2019 CVEs (page 138)
Page 138 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-3885 | Low | 3.3 | 2019-04-18 | A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be leaked via the system… |
CVE-2019-3398 | High | 8.8 | 2019-04-18 | Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attach… |
CVE-2019-11223 | Critical | 9.8 | 2019-04-18 | An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading… |
CVE-2019-11017 | Medium | 4.8 | 2019-04-18 | On D-Link DI-524 V2.06RU devices, multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration: /spap.htm, /smap.htm, and /cgi-bin/sma… |
CVE-2019-8999 | High | 7.5 | 2019-04-18 | An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access… |
CVE-2019-11322 | Critical | 9.8 | 2019-04-18 | An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function startRmtAssist in hnap, which leads to remote code execu… |
CVE-2019-11321 | Medium | 5.3 | 2019-04-18 | An issue was discovered in Motorola CX2 1.01 and M2 1.01. The router opens TCP port 8010. Users can send hnap requests to this port without authentication to o… |
CVE-2019-11320 | Critical | 9.8 | 2019-04-18 | In Motorola CX2 1.01 and M2 1.01, users can access the router's /priv_mgt.html web page to launch telnetd, as demonstrated by the 192.168.51.1 address. |
CVE-2019-11319 | Critical | 9.8 | 2019-04-18 | An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function downloadFirmware in hnap, which leads to remote code exe… |
CVE-2019-11035 | Critical | 9.1 | 2019-04-18 | When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated… |
CVE-2019-11034 | Critical | 9.1 | 2019-04-18 | When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated… |
CVE-2019-10306 | Critical | 9.9 | 2019-04-18 | A sandbox bypass vulnerability in Jenkins ontrack Plugin 3.4 and earlier allowed attackers with control over ontrack DSL definitions to execute arbitrary code… |
CVE-2019-10305 | Medium | 6.5 | 2019-04-18 | A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers with Over… |
CVE-2019-10304 | Medium | 6.5 | 2019-04-18 | A cross-site request forgery vulnerability in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows att… |
CVE-2019-10303 | High | 8.8 | 2019-04-18 | Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the Jenkins master where they… |
CVE-2019-10302 | High | 8.8 | 2019-04-18 | Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by use… |
CVE-2019-10301 | High | 8.8 | 2019-04-18 | A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers… |
CVE-2019-10300 | High | 8.0 | 2019-04-18 | A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method al… |
CVE-2019-1841 | Medium | 6.5 | 2019-04-18 | A vulnerability in the Software Image Management feature of Cisco DNA Center could allow an authenticated, remote attacker to access to internal services witho… |
CVE-2019-1840 | High | 8.6 | 2019-04-18 | A vulnerability in the DHCPv6 input packet processor of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to restart the server and… |
CVE-2019-1837 | Medium | 5.3 | 2019-04-18 | A vulnerability in the User Data Services (UDS) API of Cisco Unified Communications Manager (Unified CM) could allow an unauthenticated, remote attacker to cau… |
CVE-2019-1835 | Medium | 4.4 | 2019-04-18 | A vulnerability in the CLI of Cisco Aironet Access Points (APs) could allow an authenticated, local attacker to access sensitive information stored in an AP. T… |
CVE-2019-1834 | High | 7.4 | 2019-04-18 | A vulnerability in the internal packet processing of Cisco Aironet Series Access Points (APs) could allow an unauthenticated, adjacent attacker to cause a deni… |
CVE-2019-1831 | Medium | 5.8 | 2019-04-18 | A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacke… |
CVE-2019-1830 | Medium | 4.9 | 2019-04-18 | A vulnerability in Locally Significant Certificate (LSC) management for the Cisco Wireless LAN Controller (WLC) could allow an authenticated, remote attacker t… |
CVE-2019-1829 | Medium | 6.7 | 2019-04-18 | A vulnerability in the CLI of Cisco Aironet Series Access Points (APs) could allow an authenticated, local attacker to gain access to the underlying Linux oper… |
CVE-2019-1826 | Medium | 6.8 | 2019-04-18 | A vulnerability in the quality of service (QoS) feature of Cisco Aironet Series Access Points (APs) could allow an authenticated, adjacent attacker to cause a… |
CVE-2019-1805 | Medium | 4.3 | 2019-04-18 | A vulnerability in certain access control mechanisms for the Secure Shell (SSH) server implementation for Cisco Wireless LAN Controller (WLC) Software could al… |
CVE-2019-1802 | Medium | 4.8 | 2019-04-18 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to conduct a cro… |
CVE-2019-1800 | Medium | 6.5 | 2019-04-18 | A vulnerability in the handling of Inter-Access Point Protocol (IAPP) messages by Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated… |
CVE-2019-1799 | Medium | 6.5 | 2019-04-18 | A vulnerability in the handling of Inter-Access Point Protocol (IAPP) messages by Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated… |
CVE-2019-1797 | High | 8.8 | 2019-04-18 | A vulnerability in the web-based management interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to conduc… |
CVE-2019-1796 | Medium | 6.5 | 2019-04-18 | A vulnerability in the handling of Inter-Access Point Protocol (IAPP) messages by Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated… |
CVE-2019-1794 | Medium | 5.1 | 2019-04-18 | A vulnerability in the search path processing of Cisco Directory Connector could allow an authenticated, local attacker to load a binary of their choosing. The… |
CVE-2019-1792 | Medium | 6.1 | 2019-04-18 | A vulnerability in the URL block page of Cisco Umbrella could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against… |
CVE-2019-1777 | Medium | 5.4 | 2019-04-18 | A vulnerability in the web-based interface of the Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scrip… |
CVE-2019-1725 | Medium | 5.5 | 2019-04-18 | A vulnerability in the local management CLI implementation for specific commands on the Cisco UCS B-Series Blade Servers could allow an authenticated, local at… |
CVE-2019-1722 | Medium | 6.5 | 2019-04-18 | A vulnerability in the FindMe feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote… |
CVE-2019-1721 | Medium | 6.5 | 2019-04-18 | A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remo… |
CVE-2019-1720 | Medium | 6.8 | 2019-04-18 | A vulnerability in the XML API of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker… |
CVE-2019-1719 | Medium | 6.1 | 2019-04-18 | A vulnerability in the web-based guest portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-site scr… |
CVE-2019-1718 | High | 7.5 | 2019-04-17 | A vulnerability in the web interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to trigger high CPU usage, resulti… |
CVE-2019-1712 | Medium | 5.8 | 2019-04-17 | A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the PIM p… |
CVE-2019-1711 | Medium | 5.3 | 2019-04-17 | A vulnerability in the Event Management Service daemon (emsd) of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of ser… |
CVE-2019-1710 | Critical | 9.8 | 2019-04-17 | A vulnerability in the sysadmin virtual machine (VM) on Cisco ASR 9000 Series Aggregation Services Routers running Cisco IOS XR 64-bit Software could allow an… |
CVE-2019-1686 | High | 8.6 | 2019-04-17 | A vulnerability in the TCP flags inspection feature for access control lists (ACLs) on Cisco ASR 9000 Series Aggregation Services Routers could allow an unauth… |
CVE-2019-1654 | High | 7.8 | 2019-04-17 | A vulnerability in the development shell (devshell) authentication for Cisco Aironet Series Access Points (APs) running the Cisco AP-COS operating system could… |
CVE-2019-10643 | Critical | 9.8 | 2019-04-17 | Contao 4.7 allows Use of a Key Past its Expiration Date. |
CVE-2019-10642 | High | 8.8 | 2019-04-17 | Contao 4.7 allows CSRF. |
CVE-2019-10641 | Critical | 9.8 | 2019-04-17 | Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password. |
CVE-2019-0163 | High | 8.2 | 2019-04-17 | Insufficient input validation in system firmware for Intel(R) Broadwell U i5 vPro before version MYBDWi5v.86A may allow an authenticated user to potentially en… |
CVE-2019-0162 | Low | 3.8 | 2019-04-17 | Memory access in virtual memory mapping for some microprocessors may allow an authenticated user to potentially enable information disclosure via local access. |
CVE-2019-0158 | High | 7.8 | 2019-04-17 | Insufficient path checking in the installation package for Intel(R) Graphics Performance Analyzer for Linux version 18.4 and before may allow an authenticated… |
CVE-2019-9890 | Critical | 9.1 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecur… |
CVE-2019-9756 | Critical | 9.8 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 1… |
CVE-2019-9225 | Medium | 5.3 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Cont… |
CVE-2019-9224 | Medium | 5.3 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Cont… |
CVE-2019-9223 | High | 7.5 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2019-9222 | High | 8.1 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Insecure Permissions. |
CVE-2019-9220 | High | 7.5 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Uncontrolled Resou… |
CVE-2019-9219 | Low | 3.7 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Cont… |
CVE-2019-9217 | Critical | 9.8 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. Its User Interface has a Mis… |
CVE-2019-9179 | Low | 3.7 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2019-9178 | Medium | 5.3 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2019-9176 | Medium | 6.5 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows CSRF. |
CVE-2019-9175 | Medium | 5.3 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2019-9174 | Critical | 10.0 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows SSRF. |
CVE-2019-9172 | Medium | 5.9 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2019-9171 | Low | 3.7 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposu… |
CVE-2019-9170 | Medium | 5.3 | 2019-04-17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Cont… |
CVE-2019-8455 | High | 7.1 | 2019-04-17 | A hard-link created from the log file of Check Point ZoneAlarm up to 15.4.062 to any file on the system will get its permission changed so that all users can a… |
CVE-2019-8453 | Medium | 5.5 | 2019-04-17 | Some of the DLLs loaded by Check Point ZoneAlarm up to 15.4.062 are taken from directories where all users have write permissions. This can allow a local attac… |
CVE-2019-10953 | High | 7.5 | 2019-04-17 | ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are suscep… |
CVE-2019-10951 | High | 7.8 | 2019-04-17 | Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by pr… |
CVE-2019-10949 | Medium | 5.5 | 2019-04-17 | Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple out-of-bounds read vulnerabilities may be exploited, allowing inf… |
CVE-2019-10947 | High | 7.8 | 2019-04-17 | Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by p… |
CVE-2019-0228 | Critical | 9.8 | 2019-04-17 | Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a c… |
CVE-2019-9499 | High | 8.1 | 2019-04-17 | The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validat… |
CVE-2019-9498 | High | 8.1 | 2019-04-17 | The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the… |
CVE-2019-9497 | High | 8.1 | 2019-04-17 | The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerab… |
CVE-2019-9496 | High | 7.5 | 2019-04-17 | An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm messag… |
CVE-2019-9495 | Low | 3.7 | 2019-04-17 | The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hosta… |
CVE-2019-9494 | Medium | 5.9 | 2019-04-17 | The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access p… |
CVE-2019-6579 | Critical | 9.8 | 2019-04-17 | A vulnerability has been identified in Spectrum Power 4 (with Web Office Portal). An attacker with network access to the web server on port 80/TCP or 443/TCP c… |
CVE-2019-6575 | High | 7.5 | 2019-04-17 | A vulnerability has been identified in SIMATIC CP 443-1 OPC UA (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All ver… |
CVE-2019-6570 | High | 8.8 | 2019-04-17 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Due to insufficient checking of user permissions, an attacker may ac… |
CVE-2019-6568 | High | 7.5 | 2019-04-17 | The webserver of the affected devices contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service situ… |
CVE-2019-3883 | High | 7.5 | 2019-04-17 | In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds… |
CVE-2019-3798 | Medium | 6.0 | 2019-04-17 | Cloud Foundry Cloud Controller API Release, versions prior to 1.79.0, contains improper authentication when validating user permissions. A remote authenticated… |
CVE-2019-3709 | High | 8.3 | 2019-04-17 | IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while registering vCenter servers. A remote attacker can trick an admin user to… |
CVE-2019-3708 | High | 8.3 | 2019-04-17 | IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while uploading an OVA file. A remote attacker can trick an admin user to potent… |
CVE-2019-7155 | Medium | 6.5 | 2019-04-16 | An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has In… |
CVE-2019-9845 | Critical | 9.8 | 2019-04-16 | madskristensen Miniblog.Core through 2019-01-16 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesTo… |
CVE-2019-5520 | Medium | 5.9 | 2019-04-15 | VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11… |
CVE-2019-5517 | Medium | 6.8 | 2019-04-15 | VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11… |
CVE-2019-5516 | Medium | 6.8 | 2019-04-15 | VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6), Fusion (11.x before 11… |
CVE-2019-6609 | Critical | 9.8 | 2019-04-15 | Platform dependent weakness. This issue only impacts iSeries platforms. On these platforms, in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, F… |
CVE-2019-4203 | Critical | 9.8 | 2019-04-15 | IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers to download arbitrary files from the host OS and potentially carry out… |
CVE-2019-4202 | Critical | 10.0 | 2019-04-15 | IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitrary code on… |
CVE-2019-4178 | Medium | 6.4 | 2019-04-15 | IBM Cognos Analytics 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to write or… |