2019 CVEs (page 158)
Page 158 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1652 | High | 7.2 | 2019-01-24 | A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote… |
CVE-2019-1651 | Critical | 9.9 | 2019-01-24 | A vulnerability in the vContainer of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to cause a denial of service (DoS) condition and e… |
CVE-2019-1650 | High | 8.8 | 2019-01-24 | A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of a… |
CVE-2019-1648 | High | 7.8 | 2019-01-24 | A vulnerability in the user group configuration of the Cisco SD-WAN Solution could allow an authenticated, local attacker to gain elevated privileges on an aff… |
CVE-2019-1647 | High | 8.0 | 2019-01-24 | A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, adjacent attacker to bypass authentication and have direct unauthorized access to ot… |
CVE-2019-1646 | High | 7.8 | 2019-01-24 | A vulnerability in the local CLI of the Cisco SD-WAN Solution could allow an authenticated, local attacker to escalate privileges and modify device configurati… |
CVE-2019-1645 | Medium | 4.3 | 2019-01-24 | A vulnerability in the Cisco Connected Mobile Experiences (CMX) software could allow an unauthenticated, adjacent attacker to access sensitive data on an affec… |
CVE-2019-6486 | High | 8.2 | 2019-01-24 | Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or… |
CVE-2019-1644 | High | 7.5 | 2019-01-23 | A vulnerability in the UDP protocol implementation for Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to exhaust sy… |
CVE-2019-1643 | Medium | 6.1 | 2019-01-23 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scr… |
CVE-2019-1642 | Medium | 6.1 | 2019-01-23 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote attacker to co… |
CVE-2019-1641 | High | 7.8 | 2019-01-23 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2019-1640 | High | 7.8 | 2019-01-23 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2019-1639 | High | 7.8 | 2019-01-23 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2019-1638 | High | 7.8 | 2019-01-23 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2019-1637 | High | 7.8 | 2019-01-23 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2019-6719 | High | 7.5 | 2019-01-23 | An issue has been found in libIEC61850 v1.3.1. There is a use-after-free in the getState function in mms/iso_server/iso_server.c, as demonstrated by examples/s… |
CVE-2019-1636 | High | 7.8 | 2019-01-23 | A vulnerability in the Cisco Webex Teams client, formerly Cisco Spark, could allow an attacker to execute arbitrary commands on a targeted system. This vulnera… |
CVE-2019-6713 | Critical | 9.8 | 2019-01-23 | app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving portal/List/in… |
CVE-2019-6708 | High | 7.2 | 2019-01-23 | PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter. |
CVE-2019-6707 | High | 7.2 | 2019-01-23 | PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state product_id[] parameter. |
CVE-2019-6706 | High | 7.5 | 2019-01-23 | Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upval… |
CVE-2019-3587 | High | 7.2 | 2019-01-23 | DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Prior to 16.0.18 allows local users to execute arbitrary… |
CVE-2019-3584 | High | 7.4 | 2019-01-23 | Exploitation of Authentication vulnerability in MVision Endpoint in McAfee MVision Endpoint Prior to 1811 Update 1 (18.11.31.62) allows authenticated administr… |
CVE-2019-6691 | High | 7.2 | 2019-01-23 | phpwind 9.0.2.170426 UTF8 allows SQL Injection via the admin.php?m=backup&c=backup&a=doback tabledb[] parameter, related to the "--backup database" option. |
CVE-2019-6260 | Critical | 9.8 | 2019-01-22 | The ASPEED ast2400 and ast2500 Baseband Management Controller (BMC) hardware and firmware implement Advanced High-performance Bus (AHB) bridges, which allow ar… |
CVE-2019-6510 | High | 8.8 | 2019-01-22 | An issue was discovered in creditease-sec insight through 2018-09-11. user_delete in srcpm/app/admin/views.py allows CSRF. |
CVE-2019-6509 | High | 8.8 | 2019-01-22 | An issue was discovered in creditease-sec insight through 2018-09-11. depart_delete in srcpm/app/admin/views.py allows CSRF. |
CVE-2019-6508 | High | 8.8 | 2019-01-22 | An issue was discovered in creditease-sec insight through 2018-09-11. role_perm_delete in srcpm/app/admin/views.py allows CSRF. |
CVE-2019-6507 | High | 8.8 | 2019-01-22 | An issue was discovered in creditease-sec insight through 2018-09-11. login_user_delete in srcpm/app/admin/views.py allows CSRF. |
CVE-2019-6339 | Critical | 9.8 | 2019-01-22 | In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar s… |
CVE-2019-6503 | Critical | 9.8 | 2019-01-22 | There is a deserialization vulnerability in Chatopera cosin v3.10.0. An attacker can execute commands during server-side deserialization by uploading malicious… |
CVE-2019-6338 | High | 8.0 | 2019-01-22 | In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This libra… |
CVE-2019-1003004 | High | 7.2 | 2019-01-22 | An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProces… |
CVE-2019-1003003 | High | 7.2 | 2019-01-22 | An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMe… |
CVE-2019-1003002 | High | 8.8 | 2019-01-22 | A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipe… |
CVE-2019-1003001 | High | 8.8 | 2019-01-22 | A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, s… |
CVE-2019-1003000 | High | 8.8 | 2019-01-22 | A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySan… |
CVE-2019-6502 | High | 7.5 | 2019-01-22 | sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv. |
CVE-2019-6500 | High | 7.5 | 2019-01-21 | In Axway File Transfer Direct 2.7.1, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request with… |
CVE-2019-6499 | High | 8.1 | 2019-01-21 | Teradata Viewpoint before 14.0 and 16.20.00.02-b80 contains a hardcoded password of TDv1i2e3w4 for the viewpoint database account (in viewpoint-portal\conf\ser… |
CVE-2019-6498 | High | 8.8 | 2019-01-21 | GattLib 0.2 has a stack-based buffer over-read in gattlib_connect in dbus/gattlib.c because strncpy is misused. |
CVE-2019-6497 | Critical | 9.8 | 2019-01-20 | Hotels_Server through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter. |
CVE-2019-6496 | High | 8.8 | 2019-01-20 | The ThreadX-based firmware on Marvell Avastar Wi-Fi devices, models 88W8787, 88W8797, 88W8801, 88W8897, and 88W8997, allows remote attackers to execute arbitra… |
CVE-2019-3774 | Critical | 9.8 | 2019-01-18 | Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from… |
CVE-2019-3773 | Critical | 9.8 | 2019-01-18 | Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when… |
CVE-2019-3772 | Critical | 9.8 | 2019-01-18 | Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible… |
CVE-2019-6488 | High | 7.8 | 2019-01-18 | The string component in the GNU C Library (aka glibc or libc6) through 2.28, when running on the x32 architecture, incorrectly attempts to use a 64-bit registe… |
CVE-2019-3910 | Critical | 9.1 | 2019-01-18 | Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can us… |
CVE-2019-3909 | Critical | 9.8 | 2019-01-18 | Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention. |
CVE-2019-3908 | High | 7.5 | 2019-01-18 | Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An attacker with access… |
CVE-2019-3907 | High | 7.5 | 2019-01-18 | Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of a salt and passwor… |
CVE-2019-3906 | High | 8.8 | 2019-01-18 | Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use these credentials… |
CVE-2019-6487 | High | 8.8 | 2019-01-18 | TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, beca… |
CVE-2019-0647 | Medium | 6.5 | 2019-01-17 | An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Inf… |
CVE-2019-0646 | Medium | 5.4 | 2019-01-17 | A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross… |
CVE-2019-0624 | Medium | 5.4 | 2019-01-17 | A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 Spoo… |
CVE-2019-2556 | Medium | 6.5 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2555 | Medium | 6.5 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2554 | Medium | 6.5 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2553 | Low | 3.8 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2552 | High | 8.8 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2550 | Medium | 4.3 | 2019-01-16 | Vulnerability in the Oracle FLEXCUBE Direct Banking component of Oracle Financial Services Applications (subcomponent: Logoff Page). The supported version that… |
CVE-2019-2549 | Medium | 6.1 | 2019-01-16 | Vulnerability in the Oracle FLEXCUBE Direct Banking component of Oracle Financial Services Applications (subcomponent: Logoff Page). The supported version that… |
CVE-2019-2548 | High | 7.8 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2547 | Low | 3.5 | 2019-01-16 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18c. Easily exploit… |
CVE-2019-2546 | Medium | 4.3 | 2019-01-16 | Vulnerability in the Oracle Applications Manager component of Oracle E-Business Suite (subcomponent: SQL Extensions). Supported versions that are affected are… |
CVE-2019-2545 | Medium | 4.0 | 2019-01-16 | Vulnerability in the Oracle Solaris component of Oracle Sun Systems Products Suite (subcomponent: LDoms IO). Supported versions that are affected are 10 and 11… |
CVE-2019-2544 | Medium | 4.0 | 2019-01-16 | Vulnerability in the Oracle Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11… |
CVE-2019-2543 | Medium | 5.3 | 2019-01-16 | Vulnerability in the Oracle Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions that are affected are 10 and 11… |
CVE-2019-2541 | High | 7.5 | 2019-01-16 | Vulnerability in the Oracle Solaris component of Oracle Sun Systems Products Suite (subcomponent: DHCP Client). The supported version that is affected is 10. D… |
CVE-2019-2540 | Medium | 6.1 | 2019-01-16 | Vulnerability in the Java Advanced Management Console component of Oracle Java SE (subcomponent: Server). The supported version that is affected is Java Advanc… |
CVE-2019-2539 | Medium | 4.9 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Connection). Supported versions that are affected are 8.0.13 and prior. Easi… |
CVE-2019-2538 | High | 7.1 | 2019-01-16 | Vulnerability in the Oracle Managed File Transfer component of Oracle Fusion Middleware (subcomponent: MFT Runtime Server). Supported versions that are affecte… |
CVE-2019-2537 | Medium | 4.9 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.6.42 and prior, 5.7.24 and… |
CVE-2019-2536 | Medium | 5.0 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 8.0.13 and prior. Diffi… |
CVE-2019-2535 | Medium | 4.1 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Options). Supported versions that are affected are 8.0.13 and prior. Difficu… |
CVE-2019-2534 | High | 7.1 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.42 and prior, 5.7… |
CVE-2019-2533 | Medium | 6.5 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Privileges). Supported versions that are affected are 8.0.13 and… |
CVE-2019-2532 | Medium | 4.9 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.7.24 and p… |
CVE-2019-2531 | Medium | 4.9 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.42 and prior, 5.7… |
CVE-2019-2530 | Medium | 4.9 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.13 and prior. Easil… |
CVE-2019-2529 | Medium | 6.5 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.6.42 and prior, 5.7.2… |
CVE-2019-2528 | Medium | 4.9 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Partition). Supported versions that are affected are 5.7.24 and prior and 8… |
CVE-2019-2527 | Medium | 6.5 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.26 and… |
CVE-2019-2526 | High | 7.8 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2525 | Medium | 5.6 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2524 | High | 8.8 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2523 | High | 7.8 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2522 | High | 7.8 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2521 | High | 7.8 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2520 | High | 7.8 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2519 | Medium | 6.1 | 2019-01-16 | Vulnerability in the PeopleSoft Enterprise SCM eProcurement component of Oracle PeopleSoft Products (subcomponent: Manage Requisition Status). The supported ve… |
CVE-2019-2513 | Low | 2.5 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Shell). Supported versions that are affected are 8.0.13 and prior. Difficult to expl… |
CVE-2019-2512 | Medium | 4.7 | 2019-01-16 | Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Construction and Engineering Suite (subcomponent: Web Access). Su… |
CVE-2019-2511 | High | 7.5 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2510 | Medium | 4.9 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.24 and prior and 8.0.13 and pr… |
CVE-2019-2509 | Medium | 6.5 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2508 | Medium | 6.5 | 2019-01-16 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are prior to 5.2.24 and… |
CVE-2019-2507 | Medium | 4.9 | 2019-01-16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.6.42 and prior, 5.7.2… |