2019 CVEs (page 142)
Page 142 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10845 | Medium | 6.5 | 2019-04-08 | An issue was discovered in Uniqkey Password Manager 1.14. When entering new credentials to a site that isn't registered within this product, a pop-up window wi… |
CVE-2019-11001 | High | 7.2 | 2019-04-08 | On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and… |
CVE-2019-10676 | Medium | 6.5 | 2019-04-08 | An issue was discovered in Uniqkey Password Manager 1.14. Upon entering new credentials to a site that is not registered within this product, a pop-up window w… |
CVE-2019-4210 | High | 8.1 | 2019-04-08 | IBM QRadar SIEM 7.3.2 could allow a user to bypass authentication exposing certain functionality which could lead to information disclosure or modification of… |
CVE-2019-4155 | High | 8.8 | 2019-04-08 | IBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect (OIDC) user… |
CVE-2019-4143 | Medium | 5.5 | 2019-04-08 | The IBM Cloud Private Key Management Service (IBM Cloud Private 3.1.1 and 3.1.2) could allow a local user to obtain sensitive from the KMS plugin container log… |
CVE-2019-4051 | Medium | 5.3 | 2019-04-08 | Some URIs in IBM API Connect 2018.1 and 2018.4.1.3 disclose system specification information like the machine id, system uuid, filesystem paths, network interf… |
CVE-2019-4045 | Medium | 4.3 | 2019-04-08 | IBM Business Automation Workflow and IBM Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 provide embedded document management features. Because of a… |
CVE-2019-10914 | Critical | 9.8 | 2019-04-08 | pubRsaDecryptSignedElementExt in MatrixSSL 4.0.1 Open, as used in Inside Secure TLS Toolkit, has a stack-based buffer overflow during X.509 certificate verific… |
CVE-2019-10741 | Medium | 4.3 | 2019-04-07 | K-9 Mail v5.600 can include the original quoted HTML code of a specially crafted, benign looking, email within (digitally signed) reply messages. The quoted pa… |
CVE-2019-10740 | Medium | 4.3 | 2019-04-07 | In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. Th… |
CVE-2019-10735 | Medium | 4.3 | 2019-04-07 | In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted pa… |
CVE-2019-10734 | Medium | 4.3 | 2019-04-07 | In KDE Trojita 0.7, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part… |
CVE-2019-10732 | Medium | 4.3 | 2019-04-07 | In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part… |
CVE-2019-10908 | Critical | 9.8 | 2019-04-07 | In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG… |
CVE-2019-10907 | Critical | 9.8 | 2019-04-07 | Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An attacker able to captur… |
CVE-2019-10906 | High | 8.6 | 2019-04-07 | In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape. |
CVE-2019-10905 | High | 8.1 | 2019-04-06 | Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script (already run… |
CVE-2019-10904 | Medium | 6.1 | 2019-04-06 | Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors. |
CVE-2019-9490 | High | 8.8 | 2019-04-05 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance version 6.5 SP2 could allow an non-authorized user to disclose administrative credentia… |
CVE-2019-9489 | High | 7.5 | 2019-04-05 | A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (versions XG and 11.0), and Worry-Free Business Security (versions 10.0, 9.5 and 9.0) c… |
CVE-2019-6554 | High | 7.5 | 2019-04-05 | Advantech WebAccess/SCADA, Versions 8.3.5 and prior. An improper access control vulnerability may allow an attacker to cause a denial-of-service condition. |
CVE-2019-6552 | Critical | 9.8 | 2019-04-05 | Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, m… |
CVE-2019-6550 | Critical | 9.8 | 2019-04-05 | Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length… |
CVE-2019-10479 | Critical | 9.8 | 2019-04-05 | An issue was discovered on Glory RBW-100 devices with firmware ISP-K05-02 7.0.0. A hard-coded username and password were identified that allow a remote attacke… |
CVE-2019-10478 | High | 7.2 | 2019-04-05 | An issue was discovered on Glory RBW-100 devices with firmware ISP-K05-02 7.0.0. An unrestricted file upload vulnerability in the Front Circle Controller glyto… |
CVE-2019-10888 | High | 8.8 | 2019-04-05 | A CSRF Issue that can add an admin user was discovered in UKcms v1.1.10 via admin.php/admin/role/add.html. |
CVE-2019-10887 | Medium | 6.1 | 2019-04-05 | A reflected HTML injection vulnerability on Salicru SLC-20-cube3(5) devices running firmware version cs121-SNMP v4.54.82.130611 allows remote attackers to inje… |
CVE-2019-10885 | High | 7.8 | 2019-04-05 | An issue was discovered in Ivanti Workspace Control before 10.3.90.0. Local authenticated users with low privileges in a Workspace Control managed session can… |
CVE-2019-10884 | High | 8.8 | 2019-04-05 | Uniqkey Password Manager 1.14 contains a vulnerability because it fails to recognize the difference between domains and sub-domains. The vulnerability means th… |
CVE-2019-10875 | Medium | 6.5 | 2019-04-05 | A URL spoofing vulnerability was found in all international versions of Xiaomi Mi browser 10.5.6-g (aka the MIUI native browser) and Mint Browser 1.5.3 due to… |
CVE-2019-10877 | Critical | 9.8 | 2019-04-05 | In Teeworlds 0.7.2, there is an integer overflow in CMap::Load() in engine/shared/map.cpp that can lead to a buffer overflow, because multiplication of width a… |
CVE-2019-10879 | Critical | 9.8 | 2019-04-05 | In Teeworlds 0.7.2, there is an integer overflow in CDataFileReader::Open() in engine/shared/datafile.cpp that can lead to a buffer overflow and possibly remot… |
CVE-2019-10878 | Critical | 9.8 | 2019-04-05 | In Teeworlds 0.7.2, there is a failed bounds check in CDataFileReader::GetData() and CDataFileReader::ReplaceData() and related functions in engine/shared/data… |
CVE-2019-10876 | Medium | 6.5 | 2019-04-05 | An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/over… |
CVE-2019-10874 | High | 8.8 | 2019-04-05 | Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a Jav… |
CVE-2019-10873 | Medium | 6.5 | 2019-04-05 | An issue was discovered in Poppler 0.74.0. There is a NULL pointer dereference in the function SplashClip::clipAALine at splash/SplashClip.cc. |
CVE-2019-10872 | High | 8.8 | 2019-04-05 | An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function Splash::blitTransparent at splash/Splash.cc. |
CVE-2019-10871 | Medium | 6.5 | 2019-04-05 | An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc. |
CVE-2019-10868 | Medium | 6.5 | 2019-04-05 | In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated u… |
CVE-2019-6553 | Critical | 9.8 | 2019-04-04 | A vulnerability was found in Rockwell Automation RSLinx Classic versions 4.10.00 and prior. An input validation issue in a .dll file of RSLinx Classic where th… |
CVE-2019-10867 | High | 8.8 | 2019-04-04 | An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it po… |
CVE-2019-10863 | High | 7.2 | 2019-04-04 | A command injection vulnerability exists in TeemIp versions before 2.4.0. The new_config parameter of exec.php allows one to create a new PHP file with the exc… |
CVE-2019-7001 | Critical | 9.9 | 2019-04-04 | A SQL injection vulnerability in the WebUI component of IP Office Contact Center could allow an authenticated attacker to retrieve or alter sensitive data rela… |
CVE-2019-3886 | Medium | 5.4 | 2019-04-04 | An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, whic… |
CVE-2019-1828 | Medium | 5.9 | 2019-04-04 | A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remo… |
CVE-2019-1827 | Medium | 6.1 | 2019-04-04 | A vulnerability in the Online Help web service of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote atta… |
CVE-2019-10856 | Medium | 6.1 | 2019-04-04 | In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. This issue exists because of an incomplete fix for CVE-2019-10255. |
CVE-2019-10299 | High | 8.8 | 2019-04-04 | Jenkins CloudCoreo DeployTime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users wi… |
CVE-2019-10298 | High | 8.8 | 2019-04-04 | Jenkins Koji Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the… |
CVE-2019-10297 | High | 8.8 | 2019-04-04 | Jenkins Sametime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-10296 | High | 8.8 | 2019-04-04 | Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with a… |
CVE-2019-10295 | High | 8.8 | 2019-04-04 | Jenkins crittercism-dsym Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Re… |
CVE-2019-10294 | High | 8.8 | 2019-04-04 | Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permissio… |
CVE-2019-10293 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers with Overall/Read permission to… |
CVE-2019-10292 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers to initiate a c… |
CVE-2019-10291 | High | 8.8 | 2019-04-04 | Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be… |
CVE-2019-10290 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form validation method all… |
CVE-2019-10289 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form valid… |
CVE-2019-10288 | High | 8.8 | 2019-04-04 | Jenkins Jabber Server Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acces… |
CVE-2019-10287 | High | 8.8 | 2019-04-04 | Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed… |
CVE-2019-10286 | High | 8.8 | 2019-04-04 | Jenkins DeployHub Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read perm… |
CVE-2019-10285 | High | 8.8 | 2019-04-04 | Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acces… |
CVE-2019-10284 | High | 8.8 | 2019-04-04 | Jenkins Diawi Upload Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read p… |
CVE-2019-10283 | High | 8.8 | 2019-04-04 | Jenkins mabl Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permissio… |
CVE-2019-10282 | High | 8.8 | 2019-04-04 | Jenkins Klaros-Testmanagement Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extend… |
CVE-2019-10281 | High | 8.8 | 2019-04-04 | Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be v… |
CVE-2019-10280 | High | 8.8 | 2019-04-04 | Jenkins Assembla Auth Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users… |
CVE-2019-10279 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows attackers with Overa… |
CVE-2019-10278 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows atta… |
CVE-2019-10277 | High | 8.8 | 2019-04-04 | Jenkins StarTeam Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permi… |
CVE-2019-10273 | Medium | 4.3 | 2019-04-04 | Information leakage vulnerability in the /mc login page in ManageEngine ServiceDesk Plus 9.3 software allows authenticated users to enumerate active users. Due… |
CVE-2019-1003099 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers with Overal… |
CVE-2019-1003098 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attac… |
CVE-2019-1003097 | Medium | 6.5 | 2019-04-04 | Jenkins Crowd Integration Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by u… |
CVE-2019-1003096 | Medium | 6.5 | 2019-04-04 | Jenkins TestFairy Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read perm… |
CVE-2019-1003095 | Medium | 6.5 | 2019-04-04 | Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with acc… |
CVE-2019-1003094 | Medium | 6.5 | 2019-04-04 | Jenkins Open STF Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-1003093 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method allows attackers with Overall/Read… |
CVE-2019-1003092 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method allows attackers to… |
CVE-2019-1003091 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows attackers with Ove… |
CVE-2019-1003090 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allows at… |
CVE-2019-1003089 | Medium | 6.5 | 2019-04-04 | Jenkins Upload to pgyer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Rea… |
CVE-2019-1003088 | Medium | 6.5 | 2019-04-04 | Jenkins Fabric Beta Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extend… |
CVE-2019-1003087 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows attacke… |
CVE-2019-1003086 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation metho… |
CVE-2019-1003085 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method allows attackers wi… |
CVE-2019-1003084 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method all… |
CVE-2019-1003083 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers with Overall/Read perm… |
CVE-2019-1003082 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers to ini… |
CVE-2019-1003081 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validation method allows… |
CVE-2019-1003080 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validati… |
CVE-2019-1003079 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method allows attacker… |
CVE-2019-1003078 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation method… |
CVE-2019-1003077 | Medium | 6.5 | 2019-04-04 | A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation method allows attacke… |
CVE-2019-1003076 | Medium | 6.5 | 2019-04-04 | A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation metho… |
CVE-2019-1003075 | High | 8.8 | 2019-04-04 | Jenkins Audit to Database Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with a… |
CVE-2019-1003074 | High | 8.8 | 2019-04-04 | Jenkins Hyper.sh Commons Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with ac… |
CVE-2019-1003073 | High | 8.8 | 2019-04-04 | Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by… |
CVE-2019-1003072 | High | 8.8 | 2019-04-04 | Jenkins WildFly Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Re… |