2019 CVEs (page 148)
Page 148 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-3711 | Medium | 5.8 | 2019-03-13 | RSA Authentication Manager versions prior to 8.4 P1 contain an Insecure Credential Management Vulnerability. A malicious Operations Console administrator may b… |
CVE-2019-1723 | Critical | 9.8 | 2019-03-13 | A vulnerability in the Cisco Common Services Platform Collector (CSPC) could allow an unauthenticated, remote attacker to access an affected device by using an… |
CVE-2019-9750 | Critical | 9.1 | 2019-03-13 | In IoTivity through 1.3.1, the CoAP server interface can be used for Distributed Denial of Service attacks using source IP address spoofing and UDP-based traff… |
CVE-2019-9749 | High | 7.5 | 2019-03-13 | An issue was discovered in the MQTT input plugin in Fluent Bit through 1.0.4. When this plugin acts as an MQTT broker (server), it mishandles incoming network… |
CVE-2019-9748 | Critical | 9.1 | 2019-03-13 | In tinysvcmdns through 2018-01-16, an mDNS server processing a crafted packet can perform arbitrary data read operations up to 16383 bytes from the start of th… |
CVE-2019-9747 | High | 7.5 | 2019-03-13 | In tinysvcmdns through 2018-01-16, a maliciously crafted mDNS (Multicast DNS) packet triggers an infinite loop while parsing an mDNS query. When mDNS compresse… |
CVE-2019-9746 | High | 7.5 | 2019-03-13 | In libwebm before 2019-03-08, a NULL pointer dereference caused by the functions OutputCluster and OutputTracks in webm_info.cc will trigger an abort, which al… |
CVE-2019-9742 | High | 7.5 | 2019-03-13 | gdwfpcd.sys in G Data Total Security before 2019-02-22 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILE_DEVICE_SECURE_OP… |
CVE-2019-9741 | Medium | 6.1 | 2019-03-13 | An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument t… |
CVE-2019-9740 | Medium | 6.1 | 2019-03-13 | An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a u… |
CVE-2019-9738 | Medium | 6.1 | 2019-03-13 | jimmykuu Gopher 2.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring. |
CVE-2019-9737 | Medium | 6.1 | 2019-03-13 | Editor.md 1.5.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring. |
CVE-2019-9736 | Medium | 6.1 | 2019-03-13 | DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the '<EMBED SRC="data:image/svg+xml' substring. |
CVE-2019-9735 | Medium | 6.5 | 2019-03-13 | An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By… |
CVE-2019-9729 | High | 7.8 | 2019-03-12 | In Shanda MapleStory Online V160, the SdoKeyCrypt.sys driver allows privilege escalation to NT AUTHORITY\SYSTEM because of not validating the IOCtl 0x8000c01c… |
CVE-2019-5925 | Medium | 5.4 | 2019-03-12 | Cross-site scripting vulnerability in Dradis Community Edition Dradis Community Edition v3.11 and earlier and Dradis Professional Edition v3.1.1 and earlier al… |
CVE-2019-5924 | High | 8.8 | 2019-03-12 | Cross-site request forgery (CSRF) vulnerability in Smart Forms 2.6.15 and earlier allows remote attackers to hijack the authentication of administrators via a… |
CVE-2019-5923 | High | 7.5 | 2019-03-12 | Directory traversal vulnerability in iChain Insurance Wallet App for iOS Version 1.3.0 and earlier allows remote attackers to read arbitrary files via unspecif… |
CVE-2019-5922 | High | 7.8 | 2019-03-12 | Untrusted search path vulnerability in The installer of Microsoft Teams allows an attacker to gain privileges via a Trojan horse DLL in an unspecified director… |
CVE-2019-5921 | High | 7.8 | 2019-03-12 | Untrusted search path vulnerability in Windows 7 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. |
CVE-2019-5920 | High | 8.8 | 2019-03-12 | Cross-site request forgery (CSRF) vulnerability in FormCraft 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators via a spe… |
CVE-2019-5919 | Critical | 9.1 | 2019-03-12 | An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obtain information of t… |
CVE-2019-5918 | Critical | 9.1 | 2019-03-12 | Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors. |
CVE-2019-5917 | High | 7.5 | 2019-03-12 | azure-umqtt-c (available through GitHub prior to 2017 October 6) allows remote attackers to cause a denial of service via unspecified vectors. |
CVE-2019-0277 | Medium | 6.5 | 2019-03-12 | SAP HANA extended application services, version 1, advanced does not sufficiently validate an XML document accepted from an authenticated developer with privil… |
CVE-2019-0276 | High | 8.8 | 2019-03-12 | Banking services from SAP 9.0 (FSAPPL version 5) and SAP S/4HANA Financial Products Subledger (S4FPSL, version 1) performs an inadequate authorization check fo… |
CVE-2019-0275 | Medium | 5.4 | 2019-03-12 | SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS), versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50, does not sufficient… |
CVE-2019-0274 | High | 7.5 | 2019-03-12 | SAP Mobile Platform SDK allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service (i.e. denial of ser… |
CVE-2019-0271 | Medium | 6.5 | 2019-03-12 | ABAP Server (used in NetWeaver and Suite/ERP) and ABAP Platform does not sufficiently validate an XML document accepted from an untrusted source, leading to an… |
CVE-2019-0270 | High | 8.8 | 2019-03-12 | ABAP Server of SAP NetWeaver and ABAP Platform fail to perform necessary authorization checks for an authenticated user, resulting in escalation of privileges… |
CVE-2019-0269 | Medium | 5.4 | 2019-03-12 | SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.10 and 4.20, does not sufficiently encode user-controlled inputs, resulting in Cr… |
CVE-2019-0268 | High | 8.1 | 2019-03-12 | SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an… |
CVE-2019-3615 | Medium | 5.3 | 2019-03-12 | Data Leakage Attacks vulnerability in the web interface in McAfee Database Security prior to the 4.6.6 March 2019 update allows local users to expose passwords… |
CVE-2019-9725 | Medium | 6.1 | 2019-03-12 | The Web manager (aka Commander) on Korenix JetPort 5601 and 5601f devices has Persistent XSS via the Port Alias field under Serial Setting. |
CVE-2019-9558 | Medium | 6.1 | 2019-03-12 | Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting (XSS) via the body of an e-mail message. To exploit the vulnerability, the victim must… |
CVE-2019-9557 | Medium | 6.1 | 2019-03-12 | Ability Mail Server 4.2.6 has Persistent Cross Site Scripting (XSS) via the body e-mail body. To exploit the vulnerability, the victim must open an email with… |
CVE-2019-9714 | Medium | 6.1 | 2019-03-12 | An issue was discovered in Joomla! before 3.9.4. The media form field lacks escaping, leading to XSS. |
CVE-2019-9713 | High | 7.5 | 2019-03-12 | An issue was discovered in Joomla! before 3.9.4. The sample data plugins lack ACL checks, allowing unauthorized access. |
CVE-2019-9712 | Medium | 6.1 | 2019-03-12 | An issue was discovered in Joomla! before 3.9.4. The JSON handler in com_config lacks input validation, leading to XSS. |
CVE-2019-9711 | Medium | 6.1 | 2019-03-12 | An issue was discovered in Joomla! before 3.9.4. The item_title layout in edit views lacks escaping, leading to XSS. |
CVE-2019-9721 | Medium | 6.5 | 2019-03-12 | A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handle_o… |
CVE-2019-9718 | Medium | 6.5 | 2019-03-12 | In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ff_html… |
CVE-2019-9644 | Medium | 5.4 | 2019-03-12 | An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are au… |
CVE-2019-9710 | High | 8.1 | 2019-03-12 | An issue was discovered in webargs before 5.1.3, as used with marshmallow and other products. JSON parsing uses a short-lived cache to store the parsed JSON bo… |
CVE-2019-9706 | Medium | 5.5 | 2019-03-12 | Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of a force_rescan_use… |
CVE-2019-9705 | Medium | 5.5 | 2019-03-12 | Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (memory consumption) via a large crontab file because an unlimi… |
CVE-2019-9704 | Medium | 5.5 | 2019-03-12 | Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc retu… |
CVE-2019-4016 | High | 7.8 | 2019-03-11 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authentica… |
CVE-2019-4015 | High | 7.8 | 2019-03-11 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authentica… |
CVE-2019-1707 | Medium | 5.4 | 2019-03-11 | A vulnerability in the web-based management interface of Cisco DNA Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS)… |
CVE-2019-1702 | Medium | 6.1 | 2019-03-11 | Multiple vulnerabilities in the web-based management interface of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to conduct a… |
CVE-2019-1690 | Medium | 6.5 | 2019-03-11 | A vulnerability in the management interface of Cisco Application Policy Infrastructure Controller (APIC) software could allow an unauthenticated, adjacent atta… |
CVE-2019-1618 | High | 7.8 | 2019-03-11 | A vulnerability in the Tetration Analytics agent for Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker to… |
CVE-2019-1617 | High | 7.4 | 2019-03-11 | A vulnerability in the Fibre Channel over Ethernet (FCoE) N-port Virtualization (NPV) protocol implementation in Cisco NX-OS Software could allow an unauthenti… |
CVE-2019-1616 | High | 8.6 | 2019-03-11 | A vulnerability in the Cisco Fabric Services component of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a buffer overflow, resu… |
CVE-2019-1615 | Medium | 6.7 | 2019-03-11 | A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level crede… |
CVE-2019-1614 | High | 8.8 | 2019-03-11 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges… |
CVE-2019-1613 | Medium | 6.7 | 2019-03-11 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1612 | Medium | 4.2 | 2019-03-11 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1611 | Medium | 6.7 | 2019-03-11 | A vulnerability in the CLI of Cisco NX-OS Software and Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the un… |
CVE-2019-1610 | Medium | 6.7 | 2019-03-11 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-9693 | High | 8.8 | 2019-03-11 | In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter… |
CVE-2019-9692 | Medium | 6.5 | 2019-03-11 | class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, o… |
CVE-2019-9688 | High | 8.8 | 2019-03-11 | sftnow through 2018-12-29 allows index.php?g=Admin&m=User&a=add_post CSRF to add an admin account. |
CVE-2019-9687 | Critical | 9.8 | 2019-03-11 | PoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in base/PdfString.cpp. |
CVE-2019-9686 | High | 8.8 | 2019-03-11 | pacman before 5.1.3 allows directory traversal when installing a remote package via a specified URL "pacman -U <url>" due to an unsanitized file name received… |
CVE-2019-9659 | Critical | 9.1 | 2019-03-11 | The Chuango 433 MHz burglar-alarm product line uses static codes in the RF remote control, allowing an attacker to arm, disarm, or trigger the alarm remotely v… |
CVE-2019-9675 | High | 8.1 | 2019-03-11 | An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link valu… |
CVE-2019-9662 | High | 7.5 | 2019-03-11 | An issue was discovered in JTBC(PHP) 3.0.1.8. Its cache management module is flawed. An arbitrary file ending in "inc.php" can be deleted via a console/cache/m… |
CVE-2019-9661 | Medium | 4.8 | 2019-03-11 | Stored XSS exists in YzmCMS 5.2 via the admin/system_manage/user_config_edit.html "value" parameter, |
CVE-2019-9660 | Medium | 4.8 | 2019-03-11 | Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter. |
CVE-2019-9658 | Medium | 5.3 | 2019-03-11 | Checkstyle before 8.18 loads external DTDs by default. |
CVE-2019-9656 | High | 8.8 | 2019-03-11 | An issue was discovered in LibOFX 0.9.14. There is a NULL pointer dereference in the function OFXApplication::startElement in the file lib/ofx_sgml.cpp, as dem… |
CVE-2019-9652 | High | 8.8 | 2019-03-11 | There is a CSRF in SDCMS V1.7 via an m=admin&c=theme&a=edit request. It allows PHP code injection by providing a filename in the file parameter, and providing… |
CVE-2019-9651 | Critical | 9.8 | 2019-03-11 | An issue was discovered in SDCMS V1.7. In the \app\admin\controller\themecontroller.php file, the check_bad() function's filtering is not strict, resulting in… |
CVE-2019-9650 | Medium | 6.1 | 2019-03-11 | An XSS issue was discovered in upcoming_events.php in the Upcoming Events plugin before 1.33 for MyBB via a crafted name for an event. |
CVE-2019-9646 | Medium | 6.1 | 2019-03-10 | The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition ar… |
CVE-2019-9580 | Medium | 6.1 | 2019-03-09 | In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3, it is possible to bypass the CORS protection mechanism via a "null" origin value, potenti… |
CVE-2019-9641 | Critical | 9.8 | 2019-03-09 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process… |
CVE-2019-9640 | High | 7.5 | 2019-03-09 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in exif_process_SOFn. |
CVE-2019-9639 | High | 7.5 | 2019-03-09 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process… |
CVE-2019-9638 | High | 7.5 | 2019-03-09 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process… |
CVE-2019-9637 | High | 7.5 | 2019-03-09 | An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is pos… |
CVE-2019-8280 | Critical | 9.8 | 2019-03-08 | UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside RAW decoder, which can potentially result code execution. This attack appear… |
CVE-2019-8277 | High | 7.5 | 2019-03-08 | UltraVNC revision 1211 contains multiple memory leaks (CWE-665) in VNC server code, which allows an attacker to read stack memory and can be abused for informa… |
CVE-2019-8276 | High | 7.5 | 2019-03-08 | UltraVNC revision 1211 has a stack buffer overflow vulnerability in VNC server code inside file transfer request handler, which can result in Denial of Service… |
CVE-2019-8275 | Critical | 9.8 | 2019-03-08 | UltraVNC revision 1211 has multiple improper null termination vulnerabilities in VNC server code, which result in out-of-bound data being accessed by remote us… |
CVE-2019-8274 | Critical | 9.8 | 2019-03-08 | UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, which can potentially in result code exe… |
CVE-2019-8273 | Critical | 9.8 | 2019-03-08 | UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer request handler, which can potentially result in code e… |
CVE-2019-8272 | Critical | 9.8 | 2019-03-08 | UltraVNC revision 1211 has multiple off-by-one vulnerabilities in VNC server code, which can potentially result in code execution. This attack appears to be ex… |
CVE-2019-8271 | Critical | 9.8 | 2019-03-08 | UltraVNC revision 1211 has a heap buffer overflow vulnerability in VNC server code inside file transfer handler, which can potentially result code execution. T… |
CVE-2019-8270 | High | 7.5 | 2019-03-08 | UltraVNC revision 1210 has out-of-bounds read vulnerability in VNC client code inside Ultra decoder, which results in a denial of service (DoS) condition. This… |
CVE-2019-8269 | High | 7.5 | 2019-03-08 | UltraVNC revision 1206 has stack-based Buffer overflow vulnerability in VNC client code inside FileTransfer module, which leads to a denial of service (DoS) co… |
CVE-2019-8268 | Critical | 9.8 | 2019-03-08 | UltraVNC revision 1206 has multiple off-by-one vulnerabilities in VNC client code connected with improper usage of ClientConnection::ReadString function, which… |
CVE-2019-8267 | High | 7.5 | 2019-03-08 | UltraVNC revision 1207 has out-of-bounds read vulnerability in VNC client code inside TextChat module, which results in a denial of service (DoS) condition. Th… |
CVE-2019-8266 | Critical | 9.8 | 2019-03-08 | UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnection::Copybuffer function in VNC client c… |
CVE-2019-8265 | Critical | 9.8 | 2019-03-08 | UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of SETPIXELS macro in VNC client code, which can potenti… |
CVE-2019-8264 | Critical | 9.8 | 2019-03-08 | UltraVNC revision 1203 has out-of-bounds access vulnerability in VNC client inside Ultra2 decoder, which can potentially result in code execution. This attack… |
CVE-2019-9636 | Critical | 9.8 | 2019-03-08 | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. T… |
CVE-2019-1003039 | High | 8.8 | 2019-03-08 | An insufficiently protected credentials vulnerability exists in JenkinsAppDynamics Dashboard Plugin 1.0.14 and earlier in src/main/java/nl/codecentric/jenkins/… |