2019 CVEs (page 15)
Page 15 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-3617 | High | 7.5 | 2020-06-10 | Privilege escalation vulnerability in McAfee Total Protection (ToPS) for Mac OS prior to 4.6 allows local users to gain root privileges via incorrect protectio… |
CVE-2019-6196 | Medium | 6.7 | 2020-06-09 | A symbolic link vulnerability in some Lenovo installation packages, prior to version 1.2.9.3, could allow privileged file operations during file extraction and… |
CVE-2019-6173 | Medium | 6.7 | 2020-06-09 | A DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages, prior to version 1.2.9.3, during installation if an atta… |
CVE-2019-19412 | Medium | 4.6 | 2020-06-08 | Huawei smart phones have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protectio… |
CVE-2019-20837 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It allows signature validation bypass via a modified file or a file with non-standard signat… |
CVE-2019-20836 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It has mishandling of cloud credentials, as demonstrated by Google Drive. |
CVE-2019-20835 | Medium | 4.3 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It has homograph mishandling. |
CVE-2019-20834 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.10. It allows signature validation bypass via a modified file or a file with non-standard signatures. |
CVE-2019-20833 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.10. It has mishandling of cloud credentials, as demonstrated by Google Drive. |
CVE-2019-20832 | Medium | 4.3 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.10. It has homograph mishandling. |
CVE-2019-20831 | High | 7.5 | 2020-06-04 | An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.5.0.20733. It has void data mishandling, causing a crash. |
CVE-2019-20830 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has an out-of-bounds write when Internet Explorer is used. |
CVE-2019-20829 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has a NULL pointer dereference via FXSYS_wcslen in an Epub file. |
CVE-2019-20828 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has a buffer overflow because a looping correction does not occur after JavaScript update… |
CVE-2019-20827 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF Mac 3.3 and Foxit Reader for Mac before 3.3. It allows stack consumption because of interaction between ICC-Based c… |
CVE-2019-20826 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF Mac 3.3 and Foxit Reader for Mac before 3.3. It has a NULL pointer dereference. |
CVE-2019-20825 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.11. It has an out-of-bounds write when Internet Explorer is used. |
CVE-2019-20824 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.11. It has a NULL pointer dereference via FXSYS_wcslen in an Epub file. |
CVE-2019-20823 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.11. It has a buffer overflow because a looping correction does not occur after JavaScript updates Field… |
CVE-2019-20822 | Critical | 9.8 | 2020-06-04 | An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.7.0.29430. It has an out-of-bounds write via incorrect image data. |
CVE-2019-20821 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF Mac before 3.4. It has a NULL pointer dereference. |
CVE-2019-20820 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It has a NULL pointer dereference during the parsing of file data. |
CVE-2019-20819 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It allows stack consumption via nested function calls for XML parsing. |
CVE-2019-20818 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It allows memory consumption because data is created for each page of an application level. |
CVE-2019-20817 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It has a NULL pointer dereference. |
CVE-2019-20816 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.12. It has a NULL pointer dereference during the parsing of file data. |
CVE-2019-20815 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.12. It allows stack consumption via nested function calls for XML parsing. |
CVE-2019-20814 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.12. It allows memory consumption because data is created for each page of an application level. |
CVE-2019-20813 | High | 7.5 | 2020-06-04 | An issue was discovered in Foxit PhantomPDF before 8.3.12. It has a NULL pointer dereference. |
CVE-2019-16385 | Medium | 6.1 | 2020-06-04 | Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request, as demonstrated by an example.pdf?m… |
CVE-2019-16384 | Medium | 6.5 | 2020-06-04 | Cybele Thinfinity VirtualUI 2.5.17.2 allows ../ path traversal that can be used for data exfiltration. This enables files outside of the web directory to be re… |
CVE-2019-16150 | Medium | 5.5 | 2020-06-04 | Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClient for Windows prior to 6.4.0 may allow… |
CVE-2019-20809 | High | 7.5 | 2020-06-03 | The price oracle in PriceOracle.sol in Compound Finance Compound Price Oracle 1.0 through 2.0 allows a price poster to set an invalid asset price via the setPr… |
CVE-2019-20812 | Medium | 5.5 | 2020-06-03 | An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (C… |
CVE-2019-20811 | Medium | 5.5 | 2020-06-03 | An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count i… |
CVE-2019-20810 | Medium | 5.5 | 2020-06-03 | go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, which causes a memory l… |
CVE-2019-11843 | Medium | 6.1 | 2020-06-02 | The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Se… |
CVE-2019-17603 | High | 7.8 | 2020-06-02 | Ene.sys in Asus Aura Sync through 1.07.71 does not properly validate input to IOCTL 0x80102044, 0x80102050, and 0x80102054, which allows local users to cause a… |
CVE-2019-14087 | High | 7.8 | 2020-06-02 | Failure in buffer management while accessing handle for HDR blit when color modes not supported by display in Snapdragon Consumer IOT, Snapdragon Mobile, Snapd… |
CVE-2019-14078 | High | 7.8 | 2020-06-02 | Out of bound memory access while processing qpay due to not validating length of the response buffer provided by User. in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-14077 | High | 7.8 | 2020-06-02 | Out of bound memory access while processing ese transmit command due to passing Response buffer received from user in Snapdragon Auto, Snapdragon Compute, Snap… |
CVE-2019-14067 | Medium | 5.5 | 2020-06-02 | Using non-time-constant functions like memcmp to compare sensitive data can lead to information leakage through timing side channel issue. in Snapdragon Auto… |
CVE-2019-14066 | High | 7.8 | 2020-06-02 | Integer overflow in calculating estimated output buffer size when getting a list of installed Feature IDs, Serial Numbers or checking Feature ID status in Snap… |
CVE-2019-14054 | High | 7.8 | 2020-06-02 | Improper permissions in XBL_SEC region enable user to update XBL_SEC code and data and divert the RAM dump path to normal cold boot path in Snapdragon Compute… |
CVE-2019-14053 | High | 7.1 | 2020-06-02 | When attempting to create a new XFRM policy, a stack out-of-bounds read will occur if the user provides a template where the mode is set to a value that does n… |
CVE-2019-14043 | High | 7.1 | 2020-06-02 | Out of bound read in Fingerprint application due to requested data is being used without length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connec… |
CVE-2019-14042 | High | 7.1 | 2020-06-02 | Out of bound read in in fingerprint application due to requested data assigned to a local buffer without length check in Snapdragon Auto, Snapdragon Compute, S… |
CVE-2019-14039 | High | 7.1 | 2020-06-02 | Out of bound read in adm call back function due to incorrect boundary check for payload in command response in Snapdragon Auto, Snapdragon Compute, Snapdragon… |
CVE-2019-14038 | High | 7.1 | 2020-06-02 | Buffer over-read in ADSP parse function due to lack of check for availability of sufficient data payload received in command response in Snapdragon Auto, Snapd… |
CVE-2019-15709 | Medium | 6.5 | 2020-06-01 | An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators… |
CVE-2019-20805 | Medium | 5.5 | 2020-06-01 | p_lx_elf.cpp in UPX before 3.96 has an integer overflow during unpacking via crafted values in a PT_DYNAMIC segment. |
CVE-2019-6342 | Critical | 9.8 | 2020-05-28 | An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces mo… |
CVE-2019-20807 | Medium | 5.3 | 2020-05-28 | In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua). |
CVE-2019-20806 | Medium | 4.4 | 2020-05-27 | An issue was discovered in the Linux kernel before 5.2. There is a NULL pointer dereference in tw5864_handle_frame() in drivers/media/pci/tw5864/tw5864-video.c… |
CVE-2019-20804 | High | 8.8 | 2020-05-21 | Gila CMS before 1.11.6 allows CSRF with resultant XSS via the admin/themes URI, leading to compromise of the admin account. |
CVE-2019-20803 | Medium | 6.1 | 2020-05-21 | Gila CMS before 1.11.6 has reflected XSS via the admin/content/postcategory id parameter, which is mishandled for g_preview_theme. |
CVE-2019-5997 | Critical | 9.8 | 2020-05-20 | Video Insight VMS versions prior to 7.6.1 allow remote attackers to conduct code injection attacks via unspecified vectors. |
CVE-2019-11048 | Medium | 5.3 | 2020-05-20 | In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field name… |
CVE-2019-17066 | High | 7.8 | 2020-05-18 | In Ivanti WorkSpace Control before 10.4.40.0, a user can elevate rights on the system by hijacking certain user registries. This is possible because pwrgrid.ex… |
CVE-2019-19456 | Medium | 6.1 | 2020-05-18 | A Reflected XSS was found in the server selection box inside the login page at: enginemanager/loginfailed.html in Wowza Streaming Engine <= 4.x.x. This issue w… |
CVE-2019-19454 | High | 7.5 | 2020-05-18 | An arbitrary file download was found in the "Download Log" functionality of Wowza Streaming Engine <= 4.x.x. This issue was resolved in Wowza Streaming Engine… |
CVE-2019-7247 | Critical | 9.8 | 2020-05-18 | An issue was discovered in AODDriver2.sys in AMD OverDrive. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x81112ee0 and does not properly filter… |
CVE-2019-7246 | Medium | 6.7 | 2020-05-18 | An issue was discovered in atillk64.sys in AMD ATI Diagnostics Hardware Abstraction Sys/Overclocking Utility 5.11.9.0. The vulnerable driver exposes a wrmsr in… |
CVE-2019-20802 | Medium | 6.1 | 2020-05-18 | An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server improperly displays directory names, lead… |
CVE-2019-20801 | Medium | 5.3 | 2020-05-18 | An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server allows for cross-origin requests from any… |
CVE-2019-20800 | Critical | 9.8 | 2020-05-18 | In Cherokee through 1.2.104, remote attackers can trigger an out-of-bounds write in cherokee_handler_cgi_add_env_pair in handler_cgi.c by sending many request… |
CVE-2019-20799 | High | 7.5 | 2020-05-18 | In Cherokee through 1.2.104, multiple memory corruption errors may be used by a remote attacker to destabilize the work of a server. |
CVE-2019-20798 | High | 8.4 | 2020-05-18 | An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default co… |
CVE-2019-20797 | High | 7.5 | 2020-05-18 | An issue was discovered in e6y prboom-plus 2.5.1.5. There is a buffer overflow in client and server code responsible for handling received UDP packets, as demo… |
CVE-2019-20390 | High | 8.1 | 2020-05-15 | A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a vic… |
CVE-2019-20389 | Medium | 6.1 | 2020-05-15 | An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the… |
CVE-2019-19721 | High | 7.8 | 2020-05-15 | An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of ser… |
CVE-2019-18666 | Critical | 9.8 | 2020-05-15 | An issue was discovered on D-Link DAP-1360 revision F devices. Remote attackers can start a telnet service without authorization via an undocumented HTTP reque… |
CVE-2019-17572 | Medium | 5.3 | 2020-05-14 | In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent… |
CVE-2019-17562 | Critical | 9.8 | 2020-05-14 | A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack. This applies to all versions prior to 4.13.1. The vulnerability… |
CVE-2019-13023 | Medium | 6.5 | 2020-05-14 | An issue was discovered in all versions of Bond JetSelect. Within the JetSelect Application, the web interface hides RADIUS secrets, WPA passwords, and SNMP st… |
CVE-2019-13022 | Critical | 9.8 | 2020-05-14 | Bond JetSelect (all versions) has an issue in the Java class (ENCtool.jar) and corresponding password generation algorithm (used to set initial passwords upon… |
CVE-2019-13021 | Medium | 6.5 | 2020-05-14 | The administrative passwords for all versions of Bond JetSelect are stored within an unprotected file on the filesystem, rather than encrypted within the MySQL… |
CVE-2019-15083 | Medium | 6.1 | 2020-05-14 | Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the in… |
CVE-2019-2388 | Medium | 5.8 | 2020-05-13 | In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager in… |
CVE-2019-9682 | High | 8.1 | 2020-05-13 | Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal login of early devi… |
CVE-2019-15880 | Critical | 9.8 | 2020-05-13 | In FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the cryptodev module allocated the size of a kernel buffer based on… |
CVE-2019-15879 | High | 7.4 | 2020-05-13 | In FreeBSD 12.1-STABLE before r356908, 12.1-RELEASE before p5, 11.3-STABLE before r356908, and 11.3-RELEASE before p9, a race condition in the cryptodev module… |
CVE-2019-15878 | High | 7.8 | 2020-05-13 | In FreeBSD 12.1-STABLE before r352509, 11.3-STABLE before r352509, and 11.3-RELEASE before p9, an unprivileged local user can trigger a use-after-free situatio… |
CVE-2019-16112 | High | 8.8 | 2020-05-13 | TylerTech Eagle 2018.3.11 deserializes untrusted user input, resulting in remote code execution via a crafted Java object to the recorder/ServiceManager?servic… |
CVE-2019-4478 | Medium | 6.5 | 2020-05-12 | IBM Maximo Asset Management 7.6.0, and 7.6.1 could allow an authenticated user to obtain highly sensitive information that they should not normally have access… |
CVE-2019-5500 | High | 7.5 | 2020-05-11 | Certain versions of the NetApp Service Processor and Baseboard Management Controller firmware allow a remote unauthenticated attacker to cause a Denial of Serv… |
CVE-2019-4667 | Medium | 5.9 | 2020-05-11 | IBM UrbanCode Deploy (UCD) 7.0.5.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transpor… |
CVE-2019-19162 | High | 7.8 | 2020-05-11 | A use-after-free vulnerability in the TOBESOFT XPLATFORM versions 9.1 to 9.2.2 may lead to code execution on a system running it. |
CVE-2019-20795 | Medium | 4.4 | 2020-05-09 | iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, al… |
CVE-2019-20794 | Medium | 4.7 | 2020-05-09 | An issue was discovered in the Linux kernel 4.18 through 5.6.11 when unprivileged user namespaces are allowed. A user can create their own PID namespace, and m… |
CVE-2019-14898 | High | 7.0 | 2020-05-08 | The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive information, cause… |
CVE-2019-10170 | Medium | 6.6 | 2020-05-08 | A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker wi… |
CVE-2019-10169 | Medium | 6.6 | 2020-05-08 | A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated att… |
CVE-2019-19164 | High | 7.8 | 2020-05-07 | dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the a… |
CVE-2019-18872 | High | 7.5 | 2020-05-07 | Weak password requirements in Blaauw Remote Kiln Control through v3.00r4 allow a user to set short or guessable passwords (e.g., 1 or 1234). |
CVE-2019-18871 | High | 8.8 | 2020-05-07 | A path traversal in debug.php accessed via default.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to upload arbitrary files… |
CVE-2019-18870 | Medium | 6.5 | 2020-05-07 | A path traversal via the iniFile parameter in excel.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to download arbitrary fi… |
CVE-2019-18869 | Critical | 9.8 | 2020-05-07 | Leftover Debug Code in Blaauw Remote Kiln Control through v3.00r4 allows a user to execute arbitrary php code via /default.php?idx=17. |
CVE-2019-18866 | High | 7.5 | 2020-05-07 | Unauthenticated SQL injection via the username in the login mechanism in Blaauw Remote Kiln Control through v3.00r4 allows a user to extract arbitrary data fro… |