2019 CVEs (page 150)
Page 150 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-9578 | High | 7.5 | 2019-03-05 | In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device. |
CVE-2019-9555 | Medium | 5.3 | 2019-03-05 | Sagemcom F@st 5260 routers using firmware version 0.4.39, in WPA mode, default to using a PSK that is generated from a 2-part wordlist of known values and a no… |
CVE-2019-8336 | High | 8.1 | 2019-03-05 | HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbit… |
CVE-2019-0743 | Medium | 5.4 | 2019-03-05 | A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross… |
CVE-2019-0742 | Medium | 5.4 | 2019-03-05 | A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross… |
CVE-2019-0741 | High | 7.5 | 2019-03-05 | An information disclosure vulnerability exists in the way Azure IoT Java SDK logs sensitive information, aka 'Azure IoT Java SDK Information Disclosure Vulnera… |
CVE-2019-0729 | Critical | 9.8 | 2019-03-05 | An Elevation of Privilege vulnerability exists in the way Azure IoT Java SDK generates symmetric keys for encryption, allowing an attacker to predict the rando… |
CVE-2019-0728 | High | 7.8 | 2019-03-05 | A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remot… |
CVE-2019-0724 | High | 8.1 | 2019-03-05 | An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID… |
CVE-2019-0686 | High | 7.4 | 2019-03-05 | An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID… |
CVE-2019-0676 | Medium | 6.5 | 2019-03-05 | An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this vulnerab… |
CVE-2019-0675 | High | 7.8 | 2019-03-05 | A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office A… |
CVE-2019-0674 | High | 7.8 | 2019-03-05 | A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office A… |
CVE-2019-0673 | High | 7.8 | 2019-03-05 | A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office A… |
CVE-2019-0672 | High | 7.8 | 2019-03-05 | A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office A… |
CVE-2019-0671 | High | 7.8 | 2019-03-05 | A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office A… |
CVE-2019-0670 | Medium | 6.1 | 2019-03-05 | A spoofing vulnerability exists in Microsoft SharePoint when the application does not properly parse HTTP content, aka 'Microsoft SharePoint Spoofing Vulnerabi… |
CVE-2019-0669 | Medium | 6.5 | 2019-03-05 | An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosur… |
CVE-2019-0668 | High | 8.8 | 2019-03-05 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share… |
CVE-2019-0664 | Medium | 6.5 | 2019-03-05 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-0663 | Medium | 5.5 | 2019-03-05 | An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.To exploit this vulnerability, an authenticated… |
CVE-2019-0662 | High | 8.8 | 2019-03-05 | A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code E… |
CVE-2019-0661 | Medium | 5.5 | 2019-03-05 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera… |
CVE-2019-0660 | Medium | 6.5 | 2019-03-05 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-0659 | High | 7.0 | 2019-03-05 | An elevation of privilege vulnerability exists when the Storage Service improperly handles file operations, aka 'Windows Storage Service Elevation of Privilege… |
CVE-2019-0658 | Medium | 6.5 | 2019-03-05 | An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka 'Scripting Engine In… |
CVE-2019-0657 | Medium | 5.9 | 2019-03-05 | A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerabil… |
CVE-2019-0656 | High | 7.0 | 2019-03-05 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege V… |
CVE-2019-0655 | High | 7.5 | 2019-03-05 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Cor… |
CVE-2019-0654 | Medium | 4.3 | 2019-03-05 | A spoofing vulnerability exists when Microsoft browsers improperly handles specific redirects, aka 'Microsoft Browser Spoofing Vulnerability'. |
CVE-2019-0652 | High | 7.5 | 2019-03-05 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Cor… |
CVE-2019-0651 | High | 7.5 | 2019-03-05 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Cor… |
CVE-2019-0650 | High | 7.5 | 2019-03-05 | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'. T… |
CVE-2019-0649 | High | 8.1 | 2019-03-05 | A vulnerability exists in Microsoft Chakra JIT server, aka 'Scripting Engine Elevation of Privileged Vulnerability'. |
CVE-2019-0648 | Medium | 4.3 | 2019-03-05 | An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to… |
CVE-2019-0645 | High | 7.5 | 2019-03-05 | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'. T… |
CVE-2019-0644 | High | 7.5 | 2019-03-05 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Cor… |
CVE-2019-0643 | Medium | 4.3 | 2019-03-05 | An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests, aka 'Microsoft Edge Information Disclosure Vulnera… |
CVE-2019-0642 | High | 7.5 | 2019-03-05 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Cor… |
CVE-2019-0641 | Medium | 5.9 | 2019-03-05 | A security feature bypass vulnerability exists in Microsoft Edge handles whitelisting, aka 'Microsoft Edge Security Feature Bypass Vulnerability'. |
CVE-2019-0640 | High | 7.5 | 2019-03-05 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Cor… |
CVE-2019-0637 | High | 7.5 | 2019-03-05 | A security feature bypass vulnerability exists when Windows Defender Firewall incorrectly applies firewall profiles to cellular network connections, aka 'Windo… |
CVE-2019-0636 | Medium | 5.5 | 2019-03-05 | An information vulnerability exists when Windows improperly discloses file information, aka 'Windows Information Disclosure Vulnerability'. |
CVE-2019-0635 | Medium | 6.2 | 2019-03-05 | An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a… |
CVE-2019-0634 | High | 7.5 | 2019-03-05 | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft Edge Memory Corruption Vulnerability'. T… |
CVE-2019-0633 | High | 8.8 | 2019-03-05 | A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requests, aka 'Windows SMB R… |
CVE-2019-0632 | High | 7.8 | 2019-03-05 | A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security Feature Bypass Vulnerabil… |
CVE-2019-0631 | High | 7.8 | 2019-03-05 | A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security Feature Bypass Vulnerabil… |
CVE-2019-0630 | High | 8.8 | 2019-03-05 | A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requests, aka 'Windows SMB R… |
CVE-2019-0628 | Medium | 5.5 | 2019-03-05 | An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerabili… |
CVE-2019-0627 | High | 7.8 | 2019-03-05 | A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka 'Windows Security Feature Bypass Vulnerabil… |
CVE-2019-0626 | Critical | 9.8 | 2019-03-05 | A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP server, aka 'Windows DHC… |
CVE-2019-0625 | High | 7.8 | 2019-03-05 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2019-0623 | High | 7.8 | 2019-03-05 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil… |
CVE-2019-0621 | Medium | 5.5 | 2019-03-05 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera… |
CVE-2019-0619 | Medium | 6.5 | 2019-03-05 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-0618 | High | 8.8 | 2019-03-05 | A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code E… |
CVE-2019-0616 | Medium | 6.5 | 2019-03-05 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-0615 | Medium | 6.5 | 2019-03-05 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-0613 | High | 8.8 | 2019-03-05 | A remote code execution vulnerability exists in .NET Framework and Visual Studio software when the software fails to check the source markup of a file.An attac… |
CVE-2019-0610 | High | 7.5 | 2019-03-05 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Cor… |
CVE-2019-0607 | High | 7.5 | 2019-03-05 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Cor… |
CVE-2019-0606 | High | 7.5 | 2019-03-05 | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerabili… |
CVE-2019-0605 | High | 7.5 | 2019-03-05 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Cor… |
CVE-2019-0604 | Critical | 9.8 | 2019-03-05 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microso… |
CVE-2019-0602 | Medium | 6.5 | 2019-03-05 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-0601 | Medium | 4.7 | 2019-03-05 | An information disclosure vulnerability exists when the Human Interface Devices (HID) component improperly handles objects in memory, aka 'HID Information Disc… |
CVE-2019-0600 | Medium | 4.7 | 2019-03-05 | An information disclosure vulnerability exists when the Human Interface Devices (HID) component improperly handles objects in memory, aka 'HID Information Disc… |
CVE-2019-0599 | High | 7.8 | 2019-03-05 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2019-0598 | High | 7.8 | 2019-03-05 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2019-0597 | High | 7.8 | 2019-03-05 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2019-0596 | High | 7.8 | 2019-03-05 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2019-0595 | High | 7.8 | 2019-03-05 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2019-0594 | High | 8.8 | 2019-03-05 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microso… |
CVE-2019-0593 | High | 7.5 | 2019-03-05 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Cor… |
CVE-2019-0591 | High | 7.5 | 2019-03-05 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Cor… |
CVE-2019-0590 | High | 7.5 | 2019-03-05 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Cor… |
CVE-2019-0540 | Medium | 5.5 | 2019-03-05 | A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which cou… |
CVE-2019-9213 | Medium | 5.5 | 2019-03-05 | In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit ke… |
CVE-2019-9576 | Medium | 6.1 | 2019-03-05 | The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS. |
CVE-2019-9575 | Medium | 6.1 | 2019-03-05 | The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS. |
CVE-2019-9574 | High | 7.5 | 2019-03-05 | The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR M… |
CVE-2019-9573 | High | 7.5 | 2019-03-05 | The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications. |
CVE-2019-3922 | Critical | 9.8 | 2019-03-05 | The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST request sent by a rem… |
CVE-2019-3921 | High | 8.8 | 2019-03-05 | The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST request sent by a rem… |
CVE-2019-3920 | High | 8.8 | 2019-03-05 | The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to authenticated command injection via crafted HTTP request sent by a… |
CVE-2019-3919 | High | 8.8 | 2019-03-05 | The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to command injection via crafted HTTP request sent by a remote, authen… |
CVE-2019-3918 | Critical | 9.8 | 2019-03-05 | The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 contains multiple hard coded credentials for the Telnet and SSH interfaces. |
CVE-2019-3917 | High | 7.5 | 2019-03-05 | The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 allows a remote, unauthenticated attacker to enable telnetd on the router via a craf… |
CVE-2019-6565 | Medium | 6.1 | 2019-03-05 | Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attacks, which may be use… |
CVE-2019-6563 | Critical | 9.8 | 2019-03-05 | Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, which could lead to a… |
CVE-2019-6561 | High | 8.8 | 2019-03-05 | Cross-site request forgery has been identified in Moxa IKS and EDS, which may allow for the execution of unauthorized actions on the device. |
CVE-2019-6559 | Medium | 6.5 | 2019-03-05 | Moxa IKS and EDS allow remote authenticated users to cause a denial of service via a specially crafted packet, which may cause the switch to crash. |
CVE-2019-6557 | Critical | 9.8 | 2019-03-05 | Several buffer overflow vulnerabilities have been identified in Moxa IKS and EDS, which may allow remote code execution. |
CVE-2019-6528 | High | 8.8 | 2019-03-05 | PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family, IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4.2.21, 5.0.27, 5.1… |
CVE-2019-6524 | Critical | 9.8 | 2019-03-05 | Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to discover passwords via… |
CVE-2019-6522 | Critical | 9.1 | 2019-03-05 | Moxa IKS and EDS fails to properly check array bounds which may allow an attacker to read device memory on arbitrary addresses, and may allow an attacker to re… |
CVE-2019-6520 | High | 7.5 | 2019-03-05 | Moxa IKS and EDS does not properly check authority on server side, which results in a read-only user being able to perform arbitrary configuration changes. |
CVE-2019-6518 | High | 7.5 | 2019-03-05 | Moxa IKS and EDS store plaintext passwords, which may allow sensitive information to be read by someone with access to the device. |
CVE-2019-4063 | Medium | 5.9 | 2019-03-05 | IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 Standard Edition could allow highly sensitive information to be transmitted in plain text. An attacker coul… |