2019 CVEs (page 140)
Page 140 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-0874 | Medium | 6.1 | 2019-04-09 | A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site… |
CVE-2019-0871 | Medium | 6.1 | 2019-04-09 | A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure… |
CVE-2019-0870 | Medium | 6.1 | 2019-04-09 | A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure… |
CVE-2019-0869 | Medium | 6.1 | 2019-04-09 | A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTML Injection Vulnera… |
CVE-2019-0868 | Medium | 6.1 | 2019-04-09 | A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure… |
CVE-2019-0867 | Medium | 6.1 | 2019-04-09 | A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure… |
CVE-2019-0866 | Medium | 6.1 | 2019-04-09 | A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure… |
CVE-2019-0862 | High | 7.5 | 2019-04-09 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory… |
CVE-2019-0861 | High | 7.5 | 2019-04-09 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
CVE-2019-0860 | High | 7.5 | 2019-04-09 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
CVE-2019-0859 | High | 7.8 | 2019-04-09 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil… |
CVE-2019-0858 | Medium | 6.1 | 2019-04-09 | A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoof… |
CVE-2019-0857 | Medium | 6.5 | 2019-04-09 | A spoofing vulnerability that could allow a security feature bypass exists in when Azure DevOps Server does not properly sanitize user provided input, aka 'Azu… |
CVE-2019-0856 | High | 7.2 | 2019-04-09 | A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Remote Code Execution Vulnerability'. |
CVE-2019-0853 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code E… |
CVE-2019-0851 | High | 7.8 | 2019-04-09 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2019-0849 | Medium | 6.5 | 2019-04-09 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-0848 | Medium | 5.5 | 2019-04-09 | An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerabili… |
CVE-2019-0847 | High | 7.8 | 2019-04-09 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2019-0846 | High | 7.8 | 2019-04-09 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2019-0845 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the IOleCvt interface renders ASP webpage content, aka 'Windows IOleCvt Interface Remote Code Execution Vulne… |
CVE-2019-0844 | Medium | 5.5 | 2019-04-09 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera… |
CVE-2019-0842 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'Windows VBScript Engine Remote Code Execution… |
CVE-2019-0841 | High | 7.8 | 2019-04-09 | An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privileg… |
CVE-2019-0840 | Medium | 5.5 | 2019-04-09 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera… |
CVE-2019-0839 | Medium | 4.4 | 2019-04-09 | An information disclosure vulnerability exists when the Terminal Services component improperly discloses the contents of its memory, aka 'Windows Information D… |
CVE-2019-0838 | High | 7.8 | 2019-04-09 | An information disclosure vulnerability exists when Windows Task Scheduler improperly discloses credentials to Windows Credential Manager, aka 'Windows Informa… |
CVE-2019-0837 | Medium | 5.5 | 2019-04-09 | An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure Vulnerability'. |
CVE-2019-0836 | High | 7.8 | 2019-04-09 | An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulne… |
CVE-2019-0835 | Medium | 6.5 | 2019-04-09 | An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory, aka 'Microsoft Scripting Engine Informatio… |
CVE-2019-0833 | Medium | 6.5 | 2019-04-09 | An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka 'Microsoft Edge Information Disclosure Vulnerabili… |
CVE-2019-0831 | Medium | 5.4 | 2019-04-09 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2019-0830 | Medium | 5.4 | 2019-04-09 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2019-0829 | High | 7.5 | 2019-04-09 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
CVE-2019-0828 | High | 7.8 | 2019-04-09 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
CVE-2019-0827 | High | 7.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office A… |
CVE-2019-0826 | High | 7.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office A… |
CVE-2019-0825 | High | 7.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office A… |
CVE-2019-0824 | High | 7.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office A… |
CVE-2019-0823 | High | 7.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office A… |
CVE-2019-0822 | High | 7.8 | 2019-04-09 | A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Remote… |
CVE-2019-0817 | Medium | 5.4 | 2019-04-09 | A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoof… |
CVE-2019-0815 | High | 7.5 | 2019-04-09 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'. |
CVE-2019-0814 | Medium | 5.5 | 2019-04-09 | An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerabili… |
CVE-2019-0813 | Critical | 9.8 | 2019-04-09 | An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain situations, aka 'Windows Admin Center El… |
CVE-2019-0812 | High | 7.5 | 2019-04-09 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
CVE-2019-0810 | High | 7.5 | 2019-04-09 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
CVE-2019-0806 | High | 7.5 | 2019-04-09 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
CVE-2019-0805 | High | 7.8 | 2019-04-09 | An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulne… |
CVE-2019-0803 | High | 7.8 | 2019-04-09 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil… |
CVE-2019-0802 | Medium | 6.5 | 2019-04-09 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-0801 | High | 7.8 | 2019-04-09 | A remote code execution vulnerability exists when Microsoft Office fails to properly handle certain files.To exploit the vulnerability, an attacker would have… |
CVE-2019-0796 | Medium | 5.5 | 2019-04-09 | An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulne… |
CVE-2019-0795 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-0794 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when OLE automation improperly handles objects in memory, aka 'OLE Automation Remote Code Execution Vulnerability'. |
CVE-2019-0793 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-0792 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-0791 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-0790 | High | 8.8 | 2019-04-09 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-0786 | Critical | 9.8 | 2019-04-09 | An elevation of privilege vulnerability exists in the Microsoft Server Message Block (SMB) Server when an attacker with valid credentials attempts to open a sp… |
CVE-2019-0764 | Medium | 6.5 | 2019-04-09 | A tampering vulnerability exists when Microsoft browsers do not properly validate input under specific conditions, aka 'Microsoft Browsers Tampering Vulnerabil… |
CVE-2019-0753 | High | 7.5 | 2019-04-09 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory… |
CVE-2019-0752 | High | 7.5 | 2019-04-09 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory… |
CVE-2019-0739 | High | 7.5 | 2019-04-09 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Cor… |
CVE-2019-0735 | High | 7.8 | 2019-04-09 | An elevation of privilege vulnerability exists when the Windows Client Server Run-Time Subsystem (CSRSS) fails to properly handle objects in memory, aka 'Windo… |
CVE-2019-0732 | High | 7.8 | 2019-04-09 | A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard when Windows improperly handles calls to the LUA… |
CVE-2019-0731 | High | 7.8 | 2019-04-09 | An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulne… |
CVE-2019-0730 | High | 7.8 | 2019-04-09 | An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulne… |
CVE-2019-0688 | High | 7.5 | 2019-04-09 | An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka 'Windows TCP/IP Information Disclosu… |
CVE-2019-0685 | High | 7.8 | 2019-04-09 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil… |
CVE-2019-7361 | High | 7.8 | 2019-04-09 | An attacker may convince a victim to open a malicious action micro (.actm) file that has serialized data, which may trigger a code execution in Autodesk Advanc… |
CVE-2019-7360 | High | 7.8 | 2019-04-09 | An exploitable use-after-free vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architectu… |
CVE-2019-7359 | High | 7.8 | 2019-04-09 | An exploitable heap overflow vulnerability in the AcCellMargin handling code in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architectu… |
CVE-2019-7358 | High | 7.8 | 2019-04-09 | An exploitable heap overflow vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architectur… |
CVE-2019-5513 | Medium | 5.3 | 2019-04-09 | VMware Horizon Connection Server (7.x before 7.8, 7.5.x before 7.5.2, 6.x before 6.2.8) contains an information disclosure vulnerability. Successful exploitati… |
CVE-2019-5512 | High | 8.8 | 2019-04-09 | VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) running on Windows does not handle COM classes appropriately. Successful exploitation of this issue… |
CVE-2019-5511 | High | 8.8 | 2019-04-09 | VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) running on Windows does not handle paths appropriately. Successful exploitation of this issue may a… |
CVE-2019-1567 | Medium | 5.4 | 2019-04-09 | The Expedition Migration tool 1.1.6 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping Settings. |
CVE-2019-9134 | Critical | 9.8 | 2019-04-09 | Architectural Information System 1.0 and earlier versions have a Stack-based buffer overflow, allows remote attackers to execute arbitrary code. |
CVE-2019-9133 | Medium | 5.5 | 2019-04-09 | When processing subtitles format media file, KMPlayer version 2018.12.24.14 or lower doesn't check object size correctly, which leads to integer underflow then… |
CVE-2019-8990 | High | 8.1 | 2019-04-09 | The HTTP Connector component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks contains a vulnerability that theoretically allows unauthenticated HTTP… |
CVE-2019-7174 | Critical | 9.8 | 2019-04-09 | Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Echo File List), and… |
CVE-2019-6117 | Medium | 6.1 | 2019-04-09 | The wpape APE GALLERY plugin 1.6.14 for WordPress has stored XSS via the classGallery.php getCategories function. |
CVE-2019-5615 | Medium | 6.5 | 2019-04-09 | Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwor… |
CVE-2019-3941 | High | 7.5 | 2019-04-09 | Advantech WebAccess 8.3.4 allows unauthenticated, remote attackers to delete arbitrary files via IOCTL 10005 RPC. |
CVE-2019-3940 | Critical | 9.8 | 2019-04-09 | Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call. An unauthenticated, remote attacker can use this vulnerability to… |
CVE-2019-3893 | Medium | 4.9 | 2019-04-09 | In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password… |
CVE-2019-3887 | Medium | 5.6 | 2019-04-09 | A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest cou… |
CVE-2019-3880 | Medium | 5.4 | 2019-04-09 | A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to creat… |
CVE-2019-3870 | Medium | 6.1 | 2019-04-09 | A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are create… |
CVE-2019-3795 | Medium | 5.3 | 2019-04-09 | Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureR… |
CVE-2019-10244 | High | 7.5 | 2019-04-09 | In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service (not part… |
CVE-2019-10243 | Medium | 5.3 | 2019-04-09 | In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies. This can be used as a hint by an attacker to specifical… |
CVE-2019-10242 | Medium | 5.3 | 2019-04-09 | In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversal in get requests… |
CVE-2019-11028 | High | 8.8 | 2019-04-09 | GAT-Ship Web Module before 1.40 suffers from a vulnerability allowing authenticated attackers to upload any file type to the server via the "Documents" area. T… |
CVE-2019-10634 | Medium | 5.4 | 2019-04-09 | An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitrary JavaScript or HTML via the user, gr… |
CVE-2019-10633 | High | 8.8 | 2019-04-09 | An eval injection vulnerability in the Python web server routing on the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to execute… |
CVE-2019-10632 | Medium | 6.5 | 2019-04-09 | A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the loca… |
CVE-2019-10631 | High | 8.8 | 2019-04-09 | Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via m… |
CVE-2019-10630 | High | 8.8 | 2019-04-09 | A plaintext password vulnerability in the Zyxel NAS 326 through 5.21 allows an elevated privileged user to get the admin password of the device. |