2019 CVEs (page 153)
Page 153 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-9002 | Critical | 9.8 | 2019-02-22 | An issue was discovered in Tiny Issue 1.3.1 and pixeline Bugs through 1.3.2c. install/config-setup.php allows remote attackers to execute arbitrary PHP code vi… |
CVE-2019-8955 | High | 7.5 | 2019-02-21 | In Tor before 0.3.3.12, 0.3.4.x before 0.3.4.11, 0.3.5.x before 0.3.5.8, and 0.4.x before 0.4.0.2-alpha, remote denial of service against Tor clients and relay… |
CVE-2019-8996 | Critical | 9.8 | 2019-02-21 | In Signiant Manager+Agents before 13.5, the implementation of the set command has a Buffer Overflow. |
CVE-2019-6340 | High | 8.1 | 2019-02-21 | Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary P… |
CVE-2019-1700 | Medium | 6.1 | 2019-02-21 | A vulnerability in field-programmable gate array (FPGA) ingress buffer management for the Cisco Firepower 9000 Series with the Cisco Firepower 2-port 100G doub… |
CVE-2019-1698 | Medium | 4.9 | 2019-02-21 | A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director (IoT-FND) Software could allow an authenticated, remote atta… |
CVE-2019-1691 | Medium | 5.8 | 2019-02-21 | A vulnerability in the detection engine of Cisco Firepower Threat Defense Software could allow an unauthenticated, remote attacker to cause the unexpected rest… |
CVE-2019-1685 | Medium | 6.1 | 2019-02-21 | A vulnerability in the Security Assertion Markup Language (SAML) single sign-on (SSO) interface of Cisco Unity Connection could allow an unauthenticated, remot… |
CVE-2019-1684 | Medium | 6.5 | 2019-02-21 | A vulnerability in the Cisco Discovery Protocol or Link Layer Discovery Protocol (LLDP) implementation for the Cisco IP Phone 7800 and 8800 Series could allow… |
CVE-2019-1681 | High | 7.5 | 2019-02-21 | A vulnerability in the TFTP service of Cisco Network Convergence System 1000 Series software could allow an unauthenticated, remote attacker to retrieve arbitr… |
CVE-2019-8985 | Critical | 9.8 | 2019-02-21 | On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880), there is a stack-based buffer overflow that does not r… |
CVE-2019-1667 | Low | 3.3 | 2019-02-21 | A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite inte… |
CVE-2019-1666 | Medium | 5.3 | 2019-02-21 | A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service… |
CVE-2019-1665 | Medium | 4.7 | 2019-02-21 | A vulnerability in the web-based management interface of Cisco HyperFlex software could allow an unauthenticated, remote attacker to conduct a cross-site scrip… |
CVE-2019-1664 | High | 7.8 | 2019-02-21 | A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluste… |
CVE-2019-1662 | High | 8.2 | 2019-02-21 | A vulnerability in the Quality of Voice Reporting (QOVR) service of Cisco Prime Collaboration Assurance (PCA) Software could allow an unauthenticated, remote a… |
CVE-2019-8984 | Medium | 6.1 | 2019-02-21 | MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2). |
CVE-2019-8983 | Medium | 6.1 | 2019-02-21 | MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2). |
CVE-2019-1659 | High | 7.4 | 2019-02-21 | A vulnerability in the Identity Services Engine (ISE) integration feature of Cisco Prime Infrastructure (PI) could allow an unauthenticated, remote attacker to… |
CVE-2019-8982 | Critical | 9.6 | 2019-02-21 | com/wavemaker/studio/StudioService.java in WaveMaker Studio 6.6 mishandles the studioService.download?method=getContent&inUrl= value, leading to disclosure of… |
CVE-2019-8980 | High | 7.5 | 2019-02-21 | A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumpti… |
CVE-2019-8979 | Critical | 9.8 | 2019-02-21 | Kohana through 3.3.6 has SQL Injection when the order_by() parameter can be controlled. |
CVE-2019-5727 | Medium | 5.4 | 2019-02-21 | Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6.0.x before 6.0.15… |
CVE-2019-3475 | High | 7.8 | 2019-02-20 | A local privilege escalation vulnerability in the famtd component of Micro Focus Filr 3.0 allows a local attacker authenticated as a low privilege user to esca… |
CVE-2019-3474 | Medium | 6.5 | 2019-02-20 | A path traversal vulnerability in the web application component of Micro Focus Filr 3.x allows a remote attacker authenticated as a low privilege user to downl… |
CVE-2019-1003028 | Medium | 4.3 | 2019-02-20 | A server-side request forgery vulnerability exists in Jenkins JMS Messaging Plugin 1.1.1 and earlier in SSLCertificateAuthenticationMethod.java, UsernameAuthen… |
CVE-2019-1003027 | Medium | 4.3 | 2019-02-20 | A server-side request forgery vulnerability exists in Jenkins OctopusDeploy Plugin 1.8.1 and earlier in OctopusDeployPlugin.java that allows attackers with Ove… |
CVE-2019-1003026 | Medium | 4.3 | 2019-02-20 | A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers… |
CVE-2019-1003025 | High | 8.8 | 2019-02-20 | A exposure of sensitive information vulnerability exists in Jenkins Cloud Foundry Plugin 2.3.1 and earlier in AbstractCloudFoundryPushDescriptor.java that allo… |
CVE-2019-1003024 | High | 8.8 | 2019-02-20 | A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overa… |
CVE-2019-3924 | High | 7.5 | 2019-02-20 | MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined networ… |
CVE-2019-8954 | High | 8.8 | 2019-02-20 | In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter (in conjunction with the id parameter) in a upd_jxcode=true action to the… |
CVE-2019-8953 | Medium | 6.1 | 2019-02-20 | The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_listeners.php and hapr… |
CVE-2019-8331 | Medium | 6.1 | 2019-02-20 | In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. |
CVE-2019-8950 | Critical | 9.8 | 2019-02-20 | The backdoor account dnsekakf2$$ in /bin/login on DASAN H665 devices with firmware 1.46p1-0028 allows an attacker to login to the admin account via TELNET. |
CVE-2019-8948 | Critical | 9.8 | 2019-02-20 | PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow script injection via the user interface, aka PC-15163. |
CVE-2019-8944 | Medium | 6.5 | 2019-02-20 | An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 (and before 2018.10.4 LTS) allows remote authenticated users t… |
CVE-2019-8943 | Medium | 6.5 | 2019-02-20 | WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary… |
CVE-2019-8942 | High | 8.8 | 2019-02-20 | WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, su… |
CVE-2019-7164 | Critical | 9.8 | 2019-02-20 | SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. |
CVE-2019-5783 | High | 8.8 | 2019-02-19 | Missing URI encoding of untrusted input in DevTools in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform a Dangling Markup Injection att… |
CVE-2019-5782 | High | 8.8 | 2019-02-19 | Incorrect optimization assumptions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf… |
CVE-2019-5781 | Medium | 6.5 | 2019-02-19 | Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (… |
CVE-2019-5780 | High | 7.8 | 2019-02-19 | Insufficient restrictions on what can be done with Apple Events in Google Chrome on macOS prior to 72.0.3626.81 allowed a local attacker to execute JavaScript… |
CVE-2019-5779 | Medium | 4.3 | 2019-02-19 | Insufficient policy validation in ServiceWorker in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to bypass navigation restrictions via a crafte… |
CVE-2019-5778 | Medium | 6.5 | 2019-02-19 | A missing case for handling special schemes in permission request checks in Extensions in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced… |
CVE-2019-5777 | Medium | 6.5 | 2019-02-19 | Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (… |
CVE-2019-5776 | Medium | 6.5 | 2019-02-19 | Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (… |
CVE-2019-5775 | Medium | 6.5 | 2019-02-19 | Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (… |
CVE-2019-5774 | High | 8.8 | 2019-02-19 | Omission of the .desktop filetype from the Safe Browsing checklist in SafeBrowsing in Google Chrome on Linux prior to 72.0.3626.81 allowed an attacker who conv… |
CVE-2019-5773 | Medium | 6.5 | 2019-02-19 | Insufficient origin validation in IndexedDB in Google Chrome prior to 72.0.3626.81 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2019-5772 | High | 8.8 | 2019-02-19 | Sharing of objects over calls into JavaScript runtime in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap co… |
CVE-2019-5771 | High | 8.8 | 2019-02-19 | An incorrect JIT of GLSL shaders in SwiftShader in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code via a crafted HTML p… |
CVE-2019-5770 | High | 8.8 | 2019-02-19 | Insufficient input validation in WebGL in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform an out of bounds memory read via a crafted H… |
CVE-2019-5769 | High | 8.8 | 2019-02-19 | Incorrect handling of invalid end character position when front rendering in Blink in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentia… |
CVE-2019-5768 | Medium | 6.5 | 2019-02-19 | DevTools API not correctly gating on extension capability in DevTools in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to instal… |
CVE-2019-5767 | Medium | 6.5 | 2019-02-19 | Insufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0.3626.81 allowed an attacker who convinced the user to install a m… |
CVE-2019-5766 | Medium | 6.5 | 2019-02-19 | Incorrect handling of origin taint checking in Canvas in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2019-5765 | Medium | 5.5 | 2019-02-19 | An exposed debugging endpoint in the browser in Google Chrome on Android prior to 72.0.3626.81 allowed a local attacker to obtain potentially sensitive informa… |
CVE-2019-5764 | High | 8.8 | 2019-02-19 | Incorrect pointer management in WebRTC in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2019-5763 | High | 8.8 | 2019-02-19 | Failure to check error conditions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a crafted H… |
CVE-2019-5762 | High | 8.8 | 2019-02-19 | Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sand… |
CVE-2019-5761 | High | 8.8 | 2019-02-19 | Incorrect object lifecycle management in SwiftShader in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption vi… |
CVE-2019-5760 | High | 8.8 | 2019-02-19 | Insufficient checks of pointer validity in WebRTC in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a… |
CVE-2019-5759 | Critical | 9.6 | 2019-02-19 | Incorrect lifetime handling in HTML select elements in Google Chrome on Android and Mac prior to 72.0.3626.81 allowed a remote attacker to potentially perform… |
CVE-2019-5758 | High | 8.8 | 2019-02-19 | Incorrect object lifecycle management in Blink in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit heap corruption via a cr… |
CVE-2019-5757 | High | 8.8 | 2019-02-19 | An incorrect object type assumption in SVG in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially exploit object corruption via a craf… |
CVE-2019-5756 | High | 8.8 | 2019-02-19 | Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sand… |
CVE-2019-5755 | High | 8.1 | 2019-02-19 | Incorrect handling of negative zero in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform arbitrary read/write via a crafted HTML p… |
CVE-2019-5754 | Medium | 6.5 | 2019-02-19 | Implementation error in QUIC Networking in Google Chrome prior to 72.0.3626.81 allowed an attacker running or able to cause use of a proxy server to obtain cle… |
CVE-2019-8939 | Medium | 6.1 | 2019-02-19 | data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page. |
CVE-2019-8935 | Medium | 5.4 | 2019-02-19 | Collabtive 3.1 allows XSS via the manageuser.php?action=profile id parameter. |
CVE-2019-3812 | Medium | 4.4 | 2019-02-19 | QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A l… |
CVE-2019-8933 | High | 8.8 | 2019-02-19 | In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory (without being blocked by the Web Application Firewall), and then execute this fi… |
CVE-2019-8919 | High | 7.5 | 2019-02-18 | The seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the same Initialization Vector (IV) with Cipher Block Chaining (CB… |
CVE-2019-7629 | Critical | 9.8 | 2019-02-18 | Stack-based buffer overflow in the strip_vt102_codes function in TinTin++ 2.01.6 and WinTin++ 2.01.6 allows remote attackers to execute arbitrary code by sendi… |
CVE-2019-8917 | Critical | 9.8 | 2019-02-18 | SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpB… |
CVE-2019-8912 | High | 7.8 | 2019-02-18 | In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-afte… |
CVE-2019-8911 | Medium | 6.1 | 2019-02-18 | An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box (for the website statistics code). |
CVE-2019-8910 | High | 8.8 | 2019-02-18 | An issue was discovered in WTCMS 1.0. It allows index.php?g=admin&m=setting&a=site_post CSRF. |
CVE-2019-8909 | High | 7.5 | 2019-02-18 | An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service (resource consumption) via crafted dimensions for the verificatio… |
CVE-2019-8908 | Critical | 9.8 | 2019-02-18 | An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting -> Mailbox configuration -> Registratio… |
CVE-2019-8907 | High | 8.8 | 2019-02-18 | do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly… |
CVE-2019-8906 | Medium | 4.4 | 2019-02-18 | do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused. |
CVE-2019-8905 | Medium | 4.4 | 2019-02-18 | do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-103… |
CVE-2019-8904 | High | 8.8 | 2019-02-18 | do_bid_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printf and file_vprintf. |
CVE-2019-0127 | Low | 3.9 | 2019-02-18 | Logic error in the installer for Intel(R) OpenVINO(TM) 2018 R3 and before for Linux may allow a privileged user to potentially enable information disclosure vi… |
CVE-2019-0112 | Medium | 4.4 | 2019-02-18 | Improper flow control in crypto routines for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable a denial o… |
CVE-2019-0111 | Medium | 5.5 | 2019-02-18 | Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosur… |
CVE-2019-0110 | Medium | 5.5 | 2019-02-18 | Insufficient key management for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclos… |
CVE-2019-0109 | High | 7.8 | 2019-02-18 | Improper folder permissions in Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable escalation of privil… |
CVE-2019-0108 | Medium | 5.5 | 2019-02-18 | Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable disclosure of informa… |
CVE-2019-0107 | Medium | 6.7 | 2019-02-18 | Insufficient user prompt in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable escalat… |
CVE-2019-0106 | Medium | 6.7 | 2019-02-18 | Insufficient run protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow a privileged user to potentially enable esca… |
CVE-2019-0105 | High | 7.8 | 2019-02-18 | Insufficient file permissions checking in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow authenticated user to potentially… |
CVE-2019-0104 | Medium | 5.5 | 2019-02-18 | Insufficient file protection in uninstall routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enab… |
CVE-2019-0103 | Medium | 5.5 | 2019-02-18 | Insufficient file protection in install routine for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable… |
CVE-2019-0102 | High | 8.8 | 2019-02-18 | Insufficient session authentication in web server for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an unauthenticated user to potentially en… |
CVE-2019-0101 | Critical | 9.8 | 2019-02-18 | Authentication bypass in the Intel Unite(R) solution versions 3.2 through 3.3 may allow an unauthenticated user to potentially enable escalation of privilege t… |
CVE-2019-8903 | High | 7.5 | 2019-02-18 | index.js in Total.js Platform before 3.2.3 allows path traversal. |