2019 CVEs (page 156)
Page 156 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-7547 | Medium | 4.8 | 2019-02-06 | An issue was discovered in SIDU 6.0. Because the database name is not strictly filtered, the attacker can insert a name containing an XSS Payload, leading to s… |
CVE-2019-7546 | Medium | 6.1 | 2019-02-06 | An issue was discovered in SIDU 6.0. The dbs parameter of the conn.php page has a reflected Cross-site Scripting (XSS) vulnerability. |
CVE-2019-7545 | Medium | 5.4 | 2019-02-06 | In DbNinja 3.2.7, the Add Host function of the Manage Hosts pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name field. |
CVE-2019-7544 | Medium | 5.4 | 2019-02-06 | An issue was discovered in MyWebSQL 3.7. The Add User function of the User Manager pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name… |
CVE-2019-7543 | Medium | 6.1 | 2019-02-06 | In KindEditor 4.1.11, the php/demo.php content1 parameter has a reflected Cross-site Scripting (XSS) vulnerability. |
CVE-2019-6517 | Medium | 6.8 | 2019-02-06 | BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S. and Malaysian Releases, between November 2017 and November 2018 and BD FACSLyric… |
CVE-2019-3825 | Medium | 6.3 | 2019-02-06 | A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen by selecting the ti… |
CVE-2019-3823 | Medium | 4.3 | 2019-02-06 | libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer pass… |
CVE-2019-3822 | Critical | 9.8 | 2019-02-06 | libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth… |
CVE-2019-3820 | Medium | 4.3 | 2019-02-06 | It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to… |
CVE-2019-3464 | Critical | 9.8 | 2019-02-06 | Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users t… |
CVE-2019-3463 | Critical | 9.8 | 2019-02-06 | Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform on… |
CVE-2019-1003023 | Medium | 6.1 | 2019-02-06 | A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins/analysis/core/mode… |
CVE-2019-1003022 | Medium | 6.5 | 2019-02-06 | A denial of service vulnerability exists in Jenkins Monitoring Plugin 1.74.0 and earlier in PluginImpl.java that allows attackers to kill threads running on th… |
CVE-2019-1003021 | Medium | 4.3 | 2019-02-06 | An exposure of sensitive information vulnerability exists in Jenkins OpenId Connect Authentication Plugin 1.4 and earlier in OicSecurityRealm/config.jelly that… |
CVE-2019-1003020 | Medium | 4.3 | 2019-02-06 | A server-side request forgery vulnerability exists in Jenkins Kanboard Plugin 1.5.10 and earlier in KanboardGlobalConfiguration.java that allows attackers with… |
CVE-2019-1003019 | Medium | 5.9 | 2019-02-06 | An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attacker… |
CVE-2019-1003018 | Medium | 4.3 | 2019-02-06 | An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/config.jelly that all… |
CVE-2019-1003017 | Medium | 5.3 | 2019-02-06 | A data modification vulnerability exists in Jenkins Job Import Plugin 3.0 and earlier in JobImportAction.java that allows attackers to copy jobs from a preconf… |
CVE-2019-1003016 | High | 8.8 | 2019-02-06 | An exposure of sensitive information vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/JobImp… |
CVE-2019-1003015 | Critical | 9.1 | 2019-02-06 | An XML external entity processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/Re… |
CVE-2019-1003014 | Medium | 4.8 | 2019-02-06 | An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly t… |
CVE-2019-1003013 | Medium | 5.4 | 2019-02-06 | An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/s… |
CVE-2019-1003012 | Medium | 6.5 | 2019-02-06 | A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/j… |
CVE-2019-1003011 | High | 8.1 | 2019-02-06 | An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenma… |
CVE-2019-1003010 | Medium | 4.3 | 2019-02-06 | A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows att… |
CVE-2019-1003009 | High | 7.4 | 2019-02-06 | An improper certificate validation vulnerability exists in Jenkins Active Directory Plugin 2.10 and earlier in src/main/java/hudson/plugins/active_directory/Ac… |
CVE-2019-1003008 | High | 8.8 | 2019-02-06 | A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/plugins/analysis/war… |
CVE-2019-1003007 | High | 8.8 | 2019-02-06 | A cross-site request forgery vulnerability exists in Jenkins Warnings Plugin 5.0.0 and earlier in src/main/java/hudson/plugins/warnings/GroovyParser.java that… |
CVE-2019-1003006 | High | 8.8 | 2019-02-06 | A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attac… |
CVE-2019-1003005 | High | 8.8 | 2019-02-06 | A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/S… |
CVE-2019-6504 | Medium | 6.1 | 2019-02-06 | Insufficient output sanitization in the Automic Web Interface (AWI), in CA Automic Workload Automation 12.0 to 12.2, allow attackers to potentially conduct per… |
CVE-2019-6523 | Critical | 9.8 | 2019-02-05 | WebAccess/SCADA, Version 8.3. The software does not properly sanitize its inputs for SQL commands. |
CVE-2019-6521 | High | 8.6 | 2019-02-05 | WebAccess/SCADA, Version 8.3. Specially crafted requests could allow a possible authentication bypass that could allow an attacker to obtain and manipulate sen… |
CVE-2019-6519 | Critical | 9.8 | 2019-02-05 | WebAccess/SCADA, Version 8.3. An improper authentication vulnerability exists that could allow a possible authentication bypass allowing an attacker to upload… |
CVE-2019-6590 | Medium | 5.9 | 2019-02-05 | On BIG-IP LTM 13.0.0 to 13.0.1 and 12.1.0 to 12.1.3.6, under certain conditions, the TMM may consume excessive resources when processing SSL Session ID Persist… |
CVE-2019-6535 | High | 7.5 | 2019-02-05 | Mitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU, Q04/06/10/13/20/26… |
CVE-2019-7413 | Medium | 6.1 | 2019-02-05 | In the Parallax Scroll (aka adamrob-parallax-scroll) plugin before 2.1 for WordPress, includes/adamrob-parralax-shortcode.php allows XSS via the title text. ("… |
CVE-2019-7412 | Critical | 9.8 | 2019-02-05 | The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values. |
CVE-2019-6591 | Medium | 5.4 | 2019-02-05 | On BIG-IP APM 14.0.0 to 14.0.0.4, 13.0.0 to 13.1.1.3 and 12.1.0 to 12.1.3.7, a reflected cross-site scripting (XSS) vulnerability exists in the resource inform… |
CVE-2019-3818 | High | 7.5 | 2019-02-05 | The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowing for use of insec… |
CVE-2019-7403 | Medium | 4.9 | 2019-02-05 | An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/database_backup.php?action=import&dopost=deldir&t… |
CVE-2019-7402 | Medium | 6.1 | 2019-02-05 | An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfg_qqcode parameter. This can be exploited via C… |
CVE-2019-7400 | Medium | 6.1 | 2019-02-05 | Rukovoditel before 2.4.1 allows XSS. |
CVE-2019-7398 | High | 7.5 | 2019-02-05 | In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. |
CVE-2019-7397 | High | 7.5 | 2019-02-05 | In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in WritePDFImage in coders/pdf.c. |
CVE-2019-7396 | High | 7.5 | 2019-02-05 | In ImageMagick before 7.0.8-25, a memory leak exists in ReadSIXELImage in coders/sixel.c. |
CVE-2019-7395 | High | 7.5 | 2019-02-05 | In ImageMagick before 7.0.8-25, a memory leak exists in WritePSDChannel in coders/psd.c. |
CVE-2019-7390 | High | 8.6 | 2019-02-05 | An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to hijack… |
CVE-2019-7389 | High | 7.5 | 2019-02-05 | An issue was discovered in /bin/goahead on D-Link DIR-823G devices with the firmware 1.02B03. There is incorrect access control allowing remote attackers to re… |
CVE-2019-7388 | High | 7.5 | 2019-02-05 | An issue was discovered in /bin/goahead on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to get se… |
CVE-2019-7387 | Medium | 6.5 | 2019-02-04 | A local file inclusion vulnerability exists in the web interface of Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. When… |
CVE-2019-4038 | Medium | 6.2 | 2019-02-04 | IBM Security Identity Manager 6.0 and 7.0 could allow an attacker to create unexpected control flow paths through the application, potentially bypassing securi… |
CVE-2019-1000024 | Medium | 6.1 | 2019-02-04 | OPT/NET BV NG-NetMS version v3.6-2 and earlier versions contains a Cross Site Scripting (XSS) vulnerability in /js/libs/jstree/demo/filebrowser/index.php page… |
CVE-2019-1000023 | Critical | 9.8 | 2019-02-04 | OPT/NET BV OPTOSS Next Gen Network Management System (NG-NetMS) version v3.6-2 and earlier versions contains a SQL Injection vulnerability in Identified vulner… |
CVE-2019-1000022 | High | 8.8 | 2019-02-04 | Taoensso Sente version Prior to version 1.14.0 contains a Cross Site Request Forgery (CSRF) vulnerability in WebSocket handshake endpoint that can result in CS… |
CVE-2019-1000021 | High | 7.5 | 2019-02-04 | slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storag… |
CVE-2019-1000020 | Medium | 6.5 | 2019-02-04 | libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('… |
CVE-2019-1000019 | Medium | 6.5 | 2019-02-04 | libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zi… |
CVE-2019-1000018 | High | 7.8 | 2019-02-04 | rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission… |
CVE-2019-1000017 | Medium | 6.5 | 2019-02-04 | Chamilo Chamilo-lms version 1.11.8 and earlier contains an Incorrect Access Control vulnerability in Tickets component that can result in an authenticated user… |
CVE-2019-1000016 | Medium | 6.5 | 2019-02-04 | FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service. This atta… |
CVE-2019-1000015 | Medium | 6.1 | 2019-02-04 | Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data… |
CVE-2019-1000014 | High | 8.8 | 2019-02-04 | Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications… |
CVE-2019-1000013 | High | 8.8 | 2019-02-04 | Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modi… |
CVE-2019-1000012 | High | 8.8 | 2019-02-04 | Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modificat… |
CVE-2019-1000011 | Medium | 6.5 | 2019-02-04 | API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to… |
CVE-2019-1000010 | Medium | 6.1 | 2019-02-04 | phpIPAM version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in subnet-scan-telnet.php that can result in executing code in victims br… |
CVE-2019-1000009 | Medium | 6.5 | 2019-02-04 | Helm ChartMuseum version >=0.1.0 and < 0.8.1 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in… |
CVE-2019-1000008 | Medium | 6.5 | 2019-02-04 | All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulner… |
CVE-2019-1000007 | High | 7.4 | 2019-02-04 | aioxmpp version 0.10.2 and earlier contains a Improper Handling of Structural Elements vulnerability in Stanza Parser, rollback during error processing, aioxmp… |
CVE-2019-1000006 | Critical | 9.8 | 2019-02-04 | RIOT RIOT-OS version after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3 contains a Buffer Overflow vulnerability in sock_dns, an implementation of the DNS p… |
CVE-2019-1000005 | High | 8.8 | 2019-02-04 | mPDF version 7.1.7 and earlier contains a CWE-502: Deserialization of Untrusted Data vulnerability in getImage() method of Image/ImageProcessor class that can… |
CVE-2019-1000004 | Medium | 6.1 | 2019-02-04 | yugandhargangu JspMyAdmin2 version 1.0.6 and earlier contains a Cross Site Scripting (XSS) vulnerability in sidebar and table data that can result in Database… |
CVE-2019-1000003 | High | 8.8 | 2019-02-04 | MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvg_save that c… |
CVE-2019-1000002 | Medium | 6.5 | 2019-02-04 | Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting f… |
CVE-2019-1000001 | Critical | 9.8 | 2019-02-04 | TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared… |
CVE-2019-7352 | Medium | 6.1 | 2019-02-04 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'state' (aka Run State) (state.php) does no input validation to the v… |
CVE-2019-7351 | Medium | 6.5 | 2019-02-04 | Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom L… |
CVE-2019-7350 | High | 7.3 | 2019-02-04 | Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victi… |
CVE-2019-7349 | Medium | 6.1 | 2019-02-04 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitor[… |
CVE-2019-7348 | Medium | 6.1 | 2019-02-04 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'usernam… |
CVE-2019-7347 | High | 7.5 | 2019-02-04 | A Time-of-check Time-of-use (TOCTOU) Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deleti… |
CVE-2019-7346 | High | 8.8 | 2019-02-04 | A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback function is called displaying a "Try again" button, which all… |
CVE-2019-7345 | Medium | 4.8 | 2019-02-04 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view 'options' (options.php) does no input validation for the WEB_TITLE, H… |
CVE-2019-7344 | Medium | 6.1 | 2019-02-04 | Reflected XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'filter' as it insecurely prints the 'fi… |
CVE-2019-7343 | Medium | 6.1 | 2019-02-04 | Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonito… |
CVE-2019-7342 | Medium | 6.1 | 2019-02-04 | POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filter[AutoExe… |
CVE-2019-7341 | Medium | 6.1 | 2019-02-04 | Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonito… |
CVE-2019-7340 | Medium | 6.1 | 2019-02-04 | POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filter[Query][… |
CVE-2019-7339 | Medium | 6.1 | 2019-02-04 | POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'level' paramet… |
CVE-2019-7338 | Medium | 6.1 | 2019-02-04 | Self - Stored XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'group' as it insecurely prints the… |
CVE-2019-7337 | Medium | 4.8 | 2019-02-04 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value, witho… |
CVE-2019-7336 | Medium | 6.1 | 2019-02-04 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view _monitor_filters.php contains takes in input from the user and saves… |
CVE-2019-7335 | Medium | 6.1 | 2019-02-04 | Self - Stored XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'log' as it insecurely prints the 'L… |
CVE-2019-7334 | Medium | 6.1 | 2019-02-04 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile'… |
CVE-2019-7333 | Medium | 6.1 | 2019-02-04 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile'… |
CVE-2019-7332 | Medium | 6.1 | 2019-02-04 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'eid' (aka E… |
CVE-2019-7331 | Medium | 6.1 | 2019-02-04 | Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 while editing an existing monitor field named "signal check color" (monitor.php)… |
CVE-2019-7330 | Medium | 6.1 | 2019-02-04 | Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'show' param… |