2019 CVEs (page 144)
Page 144 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10262 | Critical | 9.8 | 2019-03-28 | A SQL Injection issue was discovered in BlueCMS 1.6. The variable $ad_id is spliced directly in uploads/admin/ad.php in the admin folder, and is not wrapped in… |
CVE-2019-0225 | High | 7.5 | 2019-03-28 | A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by… |
CVE-2019-0222 | High | 7.5 | 2019-03-28 | In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive. |
CVE-2019-0212 | High | 7.5 | 2019-03-28 | In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Reque… |
CVE-2019-6608 | Medium | 5.9 | 2019-03-28 | On BIG-IP 11.5.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, the snmpd daemon may leak memory on a multi-blade BIG-I… |
CVE-2019-6607 | Medium | 6.8 | 2019-03-28 | On BIG-IP ASM 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, there is a stored cross-site scripting vulnerability in an ASM… |
CVE-2019-6606 | Medium | 4.3 | 2019-03-28 | On BIG-IP 11.5.1-11.6.3.4, 12.1.0-12.1.3.7, 13.0.0-13.1.1.3, and 14.0.0-14.0.0.2, when processing certain SNMP requests with a request-id of 0, the snmpd proce… |
CVE-2019-6605 | High | 7.5 | 2019-03-28 | On BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, and 12.0.x, an undisclosed sequence of packets received by an SSL virtual server and processed by an associated Client… |
CVE-2019-6604 | Medium | 6.8 | 2019-03-28 | On BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3.6, 13.0.0-13.1.1.1, and 14.0.0-14.0.0.2, under certain conditions, hardware systems with a High-Speed Bri… |
CVE-2019-6603 | High | 7.5 | 2019-03-28 | In BIG-IP 11.5.1-11.5.8, 11.6.1-11.6.3, 12.1.0-12.1.3, and 13.0.0-13.0.1, malformed TCP packets sent to a self IP address or a FastL4 virtual server may cause… |
CVE-2019-6602 | High | 7.5 | 2019-03-28 | In BIG-IP 11.5.1-11.5.8 and 11.6.1-11.6.3, the Configuration Utility login page may not follow best security practices when handling a malicious request. |
CVE-2019-0224 | Medium | 6.1 | 2019-03-28 | In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server o… |
CVE-2019-9167 | Medium | 6.1 | 2019-03-28 | Cross-site scripting (XSS) vulnerability in Nagios XI before 5.5.11 allows attackers to inject arbitrary web script or HTML via the xiwindow parameter. |
CVE-2019-9166 | High | 7.8 | 2019-03-28 | Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and import_xiconfig.php. |
CVE-2019-9204 | Critical | 9.8 | 2019-03-28 | SQL injection vulnerability in Nagios IM (component of Nagios XI) before 2.2.7 allows attackers to execute arbitrary SQL commands. |
CVE-2019-9203 | Critical | 9.8 | 2019-03-28 | Authorization bypass in Nagios IM (component of Nagios XI) before 2.2.7 allows closing incidents in IM via the API. |
CVE-2019-9202 | High | 8.8 | 2019-03-28 | Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues. |
CVE-2019-9165 | Critical | 9.8 | 2019-03-28 | SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys and malicious user id. |
CVE-2019-3710 | High | 8.1 | 2019-03-28 | Dell EMC Networking OS10 versions prior to 10.4.3 contain a cryptographic key vulnerability due to an underlying application using undocumented, pre-installed… |
CVE-2019-1003048 | High | 7.8 | 2019-03-28 | A vulnerability in Jenkins PRQA Plugin 3.1.0 and earlier allows attackers with local file system access to the Jenkins home directory to obtain the unencrypted… |
CVE-2019-1003047 | Medium | 6.5 | 2019-03-28 | A missing permission check in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers with Overall/Read permission to initiate a connecti… |
CVE-2019-1003046 | Medium | 6.5 | 2019-03-28 | A cross-site request forgery vulnerability in Jenkins Fortify on Demand Uploader Plugin 3.0.10 and earlier allows attackers to initiate a connection to an atta… |
CVE-2019-1003045 | Medium | 6.5 | 2019-03-28 | A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system access to the Jenki… |
CVE-2019-1003044 | High | 7.1 | 2019-03-28 | A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-specified URL using… |
CVE-2019-1003043 | High | 7.5 | 2019-03-28 | A missing permission check in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers with Overall/Read permission to connect to an attacker-specif… |
CVE-2019-1003042 | Medium | 5.4 | 2019-03-28 | A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary J… |
CVE-2019-1003041 | Critical | 9.8 | 2019-03-28 | A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts. |
CVE-2019-1003040 | Critical | 9.8 | 2019-03-28 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts. |
CVE-2019-9164 | High | 8.8 | 2019-03-28 | Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job. |
CVE-2019-7251 | Medium | 6.5 | 2019-03-28 | An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 and earlier allows re… |
CVE-2019-5739 | High | 7.5 | 2019-03-28 | Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated serv… |
CVE-2019-5737 | High | 7.5 | 2019-03-28 | In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by est… |
CVE-2019-10260 | Medium | 6.1 | 2019-03-28 | Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format). |
CVE-2019-10255 | Medium | 6.1 | 2019-03-28 | An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted… |
CVE-2019-9864 | Medium | 6.5 | 2019-03-28 | PHP Scripts Mall Amazon Affiliate Store 2.1.6 allows Parameter Tampering of the payment amount. |
CVE-2019-5674 | High | 7.0 | 2019-03-28 | NVIDIA GeForce Experience before 3.18 contains a vulnerability when ShadowPlay or GameStream is enabled. When an attacker has access to the system and creates… |
CVE-2019-10254 | Medium | 6.1 | 2019-03-28 | In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability. |
CVE-2019-10251 | Medium | 5.9 | 2019-03-28 | The UCWeb UC Browser application through 2019-03-26 for Android uses HTTP to download certain modules associated with PDF and Microsoft Office files (related t… |
CVE-2019-7524 | High | 8.8 | 2019-03-28 | In Dovecot before 2.2.36.3 and 2.3.x before 2.3.5.1, a local attacker can cause a buffer overflow in the indexer-worker process, which can be used to elevate t… |
CVE-2019-6542 | High | 7.5 | 2019-03-28 | ENTTEC Datagate MK2, Storm 24, Pixelator all firmware versions prior to (70044,70050,70060)_update_05032019-482 allows an unauthenticated user to initiate a re… |
CVE-2019-3869 | High | 7.2 | 2019-03-28 | When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious use… |
CVE-2019-10250 | Medium | 5.9 | 2019-03-28 | UCWeb UC Browser 7.0.185.1002 on Windows uses HTTP for downloading certain PDF modules, which allows MITM attacks. |
CVE-2019-1762 | Medium | 4.4 | 2019-03-28 | A vulnerability in the Secure Storage feature of Cisco IOS and IOS XE Software could allow an authenticated, local attacker to access sensitive system informat… |
CVE-2019-1761 | Medium | 4.3 | 2019-03-28 | A vulnerability in the Hot Standby Router Protocol (HSRP) subsystem of Cisco IOS and IOS XE Software could allow an unauthenticated, adjacent attacker to recei… |
CVE-2019-1760 | Medium | 6.8 | 2019-03-28 | A vulnerability in Performance Routing Version 3 (PfRv3) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the affected device… |
CVE-2019-1759 | Medium | 5.3 | 2019-03-28 | A vulnerability in access control list (ACL) functionality of the Gigabit Ethernet Management interface of Cisco IOS XE Software could allow an unauthenticated… |
CVE-2019-1758 | Medium | 4.7 | 2019-03-28 | A vulnerability in 802.1x function of Cisco IOS Software on the Catalyst 6500 Series Switches could allow an unauthenticated, adjacent attacker to access the n… |
CVE-2019-1757 | Medium | 5.9 | 2019-03-28 | A vulnerability in the Cisco Smart Call Home feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized read… |
CVE-2019-1756 | High | 7.2 | 2019-03-28 | A vulnerability in Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands on the underlying Linux shell of an affected device… |
CVE-2019-1755 | Medium | 6.5 | 2019-03-28 | A vulnerability in the Web Services Management Agent (WSMA) function of Cisco IOS XE Software could allow an authenticated, remote attacker to execute arbitrar… |
CVE-2019-1754 | High | 8.8 | 2019-03-28 | A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privile… |
CVE-2019-1753 | High | 8.8 | 2019-03-28 | A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated but unprivileged (level 1), remote attacker to run privileged Cisco IOS com… |
CVE-2019-1752 | High | 7.5 | 2019-03-28 | A vulnerability in the ISDN functions of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to re… |
CVE-2019-1751 | High | 8.6 | 2019-03-28 | A vulnerability in the Network Address Translation 64 (NAT64) functions of Cisco IOS Software could allow an unauthenticated, remote attacker to cause either a… |
CVE-2019-1750 | High | 7.4 | 2019-03-28 | A vulnerability in the Easy Virtual Switching System (VSS) of Cisco IOS XE Software on Catalyst 4500 Series Switches could allow an unauthenticated, adjacent a… |
CVE-2019-1749 | High | 7.4 | 2019-03-28 | A vulnerability in the ingress traffic validation of Cisco IOS XE Software for Cisco Aggregation Services Router (ASR) 900 Route Switch Processor 3 (RSP3) coul… |
CVE-2019-1748 | High | 7.4 | 2019-03-28 | A vulnerability in the Cisco Network Plug-and-Play (PnP) agent of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker… |
CVE-2019-1747 | High | 8.6 | 2019-03-28 | A vulnerability in the implementation of the Short Message Service (SMS) handling functionality of Cisco IOS Software and Cisco IOS XE Software could allow an… |
CVE-2019-1746 | High | 7.4 | 2019-03-28 | A vulnerability in the Cluster Management Protocol (CMP) processing code in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjace… |
CVE-2019-1745 | High | 7.8 | 2019-03-28 | A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with elevated privileges… |
CVE-2019-1743 | High | 8.8 | 2019-03-28 | A vulnerability in the web UI framework of Cisco IOS XE Software could allow an authenticated, remote attacker to make unauthorized changes to the filesystem o… |
CVE-2019-1742 | Medium | 5.3 | 2019-03-28 | A vulnerability in the web UI of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access sensitive configuration information. The vulne… |
CVE-2019-1741 | High | 7.5 | 2019-03-28 | A vulnerability in the Cisco Encrypted Traffic Analytics (ETA) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a deni… |
CVE-2019-1740 | High | 8.6 | 2019-03-28 | A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, rem… |
CVE-2019-1739 | High | 7.5 | 2019-03-28 | A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, rem… |
CVE-2019-1738 | High | 7.5 | 2019-03-28 | A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, rem… |
CVE-2019-1737 | High | 8.6 | 2019-03-27 | A vulnerability in the processing of IP Service Level Agreement (SLA) packets by Cisco IOS Software and Cisco IOS XE software could allow an unauthenticated, r… |
CVE-2019-0161 | Medium | 5.5 | 2019-03-27 | Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access. |
CVE-2019-0160 | Critical | 9.8 | 2019-03-27 | Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network… |
CVE-2019-1010257 | Critical | 9.1 | 2019-03-27 | An Information Disclosure / Data Modification issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. A URL can be… |
CVE-2019-3829 | Medium | 5.3 | 2019-03-27 | A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any… |
CVE-2019-10238 | Medium | 6.1 | 2019-03-27 | Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter. |
CVE-2019-10237 | High | 8.8 | 2019-03-27 | S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related issue to CVE-2019-… |
CVE-2019-1000031 | High | 7.5 | 2019-03-27 | A disk space or quota exhaustion issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. Visiting PDF generation li… |
CVE-2019-10233 | High | 8.1 | 2019-03-27 | Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie. |
CVE-2019-10232 | Critical | 9.8 | 2019-03-27 | Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php. |
CVE-2019-10231 | Critical | 9.8 | 2019-03-27 | Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication. This occurs in Auth::checkPassword() (inc/auth.c… |
CVE-2019-6536 | High | 7.8 | 2019-03-27 | Opening a specially crafted LCDS LAquis SCADA before 4.3.1.71 ELS file may result in a write past the end of an allocated buffer, which may allow an attacker t… |
CVE-2019-9860 | High | 7.5 | 2019-03-27 | Due to unencrypted signal communication and predictability of rolling codes, an attacker can "desynchronize" an ABUS Secvest wireless remote control (FUBE50014… |
CVE-2019-9863 | Critical | 9.8 | 2019-03-27 | Due to the use of an insecure algorithm for rolling codes in the ABUS Secvest wireless alarm system FUAA50000 3.01.01 and its remote controls FUBE50014 and FUB… |
CVE-2019-9862 | Medium | 6.5 | 2019-03-27 | An issue was discovered on ABUS Secvest wireless alarm system FUAA50000 3.01.01 in conjunction with Secvest remote control FUBE50014 or FUBE50015. Because "enc… |
CVE-2019-5927 | High | 7.5 | 2019-03-27 | Directory traversal vulnerability in 'an' App for iOS Version 3.2.0 and earlier allows remote attackers to read arbitrary files via unspecified vectors. |
CVE-2019-5926 | Medium | 6.1 | 2019-03-27 | Cross-site scripting vulnerability in KinagaCMS versions prior to 6.5 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecif… |
CVE-2019-5420 | Critical | 9.8 | 2019-03-27 | A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development m… |
CVE-2019-5419 | High | 7.5 | 2019-03-27 | There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can c… |
CVE-2019-5418 | High | 7.5 | 2019-03-27 | There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause… |
CVE-2019-3877 | Medium | 5.8 | 2019-03-27 | A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming th… |
CVE-2019-3847 | Medium | 4.8 | 2019-03-27 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/ma… |
CVE-2019-3840 | Medium | 5.8 | 2019-03-27 | A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information through the QEMU agent. An attacker in… |
CVE-2019-3828 | Medium | 4.2 | 2019-03-27 | Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specifi… |
CVE-2019-3821 | High | 7.5 | 2019-03-27 | A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple con… |
CVE-2019-3817 | High | 7.5 | 2019-03-27 | A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application r… |
CVE-2019-3814 | High | 7.7 | 2019-03-27 | It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certifi… |
CVE-2019-9917 | Medium | 6.5 | 2019-03-27 | ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding. |
CVE-2019-10125 | Critical | 9.8 | 2019-03-27 | An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4. A file may be released by aio_poll_wake() if an expected event is triggere… |
CVE-2019-10118 | Medium | 6.1 | 2019-03-27 | Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API. |
CVE-2019-7167 | High | 7.5 | 2019-03-27 | Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability. A key-generation process, during evaluation of polynomials related… |
CVE-2019-1571 | Medium | 4.8 | 2019-03-26 | The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the RADIUS server settings. |
CVE-2019-6569 | Critical | 9.1 | 2019-03-26 | The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network. An attacker could… |
CVE-2019-1572 | High | 7.5 | 2019-03-26 | PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files. |