2019 CVEs (page 146)
Page 146 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-9977 | High | 8.8 | 2019-03-24 | The renderer process in the entertainment system on Tesla Model 3 vehicles mishandles JIT compilation, which allows attackers to trigger firmware code executio… |
CVE-2019-9970 | Medium | 6.5 | 2019-03-24 | Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homogr… |
CVE-2019-9969 | High | 7.8 | 2019-03-24 | XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted… |
CVE-2019-9968 | High | 7.8 | 2019-03-24 | XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted… |
CVE-2019-9967 | High | 7.8 | 2019-03-24 | XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted… |
CVE-2019-9966 | High | 7.8 | 2019-03-24 | XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted… |
CVE-2019-9965 | High | 7.8 | 2019-03-24 | XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted fi… |
CVE-2019-9964 | High | 7.8 | 2019-03-24 | XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted fi… |
CVE-2019-9963 | High | 7.8 | 2019-03-24 | XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted fi… |
CVE-2019-9962 | High | 7.8 | 2019-03-24 | XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted fi… |
CVE-2019-9960 | Critical | 9.8 | 2019-03-24 | The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path. |
CVE-2019-9956 | High | 8.8 | 2019-03-24 | In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which allows an attacker to cause a denial of s… |
CVE-2019-9948 | Critical | 9.1 | 2019-03-23 | urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist… |
CVE-2019-9947 | Medium | 6.1 | 2019-03-23 | An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a u… |
CVE-2019-9945 | Critical | 9.8 | 2019-03-23 | SoftNAS Cloud 4.2.0 and 4.2.1 allows remote command execution. The NGINX default configuration file has a check to verify the status of a user cookie. If not s… |
CVE-2019-9942 | Low | 3.7 | 2019-03-23 | A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() m… |
CVE-2019-9649 | Medium | 5.3 | 2019-03-22 | An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal tec… |
CVE-2019-1766 | High | 7.5 | 2019-03-22 | A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticat… |
CVE-2019-1765 | High | 8.1 | 2019-03-22 | A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an authenticated… |
CVE-2019-1764 | High | 8.1 | 2019-03-22 | A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticat… |
CVE-2019-1763 | High | 7.5 | 2019-03-22 | A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticat… |
CVE-2019-1716 | High | 7.5 | 2019-03-22 | A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Seri… |
CVE-2019-9648 | Medium | 5.3 | 2019-03-22 | An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a… |
CVE-2019-4052 | High | 7.5 | 2019-03-22 | IBM API Connect 2018.1 and 2018.4.1.2 apis can be leveraged by unauthenticated users to discover login ids of registered users. IBM X-Force ID: 156544. |
CVE-2019-4035 | Medium | 5.4 | 2019-03-22 | IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. If attackers make a fake IBM Content Navigator site, they can send… |
CVE-2019-9939 | High | 8.8 | 2019-03-22 | The SHAREit application before 4.0.36 for Android allows a remote attacker (on the same network or joining public "open" Wi-Fi hotspots created by the applicat… |
CVE-2019-9938 | Medium | 5.3 | 2019-03-22 | The SHAREit application before 4.0.42 for Android allows a remote attacker (on the same network or joining public "open" Wi-Fi hotspots created by the applicat… |
CVE-2019-9937 | High | 7.5 | 2019-03-22 | In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate… |
CVE-2019-9936 | High | 7.5 | 2019-03-22 | In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lea… |
CVE-2019-9927 | Critical | 9.8 | 2019-03-22 | Caret before 2019-02-22 allows Remote Code Execution. |
CVE-2019-9925 | Medium | 6.1 | 2019-03-22 | S-CMS PHP v1.0 has XSS in 4.edu.php via the S_id parameter. |
CVE-2019-9924 | High | 7.8 | 2019-03-22 | rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of t… |
CVE-2019-9923 | High | 7.5 | 2019-03-22 | pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers. |
CVE-2019-9915 | Medium | 6.1 | 2019-03-22 | GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter. |
CVE-2019-9914 | Medium | 6.1 | 2019-03-22 | The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS. |
CVE-2019-9913 | Medium | 6.1 | 2019-03-22 | The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS. |
CVE-2019-9912 | Medium | 6.1 | 2019-03-22 | The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO. |
CVE-2019-9911 | Medium | 6.1 | 2019-03-22 | The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS. |
CVE-2019-9910 | Medium | 6.1 | 2019-03-22 | The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS. |
CVE-2019-9909 | Medium | 6.1 | 2019-03-22 | The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS. |
CVE-2019-9908 | Medium | 6.1 | 2019-03-22 | The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php manage_font_id XSS. |
CVE-2019-8351 | Critical | 9.1 | 2019-03-21 | Heimdal Thor Agent 2.5.17x before 2.5.173 does not verify X.509 certificates from TLS servers, which allows remote attackers to spoof servers and obtain sensit… |
CVE-2019-7539 | High | 8.8 | 2019-03-21 | A code injection issue was discovered in ipycache through 2016-05-31. |
CVE-2019-3871 | Medium | 6.5 | 2019-03-21 | A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the user when building… |
CVE-2019-3858 | Medium | 5.0 | 2019-03-21 | An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compr… |
CVE-2019-3855 | High | 8.8 | 2019-03-21 | An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remot… |
CVE-2019-7537 | Critical | 9.8 | 2019-03-21 | An issue was discovered in Donfig 0.3.0. There is a vulnerability in the collect_yaml method in config_obj.py. It can execute arbitrary Python commands, result… |
CVE-2019-5490 | Critical | 9.8 | 2019-03-21 | Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a default account enabled that could allow u… |
CVE-2019-9904 | Medium | 6.5 | 2019-03-21 | An issue was discovered in lib\cdt\dttree.c in libcdt.a in graphviz 2.40.1. Stack consumption occurs because of recursive agclose calls in lib\cgraph\graph.c i… |
CVE-2019-9903 | Medium | 6.5 | 2019-03-21 | PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which… |
CVE-2019-8997 | Medium | 5.9 | 2019-03-21 | An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an att… |
CVE-2019-7238 | Critical | 9.8 | 2019-03-21 | Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. |
CVE-2019-6491 | High | 8.8 | 2019-03-21 | RISI Gestao de Horarios v3201.09.08 rev.23 allows SQL Injection. |
CVE-2019-9898 | Critical | 9.8 | 2019-03-21 | Potential recycling of random numbers used in cryptography exists within PuTTY before 0.71. |
CVE-2019-9897 | High | 7.5 | 2019-03-21 | Multiple denial-of-service attacks that can be triggered by writing to the terminal exist in PuTTY versions before 0.71. |
CVE-2019-9896 | High | 7.8 | 2019-03-21 | In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same directory as the executable. |
CVE-2019-9895 | Critical | 9.8 | 2019-03-21 | In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding. |
CVE-2019-9894 | High | 7.5 | 2019-03-21 | A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification. |
CVE-2019-9893 | Critical | 9.8 | 2019-03-21 | libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lea… |
CVE-2019-9889 | Low | 2.7 | 2019-03-21 | In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a require call using a crafted type v… |
CVE-2019-9878 | High | 7.8 | 2019-03-21 | There is an invalid memory access in the function GfxIndexedColorSpace::mapColorToBase() located in GfxState.cc in Xpdf 4.0.0, as used in pdfalto 0.2. It can b… |
CVE-2019-9877 | High | 7.8 | 2019-03-21 | There is an invalid memory access vulnerability in the function TextPage::findGaps() located at TextOutputDev.c in Xpdf 4.01, which can (for example) be trigge… |
CVE-2019-9870 | Critical | 9.8 | 2019-03-21 | plugin.js in the w8tcha oEmbed plugin before 2019-03-14 for CKEditor mishandles SCRIPT elements. |
CVE-2019-9868 | High | 7.2 | 2019-03-21 | An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The SMTP password is displayed to an administrator. |
CVE-2019-9867 | High | 7.2 | 2019-03-21 | An issue was discovered in the Web Console in Veritas NetBackup Appliance through 3.1.2. The proxy server password is displayed to an administrator. |
CVE-2019-9857 | Medium | 5.5 | 2019-03-21 | In the Linux kernel through 5.0.2, the function inotify_update_existing_watch() in fs/notify/inotify/inotify_user.c neglects to call fsnotify_put_mark() with I… |
CVE-2019-9837 | Medium | 6.1 | 2019-03-21 | Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an… |
CVE-2019-9094 | Medium | 6.1 | 2019-03-21 | A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in /s/adada/cfiles/upload in Humhub 1.3.10 Community Edition. The user-supplied input conta… |
CVE-2019-9093 | Medium | 6.1 | 2019-03-21 | A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in file/file/upload in Humhub 1.3.10 Community Edition. The user-supplied input containing… |
CVE-2019-9083 | Critical | 9.8 | 2019-03-21 | SQLiteManager 1.20 and 1.24 allows SQL injection via the /sqlitemanager/main.php dbsel parameter. NOTE: This product is discontinued. |
CVE-2019-8938 | Medium | 6.1 | 2019-03-21 | VertrigoServ 2.17 allows XSS via the /inc/extensions.php ext parameter. |
CVE-2019-8934 | Low | 3.3 | 2019-03-21 | hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model syst… |
CVE-2019-7441 | Medium | 6.5 | 2019-03-21 | cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such… |
CVE-2019-7440 | Medium | 6.5 | 2019-03-21 | JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_Setting request to cgi-bin/qcmap_web_cgi… |
CVE-2019-7439 | Medium | 6.5 | 2019-03-21 | cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices allows a DoS (Hang) via the mask POST parameter. |
CVE-2019-7438 | Medium | 6.1 | 2019-03-21 | cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST parameter. |
CVE-2019-7437 | Medium | 6.1 | 2019-03-21 | PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected Cross-Site Scripting (XSS) via the Search field. |
CVE-2019-7436 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has directory traversal via a direct request for a listing of an uploads directory. |
CVE-2019-7435 | Medium | 5.3 | 2019-03-21 | PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected HTML injection via the Search Form. |
CVE-2019-7434 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Rental Bike Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory. |
CVE-2019-7433 | High | 8.8 | 2019-03-21 | PHP Scripts Mall Rental Bike Script 2.0.3 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature. |
CVE-2019-7432 | Medium | 5.4 | 2019-03-21 | PHP Scripts Mall Rental Bike Script 2.0.3 has HTML injection via the STREET field in the Profile Edit section. |
CVE-2019-7431 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Image Sharing Script 1.3.4 has directory traversal via a direct request for a listing of an uploads directory. |
CVE-2019-7430 | Medium | 5.3 | 2019-03-21 | PHP Scripts Mall Image Sharing Script 1.3.4 has HTML injection via the Search Bar. |
CVE-2019-7429 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Property Rental Software 2.1.4 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploa… |
CVE-2019-7425 | Medium | 6.1 | 2019-03-21 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the task par… |
CVE-2019-7424 | Medium | 6.1 | 2019-03-21 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index.jsp" file in the view GET parameter or… |
CVE-2019-7423 | Medium | 6.1 | 2019-03-21 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/editProfile.jsp" file in the userName paramet… |
CVE-2019-7422 | Medium | 6.1 | 2019-03-21 | XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/addMailSettings.jsp" file in the gF parameter. |
CVE-2019-7421 | Medium | 6.1 | 2019-03-21 | XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws.login/gnb/loginView.sws" in multiple parameters: contextpath and b… |
CVE-2019-7420 | Medium | 6.1 | 2019-03-21 | XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws.application/information/networkinformationView.sws" in the tabName… |
CVE-2019-7419 | Medium | 6.1 | 2019-03-21 | XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws/leftmenu.sws" in multiple parameters: ruiFw_id, ruiFw_pid, ruiFw_t… |
CVE-2019-7418 | Medium | 6.1 | 2019-03-21 | XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws/swsAlert.sws" in multiple parameters: flag, frame, func, and Nfunc. |
CVE-2019-7417 | Medium | 6.1 | 2019-03-21 | XSS exists in Ericsson Active Library Explorer (ALEX) 14.3 in multiple parameters in the "/cgi-bin/alexserv" servlet, as demonstrated by the DB, FN, fn, or id… |
CVE-2019-7416 | Medium | 6.1 | 2019-03-21 | XSS and/or a Client Side URL Redirect exists in OpenText Documentum Webtop 5.3 SP2. The parameter startat in "/webtop/help/en/default.htm" is vulnerable. |
CVE-2019-7391 | High | 8.8 | 2019-03-21 | ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF. |
CVE-2019-7386 | Medium | 6.5 | 2019-03-21 | A Denial of Service issue has been discovered in the Gecko component of KaiOS 2.5 10.05 (platform 48.0.a2) on Nokia 8810 4G devices. When a crafted web page is… |
CVE-2019-7385 | High | 7.8 | 2019-03-21 | An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware… |
CVE-2019-7384 | High | 7.8 | 2019-03-21 | An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware… |
CVE-2019-7383 | High | 7.8 | 2019-03-21 | An issue was discovered on Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W devices with firmware V1.1-R2.1_TRUNK-20181105.bin. A shell command injection occu… |