2019 CVEs (page 145)
Page 145 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1570 | Medium | 4.8 | 2019-03-26 | The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the LDAP server settings. |
CVE-2019-1569 | Medium | 4.8 | 2019-03-26 | The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping Settings for accoun… |
CVE-2019-10107 | Medium | 5.4 | 2019-03-26 | CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section. |
CVE-2019-10106 | Medium | 5.4 | 2019-03-26 | CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News mod… |
CVE-2019-10105 | Medium | 5.4 | 2019-03-26 | CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Template" action to the… |
CVE-2019-9744 | High | 8.8 | 2019-03-26 | An issue was discovered on PHOENIX CONTACT FL NAT SMCS 8TX, FL NAT SMN 8TX, FL NAT SMN 8TX-M, and FL NAT SMN 8TX-M-DMG devices. There is unauthorized access to… |
CVE-2019-9743 | High | 8.8 | 2019-03-26 | An issue was discovered on PHOENIX CONTACT RAD-80211-XD and RAD-80211-XD/HP-BUS devices. Command injection can occur in the WebHMI component. |
CVE-2019-9961 | Medium | 6.1 | 2019-03-26 | A cross-site scripting (XSS) vulnerability in ressource view in core/modules/resource/RESOURCEVIEW.php in Wikindx prior to version 5.7.0 allows remote attacker… |
CVE-2019-8989 | Medium | 4.3 | 2019-03-26 | The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a vulnerability that theoretical… |
CVE-2019-8988 | High | 8.1 | 2019-03-26 | The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a persistent cross-site contains… |
CVE-2019-8987 | Medium | 5.4 | 2019-03-26 | The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a persistent cross-site scriptin… |
CVE-2019-6540 | Medium | 6.5 | 2019-03-26 | The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer… |
CVE-2019-6341 | Medium | 5.4 | 2019-03-26 | In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsys… |
CVE-2019-3878 | High | 8.1 | 2019-03-26 | A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through a… |
CVE-2019-3852 | Medium | 4.3 | 2019-03-26 | A vulnerability was found in moodle before version 3.6.3. The get_with_capability_join and get_users_by_capability functions were not taking context freezing i… |
CVE-2019-3851 | Medium | 4.3 | 2019-03-26 | A vulnerability was found in moodle before versions 3.6.3 and 3.5.5. There was a link to site home within the the Boost theme's secure layout, meaning students… |
CVE-2019-3850 | Medium | 4.3 | 2019-03-26 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the sam… |
CVE-2019-3849 | High | 8.8 | 2019-03-26 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed… |
CVE-2019-3848 | Medium | 4.3 | 2019-03-26 | A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the ca… |
CVE-2019-3830 | High | 7.8 | 2019-03-26 | A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log file… |
CVE-2019-3826 | Medium | 6.1 | 2019-03-26 | A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticate… |
CVE-2019-3804 | High | 7.5 | 2019-03-26 | It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated at… |
CVE-2019-3606 | High | 7.7 | 2019-03-26 | Data Leakage Attacks vulnerability in the web portal component when in an MDR pair in McAfee Network Security Management (NSM) 9.1 < 9.1.7.75 (Update 4) and 9… |
CVE-2019-3597 | Medium | 6.5 | 2019-03-26 | Authentication Bypass vulnerability in McAfee Network Security Manager (NSM) 9.1 < 9.1.7.75.2 and 9.2 < 9.2.7.31 (9.2 Update 2) allows unauthenticated users to… |
CVE-2019-10068 | Critical | 9.8 | 2019-03-26 | An issue was discovered in Kentico 12.0.x before 12.0.15, 11.0.x before 11.0.48, 10.0.x before 10.0.52, and 9.x versions. Due to a failure to validate security… |
CVE-2019-9061 | High | 8.8 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize ca… |
CVE-2019-9059 | High | 7.2 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-ma… |
CVE-2019-9058 | High | 7.2 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups… |
CVE-2019-9057 | High | 8.8 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achiev… |
CVE-2019-9055 | High | 8.8 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with… |
CVE-2019-9053 | High | 8.1 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL i… |
CVE-2019-7646 | Medium | 4.8 | 2019-03-26 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.763 is vulnerable to Stored/Persistent XSS for the "Package Name" field via the add_package module… |
CVE-2019-9764 | High | 7.4 | 2019-03-26 | HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostnam… |
CVE-2019-10063 | Critical | 9.0 | 2019-03-26 | Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using… |
CVE-2019-8981 | Critical | 9.8 | 2019-03-26 | tls1.c in Cameron Hamilton-Rich axTLS before 2.1.5 has a Buffer Overflow via a crafted sequence of TLS packets because the need_bytes value is mismanaged. |
CVE-2019-7715 | High | 7.5 | 2019-03-26 | An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The main shell handler function uses the value of the en… |
CVE-2019-7714 | Critical | 9.8 | 2019-03-26 | An issue was discovered in Interpeak IPWEBS on Green Hills INTEGRITY RTOS 5.0.4. It allocates 60 bytes for the HTTP Authentication header. However, when copyin… |
CVE-2019-7713 | Critical | 9.8 | 2019-03-26 | An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. There is a heap-based buffer overflow in the function re… |
CVE-2019-7712 | High | 7.5 | 2019-03-26 | An issue was discovered in handler_ipcom_shell_pwd in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. When using the pwd command, t… |
CVE-2019-7711 | High | 7.5 | 2019-03-26 | An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The undocumented shell command "prompt" sets the (user c… |
CVE-2019-10061 | Critical | 9.8 | 2019-03-26 | utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowi… |
CVE-2019-10060 | High | 8.1 | 2019-03-26 | The Verix Multi-app Conductor application 2.7 for Verifone Verix suffers from a buffer overflow vulnerability that allows attackers to execute arbitrary code v… |
CVE-2019-7642 | High | 7.5 | 2019-03-25 | D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can remotely obtain users' DNS query logs and… |
CVE-2019-6538 | Critical | 9.3 | 2019-03-25 | The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer… |
CVE-2019-0204 | High | 7.8 | 2019-03-25 | A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Ap… |
CVE-2019-10044 | High | 8.8 | 2019-03-25 | Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying… |
CVE-2019-7613 | High | 7.5 | 2019-03-25 | Winlogbeat versions before 5.6.16 and 6.6.2 had an insufficient logging flaw. An attacker able to inject certain characters into a log entry could prevent Winl… |
CVE-2019-7612 | Critical | 9.8 | 2019-03-25 | A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of… |
CVE-2019-7611 | High | 8.1 | 2019-03-25 | A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _alia… |
CVE-2019-7610 | Critical | 9.0 | 2019-03-25 | Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.e… |
CVE-2019-7609 | Critical | 10.0 | 2019-03-25 | Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion applicatio… |
CVE-2019-7608 | Medium | 6.1 | 2019-03-25 | Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or per… |
CVE-2019-4046 | High | 7.5 | 2019-03-25 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by improper handling of request headers. A remote attacker… |
CVE-2019-3879 | High | 8.1 | 2019-03-25 | It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation… |
CVE-2019-3874 | Medium | 6.5 | 2019-03-25 | The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a denial of service at… |
CVE-2019-3861 | Medium | 5.0 | 2019-03-25 | An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed… |
CVE-2019-3860 | Medium | 5.0 | 2019-03-25 | An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a S… |
CVE-2019-3857 | High | 8.8 | 2019-03-25 | An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an e… |
CVE-2019-3856 | High | 8.8 | 2019-03-25 | An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A… |
CVE-2019-3838 | Medium | 5.5 | 2019-03-25 | It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could… |
CVE-2019-3835 | Medium | 5.5 | 2019-03-25 | It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use thi… |
CVE-2019-3396 | Critical | 9.8 | 2019-03-25 | The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed vers… |
CVE-2019-3395 | Critical | 9.8 | 2019-03-25 | The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fix… |
CVE-2019-10042 | High | 7.5 | 2019-03-25 | The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an… |
CVE-2019-10041 | Critical | 9.8 | 2019-03-25 | The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an… |
CVE-2019-10040 | Critical | 9.8 | 2019-03-25 | The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use a h… |
CVE-2019-10039 | Critical | 9.8 | 2019-03-25 | The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_login.asp and use an… |
CVE-2019-10012 | High | 7.5 | 2019-03-25 | Jenzabar JICS (aka Internet Campus Solution) before 9 allows remote attackers to upload and execute arbitrary .aspx code by placing it in a ZIP archive and usi… |
CVE-2019-10011 | Critical | 9.8 | 2019-03-25 | ICS/StaticPages/AddTestUsers.aspx in Jenzabar JICS (aka Internet Campus Solution) before 2019-02-06 allows remote attackers to create an arbitrary number of ac… |
CVE-2019-3863 | High | 7.5 | 2019-03-25 | A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages… |
CVE-2019-3841 | High | 7.4 | 2019-03-25 | Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container… |
CVE-2019-3831 | Medium | 6.7 | 2019-03-25 | A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function exposed to the vdsm system user could b… |
CVE-2019-3827 | High | 7.0 | 2019-03-25 | An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users w… |
CVE-2019-3810 | Medium | 6.1 | 2019-03-25 | A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape… |
CVE-2019-3809 | Medium | 6.5 | 2019-03-25 | A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it sho… |
CVE-2019-3808 | Medium | 5.4 | 2019-03-25 | A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability di… |
CVE-2019-6240 | High | 7.5 | 2019-03-25 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4. It allows Directory Traversal. |
CVE-2019-3484 | High | 7.8 | 2019-03-25 | Mitigates a remote code execution issue in ArcSight Logger versions prior to 6.7. |
CVE-2019-3483 | Medium | 6.5 | 2019-03-25 | Mitigates a potential information leakage issue in ArcSight Logger versions prior to 6.7. |
CVE-2019-3482 | Medium | 6.5 | 2019-03-25 | Mitigates a directory traversal issue in ArcSight Logger versions prior to 6.7. |
CVE-2019-3481 | High | 7.1 | 2019-03-25 | Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7. |
CVE-2019-3480 | Medium | 6.1 | 2019-03-25 | Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7. |
CVE-2019-3479 | Critical | 9.8 | 2019-03-25 | Mitigates a potential remote code execution issue in ArcSight Logger versions prior to 6.7. |
CVE-2019-3476 | Critical | 9.8 | 2019-03-25 | Remote arbitrary code execution in Micro Focus Data Protector, version 10.03 this vulnerability could allow remote arbitrary code execution. |
CVE-2019-10016 | Medium | 6.1 | 2019-03-25 | GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter, as demonstrated by a snippet/search/?words= substring. |
CVE-2019-10027 | Medium | 4.8 | 2019-03-25 | PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen. |
CVE-2019-10026 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec in Function.cc for the psOpRoll case. |
CVE-2019-10025 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nBits. |
CVE-2019-10024 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for y Bresenham parameters. |
CVE-2019-10023 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for the psOpMod case. |
CVE-2019-10022 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is a NULL pointer dereference in the function Gfx::opSetExtGState in Gfx.cc. |
CVE-2019-10021 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nComps. |
CVE-2019-10020 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for x Bresenham parameters. |
CVE-2019-10019 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PSOutputDev::checkPageSlice at PSOutputDev.cc for nStripes. |
CVE-2019-10018 | Medium | 5.5 | 2019-03-25 | An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for the psOpIdiv case. |
CVE-2019-10017 | Medium | 5.4 | 2019-03-24 | CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" action to the File Picker. |
CVE-2019-10015 | High | 7.2 | 2019-03-24 | baigoStudio baigoSSO v3.0.1 allows remote attackers to execute arbitrary PHP code via the first form field of a configuration screen, because this code is writ… |
CVE-2019-10014 | Medium | 6.5 | 2019-03-24 | In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because th… |
CVE-2019-10010 | Medium | 6.1 | 2019-03-24 | Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using d… |
CVE-2019-9978 | Medium | 6.1 | 2019-03-24 | The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in t… |