2019 CVEs (page 151)
Page 151 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-4032 | Critical | 9.8 | 2019-03-05 | IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.1.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted… |
CVE-2019-4029 | Medium | 5.4 | 2019-03-05 | IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i… |
CVE-2019-4028 | Medium | 5.4 | 2019-03-05 | IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i… |
CVE-2019-4027 | Medium | 5.4 | 2019-03-05 | IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i… |
CVE-2019-6234 | High | 8.8 | 2019-03-05 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows… |
CVE-2019-6233 | High | 8.8 | 2019-03-05 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows… |
CVE-2019-6231 | Medium | 5.5 | 2019-03-05 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1.3. A malic… |
CVE-2019-6230 | High | 8.6 | 2019-03-05 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3,macOS Mojave 10.14.3,tvOS 12.1.2,watchOS 5.1.3. A… |
CVE-2019-6229 | Medium | 6.1 | 2019-03-05 | A logic issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Wind… |
CVE-2019-6228 | Medium | 6.1 | 2019-03-05 | A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue is fixed in iOS 12.1.3, Safari 12.0.3. Proces… |
CVE-2019-6227 | High | 8.8 | 2019-03-05 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, watchOS 5.1.3, Safari 12.0.3, iTunes 12… |
CVE-2019-6226 | High | 8.8 | 2019-03-05 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, watchOS 5.1.3, Safari 12.0.3, i… |
CVE-2019-6225 | High | 7.8 | 2019-03-05 | A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2. A malicious application… |
CVE-2019-6224 | High | 8.8 | 2019-03-05 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1.3. A rem… |
CVE-2019-6223 | High | 7.5 | 2019-03-05 | A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS… |
CVE-2019-6221 | High | 7.8 | 2019-03-05 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, iTunes 12.9.3 for Windows. A malici… |
CVE-2019-6220 | Medium | 5.5 | 2019-03-05 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Mojave 10.14.3. An application may be able to read restricted… |
CVE-2019-6219 | High | 7.5 | 2019-03-05 | A denial of service issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, watchOS 5.1.3. Processing a maliciou… |
CVE-2019-6218 | High | 7.8 | 2019-03-05 | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2. A malicious appli… |
CVE-2019-6217 | High | 8.8 | 2019-03-05 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, watchOS 5.1.3, Safari 12.0.3, i… |
CVE-2019-6216 | High | 8.8 | 2019-03-05 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, watchOS 5.1.3, Safari 12.0.3, i… |
CVE-2019-6215 | High | 8.8 | 2019-03-05 | A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, i… |
CVE-2019-6214 | High | 8.6 | 2019-03-05 | A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1.3. A mali… |
CVE-2019-6213 | High | 7.8 | 2019-03-05 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1.3. An applicat… |
CVE-2019-6212 | High | 8.8 | 2019-03-05 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 fo… |
CVE-2019-6211 | High | 8.8 | 2019-03-05 | A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3. Processing maliciously crafted… |
CVE-2019-6210 | High | 7.8 | 2019-03-05 | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1.3. A… |
CVE-2019-6209 | Medium | 5.5 | 2019-03-05 | An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in iOS… |
CVE-2019-6208 | Medium | 5.5 | 2019-03-05 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2. A malicious ap… |
CVE-2019-6205 | High | 7.8 | 2019-03-05 | A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2. A malicious ap… |
CVE-2019-6202 | High | 7.8 | 2019-03-05 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, watchOS 5.1.3. A malicious applicat… |
CVE-2019-6200 | High | 8.8 | 2019-03-05 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3. An attacker in a privileged networ… |
CVE-2019-8263 | Medium | 6.5 | 2019-03-05 | UltraVNC revision 1205 has stack-based buffer overflow vulnerability in VNC client code inside ShowConnInfo routine, which leads to a denial of service (DoS) c… |
CVE-2019-8262 | Critical | 9.8 | 2019-03-05 | UltraVNC revision 1203 has multiple heap buffer overflow vulnerabilities in VNC client code inside Ultra decoder, which results in code execution. This attack… |
CVE-2019-8261 | Critical | 9.8 | 2019-03-05 | UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC code inside client CoRRE decoder, caused by multiplication overflow. This attack appears t… |
CVE-2019-8260 | Critical | 9.8 | 2019-03-05 | UltraVNC revision 1199 has a out-of-bounds read vulnerability in VNC client RRE decoder code, caused by multiplication overflow. This attack appears to be expl… |
CVE-2019-8259 | High | 7.5 | 2019-03-05 | UltraVNC revision 1198 contains multiple memory leaks (CWE-655) in VNC client code, which allow an attacker to read stack memory and can be abused for informat… |
CVE-2019-8258 | Critical | 9.8 | 2019-03-05 | UltraVNC revision 1198 has a heap buffer overflow vulnerability in VNC client code which results code execution. This attack appears to be exploitable via netw… |
CVE-2019-9572 | High | 7.2 | 2019-03-05 | SchoolCMS version 2.3.1 allows file upload via the theme upload feature at admin.php?m=admin&c=theme&a=upload by using the .zip extension along with the _Stati… |
CVE-2019-9570 | Medium | 4.8 | 2019-03-05 | An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/system_manage/save.html URI, related to the site_code parameter. |
CVE-2019-6235 | Critical | 10.0 | 2019-03-04 | A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1.3, iTunes 1… |
CVE-2019-6206 | Critical | 9.8 | 2019-03-04 | An issue existed with autofill resuming after it was canceled. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.3. Passw… |
CVE-2019-9568 | Medium | 6.5 | 2019-03-04 | The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry[]… |
CVE-2019-9567 | Medium | 6.1 | 2019-03-04 | The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll. |
CVE-2019-9566 | Critical | 9.8 | 2019-03-04 | FlarumChina v0.1.0-beta.7C has SQL injection via a /?q= request. |
CVE-2019-9565 | Critical | 9.1 | 2019-03-04 | Druide Antidote RX, HD, 8 before 8.05.2287, 9 before 9.5.3937 and 10 before 10.1.2147 allows remote attackers to steal NTLM hashes or perform SMB relay attacks… |
CVE-2019-9563 | High | 7.5 | 2019-03-04 | In BlueMind 3.5.x before 3.5.11 Hotfix 7 and 4.x before 4.0-beta3, the contact application mishandles temporary uploads. |
CVE-2019-9552 | Critical | 9.8 | 2019-03-04 | Eloan V3.0 through 2018-09-20 allows remote attackers to list files via a direct request to the p2p/api/ or p2p/lib/ or p2p/images/ URI. |
CVE-2019-9551 | Medium | 4.8 | 2019-03-04 | An issue was discovered in DOYO (aka doyocms) 2.3 through 2015-05-06. It has admin.php XSS. |
CVE-2019-9550 | Medium | 4.8 | 2019-03-03 | DhCms through 2017-09-18 has admin.php?r=admin/Index/index XSS. |
CVE-2019-9549 | High | 8.8 | 2019-03-03 | An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=user&act=addnew URI, as demonstrated by adding a level=1 account, a sim… |
CVE-2019-8279 | Medium | 5.4 | 2019-03-02 | Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum. |
CVE-2019-8278 | Medium | 6.1 | 2019-03-02 | Stored XSS in Invision Power Board versions 3.3.1 - 3.4.8 leads to Remote Code Execution. |
CVE-2019-9547 | Medium | 5.3 | 2019-03-01 | In Storage Performance Development Kit (SPDK) before 19.01, a malicious vhost client (i.e., virtual machine) could carefully construct a circular descriptor ch… |
CVE-2019-9546 | Critical | 9.8 | 2019-03-01 | SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service. |
CVE-2019-9545 | High | 8.8 | 2019-03-01 | An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a… |
CVE-2019-9544 | High | 8.8 | 2019-03-01 | An issue was discovered in Bento4 1.5.1-628. An out of bounds write occurs in AP4_CttsTableEntry::AP4_CttsTableEntry() located in Core/Ap4Array.h. It can be tr… |
CVE-2019-9543 | High | 8.8 | 2019-03-01 | An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sendin… |
CVE-2019-9484 | High | 7.5 | 2019-03-01 | The Glen Dimplex Deutschland GmbH implementation of the Carel pCOWeb configuration tool allows remote attackers to obtain access via an HTTP session on port 10… |
CVE-2019-9483 | Critical | 9.1 | 2019-03-01 | Amazon Ring Doorbell before 3.4.7 mishandles encryption, which allows attackers to obtain audio and video data, or insert spoofed video that does not correspon… |
CVE-2019-9482 | Medium | 5.3 | 2019-03-01 | In MISP 2.4.102, an authenticated user can view sightings that they should not be eligible for. Exploiting this requires access to the event that has received… |
CVE-2019-6551 | High | 7.5 | 2019-02-28 | Pangea Communications Internet FAX ATA all Versions 3.1.8 and prior allow an attacker to bypass user authentication using a specially crafted URL to cause the… |
CVE-2019-6547 | Medium | 5.5 | 2019-02-28 | Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.84 and prior. An out-of-bounds read vulnerability may cause the software to crash due to… |
CVE-2019-6555 | High | 7.8 | 2019-02-28 | Cscape, 9.80 SP4 and prior. An improper input validation vulnerability may be exploited by processing specially crafted POC files. This may allow an attacker t… |
CVE-2019-1674 | High | 7.8 | 2019-02-28 | A vulnerability in the update service of Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools for Windows could allow an authenticated, local at… |
CVE-2019-1663 | Critical | 9.8 | 2019-02-28 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco… |
CVE-2019-2001 | Medium | 5.5 | 2019-02-28 | The permissions on /proc/iomem were world-readable. This could lead to local information disclosure with no additional execution privileges needed. User intera… |
CVE-2019-2000 | High | 7.8 | 2019-02-28 | In several functions of binder.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additio… |
CVE-2019-1999 | High | 7.8 | 2019-02-28 | In binder_alloc_free_page of binder_alloc.c, there is a possible double free due to improper locking. This could lead to local escalation of privilege in the k… |
CVE-2019-1998 | Medium | 5.5 | 2019-02-28 | In event_handler of keymaster_app.c, there is possible resource exhaustion due to a table being lost on reboot. This could lead to local denial of service that… |
CVE-2019-1997 | High | 7.5 | 2019-02-28 | In random_get_bytes of random.c, there is a possible degradation of randomness due to an insecure default value. This could lead to local information disclosur… |
CVE-2019-1996 | Medium | 6.5 | 2019-02-28 | In avrc_pars_browse_rsp of avrc_pars_ct.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclos… |
CVE-2019-1995 | Medium | 5.5 | 2019-02-28 | In ComposeActivityEmail of ComposeActivityEmail.java, there is a possible way to silently attach files to an email due to a confused deputy. This could lead to… |
CVE-2019-1994 | High | 8.8 | 2019-02-28 | In refresh of DevelopmentTiles.java, there is the possibility of leaving development settings accessible due to an insecure default value. This could lead to u… |
CVE-2019-1993 | High | 7.8 | 2019-02-28 | In register_app of btif_hd.cc, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with no addit… |
CVE-2019-1992 | High | 7.5 | 2019-02-28 | In bta_hl_sdp_query_results of bta_hl_main.cc, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no add… |
CVE-2019-1991 | High | 8.8 | 2019-02-28 | In btif_dm_data_copy of btif_core.cc, there is a possible out of bounds write due to a buffer overflow. This could lead to remote code execution with no additi… |
CVE-2019-1988 | High | 8.8 | 2019-02-28 | In sample6 of SkSwizzler.cpp, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution in system_serv… |
CVE-2019-1987 | High | 7.8 | 2019-02-28 | In onSetSampleX of SkSwizzler.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no addi… |
CVE-2019-1986 | High | 8.8 | 2019-02-28 | In SkSwizzler::onSetSampleX of SkSwizzler.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of p… |
CVE-2019-3599 | High | 7.5 | 2019-02-28 | Information Disclosure vulnerability in Remote logging (which is disabled by default) in McAfee Agent (MA) 5.x allows remote unauthenticated users to access se… |
CVE-2019-3598 | Medium | 5.3 | 2019-02-28 | Buffer Access with Incorrect Length Value in McAfee Agent (MA) 5.x allows remote unauthenticated users to potentially cause a denial of service via specificall… |
CVE-2019-3582 | High | 8.6 | 2019-02-28 | Privilege Escalation vulnerability in Microsoft Windows client in McAfee Endpoint Security (ENS) 10.6.1 and earlier allows local users to gain elevated privile… |
CVE-2019-9227 | Critical | 9.8 | 2019-02-28 | An issue was discovered in baigo CMS 2.1.1. There is a vulnerability that allows remote attackers to execute arbitrary code. A BG_SITE_NAME parameter with mali… |
CVE-2019-9226 | Medium | 6.1 | 2019-02-28 | An issue was discovered in baigo CMS 2.1.1. There is a persistent XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the… |
CVE-2019-9215 | Critical | 9.8 | 2019-02-28 | In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function. |
CVE-2019-9214 | High | 7.5 | 2019-02-28 | In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in epan/dissectors/packet-rpcap.c by avoiding an attempted… |
CVE-2019-9209 | Medium | 5.5 | 2019-02-28 | In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the ASN.1 BER and related dissectors could crash. This was addressed in epan/dissectors/packet-ber.c by preven… |
CVE-2019-9208 | High | 7.5 | 2019-02-28 | In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the TCAP dissector could crash. This was addressed in epan/dissectors/asn1/tcap/tcap.cnf by avoiding NULL poin… |
CVE-2019-5671 | Medium | 5.5 | 2019-02-27 | NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the software does not rel… |
CVE-2019-5670 | High | 7.8 | 2019-02-27 | NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape in which the software uses a sequential operation… |
CVE-2019-5669 | High | 7.8 | 2019-02-27 | NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape in which the software uses a sequential operation… |
CVE-2019-5668 | High | 7.8 | 2019-02-27 | NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiSubmitCommandVirtual in which the applica… |
CVE-2019-5667 | High | 7.8 | 2019-02-27 | NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiSetRootPageTable in which the application… |
CVE-2019-5666 | High | 7.8 | 2019-02-27 | NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) create context command DDI DxgkDdiCreateContext in which the… |
CVE-2019-5665 | High | 7.8 | 2019-02-27 | NVIDIA Windows GPU Display driver contains a vulnerability in the 3D vision component in which the stereo service software, when opening a file, does not check… |
CVE-2019-1559 | Medium | 5.9 | 2019-02-27 | If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can… |
CVE-2019-4061 | Medium | 5.3 | 2019-02-27 | IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the updates and fixlets deployed to the associ… |
CVE-2019-9212 | Critical | 9.8 | 2019-02-27 | SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.nam… |
CVE-2019-9211 | Medium | 6.5 | 2019-02-27 | There is a reachable assertion abort in the function write_long_string_missing_values() in data/sys-file-writer.c in libdata.a in GNU PSPP 1.2.0 that will lead… |