8951 | Medium | 6.1 | 2019-05-13 | An Open Redirect vulnerability located in the webserver affects several Bosch hardware and software products. The vulnerability potentially allows a remote att… |
CVE-2019-10053 | Critical | 9.8 | 2019-05-13 | An issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the function SSHParseBanner is composed only of a \n character, then the program runs i… |
CVE-2019-1862 | High | 7.2 | 2019-05-13 | A vulnerability in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands on the unde… |
CVE-2019-12083 | High | 8.1 | 2019-05-13 | The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and… |
CVE-2019-11600 | High | 8.1 | 2019-05-13 | A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter… |
CVE-2019-7218 | Medium | 5.9 | 2019-05-13 | Citrix ShareFile before 19.23 allows a downgrade from two-factor authentication to one-factor authentication. An attacker with access to the offline victim's o… |
CVE-2019-7217 | High | 7.5 | 2019-05-13 | Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses using the request t… |
CVE-2019-1649 | Medium | 6.7 | 2019-05-13 | A vulnerability in the logic that handles access control to one of the hardware components in Cisco's proprietary Secure Boot implementation could allow an aut… |
CVE-2019-11680 | Critical | 9.8 | 2019-05-13 | KonaKart 8.9.0.0 is vulnerable to Remote Code Execution by uploading a web shell as a product category image. |
CVE-2019-9727 | High | 7.5 | 2019-05-13 | Unauthenticated password hash disclosure in the User.getUserPWD method in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to retrieve the GU… |
CVE-2019-9726 | High | 7.5 | 2019-05-13 | Directory Traversal / Arbitrary File Read in eQ-3 AG Homematic CCU3 3.43.15 and earlier allows remote attackers to read arbitrary files of the device's filesys… |
CVE-2019-8342 | High | 7.8 | 2019-05-13 | A Local Privilege Escalation in libqcocoa.dylib in Foxit Reader 3.1.0.0111 on macOS has been discovered due to an incorrect permission set. |
CVE-2019-3702 | High | 8.8 | 2019-05-13 | A Remote Code Execution issue in the DNS Query Web UI in Lifesize Icon LS_RM3_3.7.0 (2421) allows remote authenticated attackers to execute arbitrary commands… |
CVE-2019-10050 | High | 7.5 | 2019-05-13 | A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the decode-mpls.c function DecodeMPLS is composed only of a packet of s… |