2019 CVEs (page 132)
Page 132 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10712 | Critical | 9.8 | 2019-05-07 | The Web-GUI on WAGO Series 750-88x (750-330, 750-352, 750-829, 750-831, 750-852, 750-880, 750-881, 750-882, 750-884, 750-885, 750-889) and Series 750-87x (750-… |
CVE-2019-7746 | High | 8.1 | 2019-05-07 | JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices allow remote attackers to obtain an admin token by making a /cgi-bin/qcmap_auth type=getuser request and then read… |
CVE-2019-7745 | Critical | 9.8 | 2019-05-07 | JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices allow remote attackers to obtain the Wi-Fi password by making a cgi-bin/qcmap_web_cgi Page=GetWiFi_Setting request… |
CVE-2019-7687 | Medium | 6.1 | 2019-05-07 | cgi-bin/qcmap_web_cgi on JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices has POST based reflected XSS via the Page parameter. No sanitization is performed for use… |
CVE-2019-7564 | Critical | 9.8 | 2019-05-07 | An issue was discovered on Shenzhen Coship WM3300 WiFi Router 5.0.0.55 devices. The password reset functionality of the Wireless SSID doesn't require any type… |
CVE-2019-7541 | Medium | 6.1 | 2019-05-07 | Rukovoditel through 2.4.1 allows XSS via a URL that lacks a module=users%2flogin substring. |
CVE-2019-7443 | High | 8.1 | 2019-05-07 | KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cau… |
CVE-2019-7427 | Medium | 6.1 | 2019-05-07 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the autorefT… |
CVE-2019-7426 | Medium | 6.1 | 2019-05-07 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the groupDes… |
CVE-2019-4208 | High | 7.1 | 2019-05-07 | IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2019-4207 | Low | 3.3 | 2019-05-07 | IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 may disclose sensitive information only available to a local user that could be used in further attacks agains… |
CVE-2019-10742 | High | 7.5 | 2019-05-07 | Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is… |
CVE-2019-11629 | Medium | 6.1 | 2019-05-07 | Sonatype Nexus Repository Manager 2.x before 2.14.13 allows XSS. |
CVE-2019-10869 | High | 8.1 | 2019-05-07 | Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an… |
CVE-2019-9708 | Medium | 4.9 | 2019-05-07 | An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. A site administrator can suspend the system user (root)… |
CVE-2019-11560 | Critical | 9.8 | 2019-05-07 | A buffer overflow vulnerability in the streaming server provided by hisilicon in HI3516 models allows an unauthenticated attacker to remotely run arbitrary cod… |
CVE-2019-9709 | Medium | 5.4 | 2019-05-07 | An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. The collection title is vulnerable to Cross Site Script… |
CVE-2019-11811 | High | 7.0 | 2019-05-07 | An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module is rem… |
CVE-2019-11810 | High | 7.5 | 2019-05-07 | An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when megasas_create_frame_pool() fails in megasas_alloc_cmds() i… |
CVE-2019-11808 | Low | 3.7 | 2019-05-07 | Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can dete… |
CVE-2019-11569 | High | 8.8 | 2019-05-06 | Veeam ONE Reporter 9.5.0.3201 allows CSRF. |
CVE-2019-10999 | High | 8.8 | 2019-05-06 | The D-Link DCS series of Wi-Fi cameras contains a stack-based buffer overflow in alphapd, the camera's web server. The overflow allows a remotely authenticated… |
CVE-2019-11807 | High | 7.5 | 2019-05-06 | The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=update_attachment_wccm wccm_defau… |
CVE-2019-5434 | Critical | 9.8 | 2019-05-06 | An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in the "opena… |
CVE-2019-5433 | Medium | 5.4 | 2019-05-06 | A user having access to the UI of a Revive Adserver instance could be tricked into clicking on a specifically crafted admin account-switch.php URL that would e… |
CVE-2019-5432 | High | 7.5 | 2019-05-06 | A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2… |
CVE-2019-5431 | Medium | 5.4 | 2019-05-06 | This vulnerability was caused by an incomplete fix to CVE-2017-0911. Twitter Kit for iOS versions 3.0 to 3.4.0 is vulnerable to a callback verification flaw in… |
CVE-2019-5430 | High | 8.8 | 2019-05-06 | In UniFi Video 3.10.0 and prior, due to the lack of CSRF protection, it is possible to abuse the Web API to make changes on the server configuration without th… |
CVE-2019-3799 | Medium | 6.5 | 2019-05-06 | Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow appl… |
CVE-2019-3797 | Low | 3.5 | 2019-05-06 | This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith… |
CVE-2019-3565 | High | 7.5 | 2019-05-06 | Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result… |
CVE-2019-3564 | High | 7.5 | 2019-05-06 | Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short m… |
CVE-2019-3559 | High | 7.5 | 2019-05-06 | Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short… |
CVE-2019-3558 | High | 7.5 | 2019-05-06 | Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send sho… |
CVE-2019-3552 | High | 7.5 | 2019-05-06 | C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients coul… |
CVE-2019-10249 | High | 8.1 | 2019-05-06 | All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised. |
CVE-2019-11767 | Medium | 5.8 | 2019-05-05 | Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the r… |
CVE-2019-11766 | Critical | 9.8 | 2019-05-05 | dhcp6.c in dhcpcd before 6.11.7 and 7.x before 7.2.2 has a buffer over-read in the D6_OPTION_PD_EXCLUDE feature. |
CVE-2019-6619 | High | 7.5 | 2019-05-03 | On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, the Traffic Management Microkernel (TMM) may restart when a virtual server has an HTTP/2 profile… |
CVE-2019-6618 | Medium | 4.9 | 2019-05-03 | On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, users with the Resource Administrator role can modify sensitive… |
CVE-2019-6617 | Medium | 6.5 | 2019-05-03 | On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, a user with the Resource Administrator role is able to overwrite… |
CVE-2019-6616 | High | 7.2 | 2019-05-03 | On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, administrative users with TMSH access can overwrite critical sys… |
CVE-2019-6615 | Medium | 4.9 | 2019-05-03 | On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, Administrator and Resource Administrator roles might exploit TMS… |
CVE-2019-6614 | Medium | 6.5 | 2019-05-03 | On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, internal methods used to prevent arbitrary file overwrites in Appliance Mode were not fully effe… |
CVE-2019-6158 | High | 8.7 | 2019-05-03 | An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered HTTP proxy credentials being written to a log file in clear text. This on… |
CVE-2019-3894 | High | 8.8 | 2019-05-03 | It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as. These… |
CVE-2019-3805 | Medium | 4.7 | 2019-05-03 | A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processe… |
CVE-2019-3400 | Medium | 6.1 | 2019-05-03 | The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to inject arbitrary HTML or JavaScript via… |
CVE-2019-11037 | Medium | 4.9 | 2019-05-03 | In PHP imagick extension in versions between 3.3.0 and 3.4.4, writing to an array of values in ImagickKernel::fromMatrix() function did not check that the addr… |
CVE-2019-11036 | Critical | 9.1 | 2019-05-03 | When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated… |
CVE-2019-6613 | Medium | 5.3 | 2019-05-03 | On BIG-IP 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, SNMP may expose sensitive configuration objects over insecure transmission channe… |
CVE-2019-6612 | High | 7.5 | 2019-05-03 | On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, DNS query TCP connections that are aborted before receiving a re… |
CVE-2019-6611 | High | 7.5 | 2019-05-03 | When BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8 are processing certain rare data sequences occurring in PPTP VP… |
CVE-2019-1859 | High | 7.2 | 2019-05-03 | A vulnerability in the Secure Shell (SSH) authentication process of Cisco Small Business Switches software could allow an attacker to bypass client-side certif… |
CVE-2019-1857 | Medium | 6.1 | 2019-05-03 | A vulnerability in the web-based management interface of Cisco HyperFlex HX-Series could allow an unauthenticated, remote attacker to conduct a cross-site requ… |
CVE-2019-1856 | Medium | 6.1 | 2019-05-03 | A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance (PCA) could allow an unauthenticated, remote attacker to conduct a… |
CVE-2019-1854 | Medium | 4.1 | 2019-05-03 | A vulnerability in the management web interface of Cisco Expressway Series could allow an authenticated, remote attacker to perform a directory traversal attac… |
CVE-2019-1852 | Medium | 6.1 | 2019-05-03 | A vulnerability in the web-based management interface of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to conduct a cross-site… |
CVE-2019-1844 | Medium | 5.3 | 2019-05-03 | A vulnerability in certain attachment detection mechanisms of the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypas… |
CVE-2019-1838 | Medium | 5.4 | 2019-05-03 | A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacke… |
CVE-2019-1836 | High | 7.1 | 2019-05-03 | A vulnerability in the system shell for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated… |
CVE-2019-1817 | High | 7.5 | 2019-05-03 | A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliance could allow an unauthenticated, remote attacker to ca… |
CVE-2019-1816 | High | 7.8 | 2019-05-03 | A vulnerability in the log subscription subsystem of the Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to perform command inj… |
CVE-2019-1807 | High | 7.6 | 2019-05-03 | A vulnerability in the session management functionality of the web UI for the Cisco Umbrella Dashboard could allow an authenticated, remote attacker to access… |
CVE-2019-1804 | Critical | 9.8 | 2019-05-03 | A vulnerability in the SSH key management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an unauthen… |
CVE-2019-1803 | Medium | 6.7 | 2019-05-03 | A vulnerability in the filesystem management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an authe… |
CVE-2019-1724 | High | 8.8 | 2019-05-03 | A vulnerability in the session management functionality of the web-based interface for Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could… |
CVE-2019-1715 | Medium | 5.3 | 2019-05-03 | A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security Appliance… |
CVE-2019-1714 | High | 8.6 | 2019-05-03 | A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 Single Sign-On (SSO) for Clientless SSL VPN (WebVPN) and AnyConnect Remo… |
CVE-2019-1713 | High | 8.1 | 2019-05-03 | A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to co… |
CVE-2019-1709 | Medium | 6.0 | 2019-05-03 | A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to perform a command injection attack… |
CVE-2019-1708 | High | 8.6 | 2019-05-03 | A vulnerability in the Internet Key Exchange Version 2 Mobility and Multihoming Protocol (MOBIKE) feature for the Cisco Adaptive Security Appliance (ASA) Softw… |
CVE-2019-1706 | High | 8.6 | 2019-05-03 | A vulnerability in the software cryptography module of the Cisco Adaptive Security Virtual Appliance (ASAv) and Firepower 2100 Series running Cisco Adaptive Se… |
CVE-2019-1705 | Medium | 5.3 | 2019-05-03 | A vulnerability in the remote access VPN session manager of Cisco Adaptive Security Appliance (ASA) Software could allow a unauthenticated, remote attacker to… |
CVE-2019-1704 | High | 7.5 | 2019-05-03 | Multiple vulnerabilities in the Server Message Block (SMB) Protocol preprocessor detection engine for Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2019-1703 | High | 8.6 | 2019-05-03 | A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software for the Cisco Firepower 2100 Series could allo… |
CVE-2019-1701 | Medium | 4.8 | 2019-05-03 | Multiple vulnerabilities in the WebVPN service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allo… |
CVE-2019-1699 | Medium | 6.7 | 2019-05-03 | A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to perform a command injection attack… |
CVE-2019-1697 | Medium | 6.8 | 2019-05-03 | A vulnerability in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco Adaptive Security Appliance (ASA) Software and Firep… |
CVE-2019-1696 | High | 7.5 | 2019-05-03 | Multiple vulnerabilities in the Server Message Block (SMB) Protocol preprocessor detection engine for Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2019-1695 | Medium | 6.5 | 2019-05-03 | A vulnerability in the detection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an un… |
CVE-2019-1694 | High | 8.6 | 2019-05-03 | A vulnerability in the TCP processing engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow… |
CVE-2019-1693 | Medium | 6.5 | 2019-05-03 | A vulnerability in the WebVPN service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an auth… |
CVE-2019-1692 | Medium | 5.3 | 2019-05-03 | A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated, rem… |
CVE-2019-1687 | High | 7.5 | 2019-05-03 | A vulnerability in the TCP proxy functionality for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could all… |
CVE-2019-1682 | High | 7.8 | 2019-05-03 | A vulnerability in the FUSE filesystem functionality for Cisco Application Policy Infrastructure Controller (APIC) software could allow an authenticated, local… |
CVE-2019-1635 | High | 7.5 | 2019-05-03 | A vulnerability in the call-handling functionality of Session Initiation Protocol (SIP) Software for Cisco IP Phone 7800 Series and 8800 Series could allow an… |
CVE-2019-1592 | High | 7.8 | 2019-05-03 | A vulnerability in the background operations functionality of Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow… |
CVE-2019-1590 | High | 8.1 | 2019-05-03 | A vulnerability in the Transport Layer Security (TLS) certificate validation functionality of Cisco Nexus 9000 Series Application Centric Infrastructure (ACI)… |
CVE-2019-1589 | Medium | 4.6 | 2019-05-03 | A vulnerability in the Trusted Platform Module (TPM) functionality of software for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructur… |
CVE-2019-1587 | Medium | 4.3 | 2019-05-03 | A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, remote attacker to ac… |
CVE-2019-1586 | Medium | 4.6 | 2019-05-03 | A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated, local attacker with physical access to ob… |
CVE-2019-11690 | Medium | 5.9 | 2019-05-03 | gen_rand_uuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in scenarios where CON… |
CVE-2019-11687 | High | 7.8 | 2019-05-02 | An issue was discovered in the DICOM Part 10 File Format in the NEMA DICOM Standard 1995 through 2019b and continuing in current implementations. The 128-byte… |
CVE-2019-9826 | High | 7.5 | 2019-05-02 | The fulltext search component in phpBB before 3.2.6 allows Denial of Service. |
CVE-2019-9017 | High | 7.5 | 2019-05-02 | DWRCC in SolarWinds DameWare Mini Remote Control 10.0 x64 has a Buffer Overflow associated with the size field for the machine name. |
CVE-2019-3490 | Medium | 6.1 | 2019-05-02 | A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server (OES) allowing a remote attacker to execute javascript… |
CVE-2019-11683 | Critical | 9.8 | 2019-05-02 | udp_gro_receive_segment in net/ipv4/udp_offload.c in the Linux kernel 5.x before 5.0.13 allows remote attackers to cause a denial of service (slab-out-of-bound… |
CVE-2019-11682 | Critical | 9.8 | 2019-05-02 | A buffer overflow in the SMTP response service in MailCarrier 2.51 allows the attacker to execute arbitrary code remotely via a long HELP command, a related is… |
CVE-2019-11678 | Critical | 9.8 | 2019-05-02 | The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection. |