2019 CVEs (page 149)
Page 149 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1003038 | High | 7.8 | 2019-03-08 | An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins… |
CVE-2019-1003037 | Medium | 6.5 | 2019-03-08 | An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMCloud.java… |
CVE-2019-1003036 | Medium | 4.3 | 2019-03-08 | A data modification vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgent.java tha… |
CVE-2019-1003035 | Medium | 4.3 | 2019-03-08 | An information exposure vulnerability exists in Jenkins Azure VM Agents Plugin 0.8.0 and earlier in src/main/java/com/microsoft/azure/vmagent/AzureVMAgentTempl… |
CVE-2019-1003034 | Critical | 9.9 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.g… |
CVE-2019-1003033 | High | 8.8 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptSource.java that all… |
CVE-2019-1003032 | Critical | 9.9 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublish… |
CVE-2019-1003031 | Critical | 9.9 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows a… |
CVE-2019-1003030 | Critical | 9.9 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroov… |
CVE-2019-1003029 | Critical | 9.9 | 2019-03-08 | A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/G… |
CVE-2019-5015 | High | 7.8 | 2019-03-08 | A local privilege escalation vulnerability exists in the Mac OS X version of Pixar Renderman 22.3.0's Install Helper helper tool. A user with local access can… |
CVE-2019-1609 | Medium | 6.7 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1608 | Medium | 6.7 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1607 | Medium | 6.7 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1606 | High | 7.8 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating syste… |
CVE-2019-1605 | High | 7.8 | 2019-03-08 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary code as root. The vulnerability… |
CVE-2019-9627 | High | 7.0 | 2019-03-08 | A buffer overflow in the kernel driver CybKernelTracker.sys in CyberArk Endpoint Privilege Manager versions prior to 10.7 allows an attacker (without Administr… |
CVE-2019-1604 | High | 7.8 | 2019-03-08 | A vulnerability in the user account management interface of Cisco NX-OS Software could allow an authenticated, local attacker to gain elevated privileges on an… |
CVE-2019-1603 | High | 7.8 | 2019-03-08 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to escalate lower-level privileges to the administrator level… |
CVE-2019-1602 | High | 7.8 | 2019-03-08 | A vulnerability in the filesystem permissions of Cisco NX-OS Software could allow an authenticated, local attacker to access sensitive data that could be used… |
CVE-2019-1601 | High | 7.8 | 2019-03-08 | A vulnerability in the filesystem permissions of Cisco NX-OS Software could allow an authenticated, local attacker to gain read and write access to a critical… |
CVE-2019-3780 | High | 8.8 | 2019-03-08 | Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user… |
CVE-2019-3779 | High | 8.8 | 2019-03-08 | Cloud Foundry Container Runtime, versions prior to 0.29.0, deploys Kubernetes clusters utilize the same CA (Certificate Authority) to sign and trust certs for… |
CVE-2019-9634 | High | 7.8 | 2019-03-08 | Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. |
CVE-2019-9633 | Medium | 6.5 | 2019-03-08 | gio/gsocketclient.c in GNOME GLib 2.59.2 does not ensure that a parent GTask remains alive during the execution of a connection-attempting enumeration, which a… |
CVE-2019-9632 | High | 7.5 | 2019-03-08 | ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishan… |
CVE-2019-9631 | Critical | 9.8 | 2019-03-08 | Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function. |
CVE-2019-9598 | Medium | 6.5 | 2019-03-07 | An issue was discovered in Cscms 4.1.0. There is an admin.php/pay CSRF vulnerability that can change the payment account to redirect funds. |
CVE-2019-9185 | High | 8.8 | 2019-03-07 | Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously u… |
CVE-2019-9121 | Critical | 9.8 | 2019-03-07 | An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to… |
CVE-2019-9120 | Critical | 9.8 | 2019-03-07 | An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to… |
CVE-2019-9119 | Critical | 9.8 | 2019-03-07 | An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to… |
CVE-2019-9118 | Critical | 9.8 | 2019-03-07 | An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to… |
CVE-2019-9117 | Critical | 9.8 | 2019-03-07 | An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to… |
CVE-2019-8440 | Medium | 4.8 | 2019-03-07 | An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox (aka site logo) of "System setting->site setting" of admin/i… |
CVE-2019-8439 | Medium | 5.4 | 2019-03-07 | An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the second textbox of "System setting->site setting" of admin/index.php, aka s… |
CVE-2019-8438 | Medium | 4.8 | 2019-03-07 | An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the first textbox of "System setting->site setting" of admin/index.php, aka si… |
CVE-2019-8437 | High | 8.8 | 2019-03-07 | njiandan-cms through 2013-05-23 has index.php/admin/user_new CSRF to add an administrator. |
CVE-2019-7661 | Medium | 6.1 | 2019-03-07 | An issue was discovered in PHPMyWind 5.5. The method parameter of the data/api/oauth/connect.php page has a reflected Cross-site Scripting (XSS) vulnerability. |
CVE-2019-7660 | Medium | 6.1 | 2019-03-07 | An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site Scripting (XSS) vulnerability, as demon… |
CVE-2019-7175 | High | 7.5 | 2019-03-07 | In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. |
CVE-2019-6710 | High | 8.8 | 2019-03-07 | Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CSRF. |
CVE-2019-8986 | High | 7.7 | 2019-03-07 | The SOAP API component vulnerability of TIBCO Software Inc.'s TIBCO JasperReports Server, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulner… |
CVE-2019-0192 | Critical | 9.8 | 2019-03-07 | In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a mali… |
CVE-2019-5019 | Critical | 9.8 | 2019-03-07 | A heap-based overflow vulnerability exists in the PowerPoint document conversion function of Rainbow PDF Office Server Document Converter V7.0 Pro R1 (7,0,2018… |
CVE-2019-1600 | Medium | 4.4 | 2019-03-07 | A vulnerability in the file system permissions of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to access sensitive… |
CVE-2019-1599 | High | 8.6 | 2019-03-07 | A vulnerability in the network stack of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on th… |
CVE-2019-1598 | High | 8.6 | 2019-03-07 | Multiple vulnerabilities in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco FXOS Software and Cisco NX-OS Software coul… |
CVE-2019-1597 | High | 8.6 | 2019-03-07 | Multiple vulnerabilities in the implementation of the Lightweight Directory Access Protocol (LDAP) feature in Cisco FXOS Software and Cisco NX-OS Software coul… |
CVE-2019-1596 | High | 7.8 | 2019-03-07 | A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to escalate their privilege level to roo… |
CVE-2019-3784 | High | 8.2 | 2019-03-07 | Cloud Foundry Stratos, versions prior to 2.3.0, contains an insecure session that can be spoofed. When deployed on cloud foundry with multiple instances using… |
CVE-2019-3783 | High | 8.8 | 2019-03-07 | Cloud Foundry Stratos, versions prior to 2.3.0, deploys with a public default session store secret. A malicious user with default session store secret can brut… |
CVE-2019-3781 | High | 8.8 | 2019-03-07 | Cloud Foundry CLI, versions prior to v6.43.0, improperly exposes passwords when verbose/trace/debugging is turned on. A local unauthenticated or remote authent… |
CVE-2019-3778 | Medium | 6.5 | 2019-03-07 | Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions cou… |
CVE-2019-3777 | High | 8.0 | 2019-03-07 | Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud contro… |
CVE-2019-3776 | High | 7.2 | 2019-03-07 | Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, cont… |
CVE-2019-3775 | High | 7.1 | 2019-03-07 | Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by ch… |
CVE-2019-3712 | High | 8.2 | 2019-03-07 | Dell WES Wyse Device Agent versions prior to 14.1.2.9 and Dell Wyse ThinLinux HAgent versions prior to 5.4.55 00.10 contain a buffer overflow vulnerability. An… |
CVE-2019-9626 | Critical | 9.8 | 2019-03-07 | PHPSHE 1.7 allows module/index/cart.php pintuan_id SQL Injection to index.php. |
CVE-2019-9625 | High | 8.8 | 2019-03-07 | JBMC DirectAdmin 1.55 allows CSRF via the /CMD_ACCOUNT_ADMIN URI to create a new admin account. |
CVE-2019-9624 | High | 7.8 | 2019-03-07 | Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted… |
CVE-2019-9623 | Critical | 9.8 | 2019-03-07 | Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via "<!--#exec cmd=" in a .shtml file to ck_upload_handler.php. |
CVE-2019-9622 | Medium | 4.3 | 2019-03-07 | eBrigade through 4.5 allows Arbitrary File Download via ../ directory traversal in the showfile.php file parameter, as demonstrated by reading the user-data/sa… |
CVE-2019-9617 | High | 8.8 | 2019-03-06 | An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for exam… |
CVE-2019-9616 | High | 7.2 | 2019-03-06 | An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for exam… |
CVE-2019-9615 | High | 7.2 | 2019-03-06 | An issue was discovered in OFCMS before 1.1.3. It allows admin/system/generate/create?sql= SQL injection, related to SystemGenerateController.java. |
CVE-2019-9614 | High | 8.8 | 2019-03-06 | An issue was discovered in OFCMS before 1.1.3. A command execution vulnerability exists via a template file with '<#assign ex="freemarker.template.utility.Exec… |
CVE-2019-9613 | High | 7.2 | 2019-03-06 | An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for exam… |
CVE-2019-9612 | High | 8.8 | 2019-03-06 | An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for exam… |
CVE-2019-9611 | Medium | 6.5 | 2019-03-06 | An issue was discovered in OFCMS before 1.1.3. It allows admin/cms/template/getTemplates.html?res_path=res directory traversal, with ../ in the dir parameter… |
CVE-2019-9610 | Medium | 4.3 | 2019-03-06 | An issue was discovered in OFCMS before 1.1.3. It has admin/cms/template/getTemplates.html?res_path=res&up_dir=../ directory traversal, related to the getTempl… |
CVE-2019-9609 | High | 8.8 | 2019-03-06 | An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for exam… |
CVE-2019-9608 | High | 8.8 | 2019-03-06 | An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for exam… |
CVE-2019-9607 | Medium | 5.3 | 2019-03-06 | PHP Scripts Mall Medical Store Script 3.0.3 allows Path Traversal by navigating to the parent directory of a jpg or png file. |
CVE-2019-9606 | Medium | 5.4 | 2019-03-06 | PHP Scripts Mall Personal Video Collection Script 4.0.4 has Stored XSS via the "Update profile" feature. |
CVE-2019-1595 | High | 7.4 | 2019-03-06 | A vulnerability in the Fibre Channel over Ethernet (FCoE) protocol implementation in Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to… |
CVE-2019-1594 | High | 7.4 | 2019-03-06 | A vulnerability in the 802.1X implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) cond… |
CVE-2019-1593 | High | 7.8 | 2019-03-06 | A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to escalate their privilege level by exe… |
CVE-2019-1591 | High | 7.8 | 2019-03-06 | A vulnerability in a specific CLI command implementation of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker to es… |
CVE-2019-1588 | Medium | 4.4 | 2019-03-06 | A vulnerability in the Cisco Nexus 9000 Series Fabric Switches running in Application-Centric Infrastructure (ACI) mode could allow an authenticated, local att… |
CVE-2019-1585 | Medium | 6.7 | 2019-03-06 | A vulnerability in the controller authorization functionality of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker… |
CVE-2019-1543 | High | 7.4 | 2019-03-06 | ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 9… |
CVE-2019-4030 | Medium | 5.4 | 2019-03-06 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W… |
CVE-2019-9603 | Medium | 6.5 | 2019-03-06 | MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891. |
CVE-2019-9601 | High | 7.5 | 2019-03-06 | The ApowerManager application through 3.1.7 for Android allows remote attackers to cause a denial of service via many simultaneous /?Key=PhoneRequestAuthorizat… |
CVE-2019-9600 | High | 7.5 | 2019-03-06 | The Olive Tree FTP Server (aka com.theolivetree.ftpserver) application through 1.32 for Android allows remote attackers to cause a denial of service via a clie… |
CVE-2019-9599 | High | 7.5 | 2019-03-06 | The AirDroid application through 4.2.1.6 for Android allows remote attackers to cause a denial of service (service crash) via many simultaneous sdctl/comm/lite… |
CVE-2019-0200 | High | 7.5 | 2019-03-06 | A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to cras… |
CVE-2019-0187 | Critical | 9.8 | 2019-03-06 | Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-se… |
CVE-2019-9595 | Medium | 6.1 | 2019-03-06 | AppCMS 2.0.101 allows XSS via the upload/callback.php params parameter. |
CVE-2019-9594 | Critical | 9.8 | 2019-03-06 | BlueCMS 1.6 allows SQL Injection via the user_id parameter in an uploads/admin/user.php?act=edit request. |
CVE-2019-9593 | Medium | 6.1 | 2019-03-06 | A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2019-9592 | Medium | 6.1 | 2019-03-06 | A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2019-9591 | Medium | 6.1 | 2019-03-06 | A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attackers to inject arbitrary web script or H… |
CVE-2019-9590 | High | 7.5 | 2019-03-06 | An issue was discovered on TENGCONTROL T-920 PLC v5.5 devices. It allows remote attackers to cause a denial of service (persistent failure mode) by sending a s… |
CVE-2019-3824 | Medium | 6.5 | 2019-03-06 | A flaw was found in the way an LDAP search expression could crash the shared LDAP server process of a samba AD DC in samba before version 4.10. An authenticate… |
CVE-2019-9589 | High | 7.8 | 2019-03-06 | There is a NULL pointer dereference vulnerability in PSOutputDev::setupResources() located in PSOutputDev.cc in Xpdf 4.01. It can be triggered by sending a cra… |
CVE-2019-9588 | High | 7.8 | 2019-03-06 | There is an Invalid memory access in gAtomicIncrement() located at GMutex.h in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) th… |
CVE-2019-9587 | High | 7.8 | 2019-03-06 | There is a stack consumption issue in md5Round1() located in Decrypt.cc in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pd… |
CVE-2019-9581 | High | 8.8 | 2019-03-06 | phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favicon.php PHP code, bec… |