2019 CVEs (page 14)
Page 14 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-19160 | Medium | 5.7 | 2020-06-29 | Reportexpress ProPlus contains a vulnerability that could allow an arbitrary code execution by inserted VBscript into the configure file(rxp). |
CVE-2019-18256 | Medium | 4.6 | 2020-06-29 | BIOTRONIK CardioMessenger II, The affected products use individual per-device credentials that are stored in a recoverable format. An attacker with physical ac… |
CVE-2019-18254 | Medium | 4.6 | 2020-06-29 | BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest. An attacker with physical access to the CardioMessenger… |
CVE-2019-18252 | Medium | 4.3 | 2020-06-29 | BIOTRONIK CardioMessenger II, The affected products allow credential reuse for multiple authentication purposes. An attacker with adjacent access to the Cardio… |
CVE-2019-18248 | Medium | 4.3 | 2020-06-29 | BIOTRONIK CardioMessenger II, The affected products transmit credentials in clear-text prior to switching to an encrypted communication channel. An attacker ca… |
CVE-2019-18246 | Medium | 4.3 | 2020-06-29 | BIOTRONIK CardioMessenger II, The affected products do not properly enforce mutual authentication with the BIOTRONIK Remote Communication infrastructure. |
CVE-2019-3681 | High | 7.5 | 2020-06-29 | A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Developme… |
CVE-2019-20414 | Medium | 5.4 | 2020-06-29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulne… |
CVE-2019-20413 | High | 7.5 | 2020-06-29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulner… |
CVE-2019-20412 | Medium | 5.3 | 2020-06-29 | The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information… |
CVE-2019-20411 | Medium | 4.3 | 2020-06-29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerab… |
CVE-2019-20410 | Medium | 6.5 | 2020-06-29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in… |
CVE-2019-4650 | Medium | 6.3 | 2020-06-26 | IBM Maximo Asset Management 7.6.1.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attack… |
CVE-2019-19506 | High | 7.5 | 2020-06-25 | Tenda PA6 Wi-Fi Powerline extender 1.0.1.21 is vulnerable to a denial of service, caused by an error in the "homeplugd" process. By sending a specially crafted… |
CVE-2019-19505 | High | 8.8 | 2020-06-25 | Tenda PA6 Wi-Fi Powerline extender 1.0.1.21 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the "Wireless" section in the… |
CVE-2019-16213 | High | 8.8 | 2020-06-25 | Tenda PA6 Wi-Fi Powerline extender 1.0.1.21 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially cra… |
CVE-2019-20892 | Medium | 6.5 | 2020-06-25 | net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp pack… |
CVE-2019-20409 | Critical | 9.8 | 2020-06-23 | The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code exec… |
CVE-2019-3865 | Medium | 6.1 | 2020-06-22 | A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name fie… |
CVE-2019-14894 | High | 8.0 | 2020-06-22 | A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS sch… |
CVE-2019-14094 | High | 7.8 | 2020-06-22 | Integer overflow in diag command handler when user inputs a large value for number of tasks field in the request packet in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-14092 | Medium | 5.5 | 2020-06-22 | System Services exports services without permission protect and can lead to information exposure in Snapdragon Industrial IOT, Snapdragon Mobile in MDM9206, MD… |
CVE-2019-14091 | High | 7.8 | 2020-06-22 | Double free issue in NPU due to lack of resource locking mechanism to avoid race condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Sna… |
CVE-2019-14080 | Critical | 9.8 | 2020-06-22 | Out of bound write can happen due to lack of check of array index value while parsing SDP attribute for SAR in Snapdragon Auto, Snapdragon Compute, Snapdragon… |
CVE-2019-14076 | High | 7.8 | 2020-06-22 | Buffer overflow occurs while processing an subsample data length out of range due to lack of user input validation in Snapdragon Auto, Snapdragon Compute, Snap… |
CVE-2019-14073 | Critical | 9.8 | 2020-06-22 | Copying RTCP messages into the output buffer without checking the destination buffer size which could lead to a remote stack overflow when processing large dat… |
CVE-2019-14062 | Critical | 9.8 | 2020-06-22 | Buffer overflows while decoding setup message from Network due to lack of check of IE message length received from network in Snapdragon Auto, Snapdragon Compu… |
CVE-2019-14047 | High | 7.8 | 2020-06-22 | While IPA driver processes route add rule IOCTL, there is no input validation of the rule ID prior to adding the rule to the IPA HW commit list in Snapdragon A… |
CVE-2019-10626 | Medium | 5.5 | 2020-06-22 | Payload size is not validated before reading memory that may cause issue of accessing invalid pointer or some garbage data in Snapdragon Auto, Snapdragon Compu… |
CVE-2019-10597 | High | 7.8 | 2020-06-22 | kernel writes to user passed address without any checks can lead to arbitrary memory write in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sna… |
CVE-2019-20891 | High | 8.8 | 2020-06-19 | WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XS… |
CVE-2019-20890 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.7. It allows a bypass of e-mail address discovery restrictions. |
CVE-2019-20889 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation. |
CVE-2019-20888 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service (memory consumption) via an… |
CVE-2019-20887 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.7.1, 5.6.4, 5.5.3, and 4.10.6. It does not honor flags API permissions when deciding whether a user can r… |
CVE-2019-20886 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin. |
CVE-2019-20885 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file. |
CVE-2019-20884 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially attach a file to more than one post. |
CVE-2019-20883 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post. |
CVE-2019-20882 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team. |
CVE-2019-20881 | High | 7.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA. |
CVE-2019-20880 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. It allows attackers to cause a denial of service (memory consumption) via… |
CVE-2019-20879 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. Changes to e-mail addresses do not require credential re-entry. |
CVE-2019-20878 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Changes, within the application, to e-mail addresses are mishandled. |
CVE-2019-20877 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information about whether someone… |
CVE-2019-20876 | Medium | 5.4 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deactivate themselves, bypassing a policy. |
CVE-2019-20875 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows a password reset to proceed while an e-mail address is being cha… |
CVE-2019-20874 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during a role change. |
CVE-2019-20873 | Medium | 6.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user activation… |
CVE-2019-20872 | Medium | 5.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services. |
CVE-2019-20871 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic backtracking. |
CVE-2019-20870 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID. |
CVE-2019-20869 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Update/Patch Channel endpoint for a private… |
CVE-2019-20868 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated. |
CVE-2019-20867 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post. |
CVE-2019-20866 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for obtaining IP… |
CVE-2019-20865 | High | 8.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF. |
CVE-2019-20864 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Plugins before 5.13.0. The GitHub plugin allows an attacker to attach his Mattermost account to a different person's GitH… |
CVE-2019-20863 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted. |
CVE-2019-20862 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands. |
CVE-2019-20861 | High | 8.8 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted link. |
CVE-2019-20860 | Medium | 5.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service (application han… |
CVE-2019-20859 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input. |
CVE-2019-20858 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service (CPU consumption) via crafted characters in a SQL… |
CVE-2019-20857 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.16.0. It allows attackers to cause a denial of service (markdown renderer hang) via many backtick charact… |
CVE-2019-20856 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection. |
CVE-2019-20855 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information (local files) during… |
CVE-2019-20854 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.17.0. It allows remote attackers to cause a denial of service (client-side application crash) via a LaTeX… |
CVE-2019-20853 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Packages before 5.16.3. A Droplet could allow Internet access to a service that has a remote code execution problem. |
CVE-2019-20852 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0. Local logging is not blocked for sensitive information (e.g., server addresses or message cont… |
CVE-2019-20851 | Critical | 9.1 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to overwrite arbitrary… |
CVE-2019-20850 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0. A view cache can persist on a device after a logout. |
CVE-2019-20849 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0. Cookie data can persist on a device after a logout. |
CVE-2019-20848 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0. The Quick Reply feature mishandles crafted replies. |
CVE-2019-20847 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0. An attacker can send a user_typing WebSocket event to any channel. |
CVE-2019-20846 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0. It has weak permissions for server-local file storage. |
CVE-2019-20845 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0. It allows attackers to cause a denial of service (memory consumption) via a large Slack import. |
CVE-2019-20844 | Medium | 6.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the t… |
CVE-2019-20843 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There are weak permissions for configuration files. |
CVE-2019-20842 | High | 7.2 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There is SQL injection by admins via SearchAllChannels. |
CVE-2019-20841 | High | 8.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. CSRF can sometimes occur via a crafted web site for account take… |
CVE-2019-13033 | Low | 3.3 | 2020-06-18 | In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data upload is being performed. This license can be us… |
CVE-2019-9944 | High | 7.5 | 2020-06-17 | In Open Microscopy Environment OMERO.server 5.0.0 through 5.6.0, the reading of files from imported image filesets may circumvent OMERO permissions restriction… |
CVE-2019-9943 | High | 7.5 | 2020-06-17 | In ome.services.graphs.GraphTraversal.findObjectDetails in Open Microscopy Environment OMERO.server 5.1.0 through 5.6.0, permissions on OMERO model objects may… |
CVE-2019-16245 | Medium | 5.3 | 2020-06-17 | OMERO before 5.6.1 makes the details of each user available to all users. |
CVE-2019-20840 | High | 7.5 | 2020-06-17 | An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode. |
CVE-2019-20839 | High | 7.5 | 2020-06-17 | libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename. |
CVE-2019-17655 | Medium | 5.3 | 2020-06-16 | A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earl… |
CVE-2019-18614 | High | 7.8 | 2020-06-16 | On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow. This is because the maximum BLOC buffer size for se… |
CVE-2019-20838 | High | 7.5 | 2020-06-15 | libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to… |
CVE-2019-19112 | Medium | 6.1 | 2020-06-15 | The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php. |
CVE-2019-19111 | Medium | 6.1 | 2020-06-15 | The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter. |
CVE-2019-19110 | Medium | 4.8 | 2020-06-15 | The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter. |
CVE-2019-19109 | High | 8.8 | 2020-06-15 | The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF. |
CVE-2019-16252 | Medium | 5.9 | 2020-06-12 | Missing SSL Certificate Validation in the Nutfind.com application through 3.9.12 for Android allows a man-in-the-middle attacker to sniff and manipulate all AP… |
CVE-2019-15123 | High | 7.2 | 2020-06-12 | The Branding Module in Viki Vera 4.9.1.26180 allows an authenticated user to change the logo on the website. An attacker could use this to upload a malicious… |
CVE-2019-4576 | Critical | 9.8 | 2020-06-10 | IBM QRadar Network Packet Capture 7.3.0 - 7.3.3 Patch 1 and 7.4.0 GA does not require that users should have strong passwords by default, which makes it easier… |
CVE-2019-3588 | Medium | 6.3 | 2020-06-10 | Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 14 may allow unauthorized u… |
CVE-2019-3585 | High | 7.0 | 2020-06-10 | Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 14 may allow local users to… |
CVE-2019-3613 | Medium | 5.9 | 2020-06-10 | DLL Search Order Hijacking vulnerability in McAfee Agent (MA) prior to 5.6.4 allows attackers with local access to execute arbitrary code via execution from a… |