2019 CVEs (page 16)
Page 16 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-18864 | High | 7.5 | 2020-05-07 | /server-info and /server-status in Blaauw Remote Kiln Control through v3.00r4 allow an unauthenticated attacker to gain sensitive information about the host ma… |
CVE-2019-18868 | Critical | 9.8 | 2020-05-07 | Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to access MySQL credentials in cleartext in /engine/db.inc, /lang/nl.bak, or /lan… |
CVE-2019-18867 | High | 7.5 | 2020-05-07 | Browsable directories in Blaauw Remote Kiln Control through v3.00r4 allow an attacker to enumerate sensitive filenames and locations, including source code. Th… |
CVE-2019-18865 | Medium | 5.3 | 2020-05-07 | Information disclosure via error message discrepancies in authentication functions in Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated atta… |
CVE-2019-4266 | Low | 2.4 | 2020-05-06 | IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 does not have device jailbreak detection which could result in an attacker gaining sensitive informa… |
CVE-2019-19169 | High | 7.8 | 2020-05-06 | Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download arbitrary file by setting the arguments… |
CVE-2019-19168 | High | 7.8 | 2020-05-06 | Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download and execute remote arbitrary file by se… |
CVE-2019-19167 | High | 7.8 | 2020-05-06 | Tobesoft Nexacro v2019.9.25.1 and earlier version have an arbitrary code execution vulnerability by using method supported by Nexacro14 ActiveX Control. It all… |
CVE-2019-19166 | High | 7.8 | 2020-05-06 | Tobesoft XPlatform v9.1, 9.2.0, 9.2.1 and 9.2.2 have a vulnerability that can load unauthorized DLL files. It allows attacker to cause remote code execution. |
CVE-2019-20768 | Medium | 5.4 | 2020-05-05 | ServiceNow IT Service Management Kingston through Patch 14-1, London through Patch 7, and Madrid before patch 4 allow stored XSS via crafted sysparm_item_guid… |
CVE-2019-19517 | High | 8.8 | 2020-05-05 | Intelbras RF1200 1.1.3 devices allow CSRF to bypass the login.html form, as demonstrated by launching a scrapy process. |
CVE-2019-19515 | Medium | 6.1 | 2020-05-05 | Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in wireless settings. |
CVE-2019-19514 | Medium | 5.4 | 2020-05-05 | Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in basic repeater settings via an SSID. |
CVE-2019-13285 | High | 7.5 | 2020-05-04 | CoSoSys Endpoint Protector 5.1.0.2 allows Host Header Injection. |
CVE-2019-12864 | Medium | 5.5 | 2020-05-04 | SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as d… |
CVE-2019-17557 | Medium | 5.4 | 2020-05-04 | It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the… |
CVE-2019-11823 | High | 8.6 | 2020-05-04 | CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attackers to cause a denial of service (out-o… |
CVE-2019-4209 | Medium | 6.1 | 2020-05-01 | HCL Connections v5.5, v6.0, and v6.5 contains an open redirect vulnerability which could be exploited by an attacker to conduct phishing attacks. |
CVE-2019-12425 | High | 7.5 | 2020-04-30 | Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host |
CVE-2019-0235 | High | 8.8 | 2020-04-30 | Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks. |
CVE-2019-19220 | High | 8.8 | 2020-04-30 | BMC Control-M/Agent 7.0.00.000 allows OS Command Injection (issue 2 of 2). |
CVE-2019-19219 | High | 7.5 | 2020-04-30 | BMC Control-M/Agent 7.0.00.000 allows Arbitrary File Download. |
CVE-2019-19218 | High | 7.5 | 2020-04-30 | BMC Control-M/Agent 7.0.00.000 has Insecure Password Storage. |
CVE-2019-19217 | High | 8.8 | 2020-04-30 | BMC Control-M/Agent 7.0.00.000 allows OS Command Injection. |
CVE-2019-19216 | High | 8.8 | 2020-04-30 | BMC Control-M/Agent 7.0.00.000 has an Insecure File Copy. |
CVE-2019-19215 | High | 8.8 | 2020-04-30 | A buffer overflow vulnerability in BMC Control-M/Agent 7.0.00.000 when the On-Do action destination is Mail and the Control-M/Agent is configured to send the e… |
CVE-2019-5623 | Critical | 9.8 | 2020-04-29 | Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Elements used in a Command ('Comma… |
CVE-2019-5622 | Critical | 9.8 | 2020-04-29 | Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded Credentials. |
CVE-2019-5621 | High | 7.8 | 2020-04-29 | ABBS Software Audio Media Player version 3.1 suffers from an instance of CWE-121: Stack-based Buffer Overflow. |
CVE-2019-5620 | Critical | 9.8 | 2020-04-29 | ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function. |
CVE-2019-5619 | Critical | 9.8 | 2020-04-29 | AASync.com AASync version 2.2.1.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow. |
CVE-2019-5618 | High | 7.8 | 2020-04-29 | A-PDF WAV to MP3 version 1.0.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow. |
CVE-2019-16011 | High | 7.8 | 2020-04-29 | A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with roo… |
CVE-2019-19165 | High | 7.2 | 2020-04-29 | AxECM.cab(ActiveX Control) in Inogard Ebiz4u contains a vulnerability that could allow remote files to be downloaded and executed by setting arguments to the a… |
CVE-2019-4288 | Medium | 4.3 | 2020-04-29 | IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 could disclose highly senstiive user information to an authenticated user with physical access to th… |
CVE-2019-4286 | Medium | 4.3 | 2020-04-29 | IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 could disclose highly senstiive user information to an authenticated user with physical access to th… |
CVE-2019-20781 | High | 7.8 | 2020-04-29 | An issue was discovered in LG Bridge before April 2019 on Windows. DLL Hijacking can occur. |
CVE-2019-16653 | High | 8.8 | 2020-04-29 | An application plugin in Genius Bytes Genius Server (Genius CDDS) 3.2.2 allows remote authenticated users to gain admin privileges. |
CVE-2019-7634 | Medium | 5.4 | 2020-04-29 | SUAP V2 allows XSS during the update of user information. |
CVE-2019-16652 | High | 7.2 | 2020-04-29 | The BPM component in Genius Bytes Genius Server (Genius CDDS) 3.2.2 allows remote authenticated users to execute arbitrary commands. |
CVE-2019-20792 | Medium | 6.8 | 2020-04-29 | OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check. |
CVE-2019-19102 | Medium | 5.5 | 2020-04-29 | A directory traversal vulnerability in SharpZipLib used in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x and 4.2.x allow unauthenticated u… |
CVE-2019-19101 | Medium | 6.5 | 2020-04-29 | A missing secure communication definition and an incomplete TLS validation in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3… |
CVE-2019-19100 | High | 7.5 | 2020-04-29 | A privilege escalation vulnerability in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.5.4SP, <. 4.6.3SP… |
CVE-2019-5614 | Critical | 9.8 | 2020-04-29 | In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASE-p8, incomplete pac… |
CVE-2019-15874 | Critical | 9.8 | 2020-04-29 | In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASE-p8, incomplete pac… |
CVE-2019-15877 | Medium | 5.5 | 2020-04-28 | In FreeBSD 12.1-STABLE before r356606 and 12.1-RELEASE before 12.1-RELEASE-p3, driver specific ioctl command handlers in the ixl network driver failed to check… |
CVE-2019-15876 | Medium | 5.5 | 2020-04-28 | In FreeBSD 12.1-STABLE before r356089, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r356090, and 11.3-RELEASE before 11.3-RELEASE-p7, driver specifi… |
CVE-2019-20791 | Critical | 9.8 | 2020-04-28 | OpenThread before 2019-12-13 has a stack-based buffer overflow in MeshCoP::Commissioner::GeneratePskc. |
CVE-2019-15790 | Low | 2.8 | 2020-04-28 | Apport reads and writes information on a crashed process to /proc/pid with elevated privileges. Apport then determines which user the crashed process belongs t… |
CVE-2019-5303 | Medium | 5.3 | 2020-04-27 | There are two denial of service vulnerabilities on some Huawei smartphones. An attacker may send specially crafted TD-SCDMA messages from a rogue base station… |
CVE-2019-5302 | Medium | 5.3 | 2020-04-27 | There are two denial of service vulnerabilities on some Huawei smartphones. An attacker may send specially crafted TD-SCDMA messages from a rogue base station… |
CVE-2019-15234 | High | 7.5 | 2020-04-27 | SHAREit through 4.0.6.177 does not check the full message length from the received packet header (which is used to allocate memory for the next set of data). T… |
CVE-2019-14941 | High | 7.5 | 2020-04-27 | SHAREit through 4.0.6.177 does not check the body length from the received packet header (which is used to allocate memory for the next set of data). This coul… |
CVE-2019-20002 | High | 7.8 | 2020-04-27 | Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value (provided by a low-privileged user in the Subject field of a help r… |
CVE-2019-18823 | Critical | 9.8 | 2020-04-27 | HTCondor up to and including stable series 8.8.6 and development series 8.9.4 has Incorrect Access Control. It is possible to use a different authentication me… |
CVE-2019-4729 | Medium | 4.3 | 2020-04-27 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the bro… |
CVE-2019-20790 | Critical | 9.8 | 2020-04-27 | OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC authentication in situations where the HELO fie… |
CVE-2019-18223 | Medium | 5.4 | 2020-04-27 | ZOOM International Call Recording 6.3.1 suffers from multiple authenticated stored XSS vulnerabilities via the phoneNumber field in the (1) User Edit or (2) Us… |
CVE-2019-20789 | Medium | 4.8 | 2020-04-26 | Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies. |
CVE-2019-4751 | Medium | 5.3 | 2020-04-24 | IBM Cloud App Management 2019.3.0 and 2019.4.0 reveals a stack trace on certain API requests which can allow an attacker further information about the implemen… |
CVE-2019-4750 | High | 8.8 | 2020-04-24 | IBM Cloud App Management 2019.3.0 and 2019.4.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized… |
CVE-2019-15794 | High | 7.1 | 2020-04-24 | Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file… |
CVE-2019-15793 | Medium | 6.5 | 2020-04-24 | In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group i… |
CVE-2019-15792 | High | 7.1 | 2020-04-24 | In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() calls fdget(oldfd), the… |
CVE-2019-15791 | High | 7.1 | 2020-04-24 | In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() installs an fd referenc… |
CVE-2019-20788 | Critical | 9.8 | 2020-04-23 | libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value… |
CVE-2019-17101 | Medium | 5.7 | 2020-04-23 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in firmware versions prior to x.xx of Netatmo Smart Indoor Ca… |
CVE-2019-9183 | High | 7.5 | 2020-04-23 | An issue was discovered in Contiki-NG through 4.3 and Contiki through 3.0. A buffer overflow is present due to an integer underflow during 6LoWPAN fragment pro… |
CVE-2019-8359 | Critical | 9.8 | 2020-04-23 | An issue was discovered in Contiki-NG through 4.3 and Contiki through 3.0. An out of bounds write is present in the data section during 6LoWPAN fragment re-ass… |
CVE-2019-4735 | Medium | 4.6 | 2020-04-23 | IBM MaaS360 3.96.62 for iOS could allow an attacker with physical access to the device to obtain sensitive information from the agent outside of the container… |
CVE-2019-4668 | Medium | 5.5 | 2020-04-23 | IBM UrbanCode Deploy (UCD) 7.0.4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171250. |
CVE-2019-6859 | High | 7.5 | 2020-04-22 | A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions of the following CPUs and Communication Module product refere… |
CVE-2019-20787 | Critical | 9.8 | 2020-04-22 | Teeworlds before 0.7.4 has an integer overflow when computing a tilemap size. |
CVE-2019-19107 | Medium | 6.2 | 2020-04-22 | The Configuration pages in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway for user profiles and services transfer the password in plai… |
CVE-2019-19106 | Critical | 9.1 | 2020-04-22 | Improper implementation of Access Control in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway allows an unauthorized user to access data… |
CVE-2019-19105 | Medium | 6.2 | 2020-04-22 | The backup function in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway saves the current settings and configuration of the application… |
CVE-2019-19104 | Critical | 9.1 | 2020-04-22 | The web server in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway allows access to different endpoints of the application without authe… |
CVE-2019-20102 | Medium | 6.1 | 2020-04-22 | The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0 through version 6.14.3, and version 6.15.0 before version 6.15.5 allows rem… |
CVE-2019-4327 | High | 7.5 | 2020-04-21 | "HCL AppScan Enterprise uses hard-coded credentials which can be exploited by attackers to get unauthorized access to application's encrypted files." |
CVE-2019-17525 | High | 8.8 | 2020-04-21 | The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks. |
CVE-2019-8961 | High | 7.5 | 2020-04-21 | A Denial of Service vulnerability related to stack exhaustion has been identified in FlexNet Publisher lmadmin.exe 11.16.2. Because the message reading functio… |
CVE-2019-8960 | High | 7.5 | 2020-04-21 | A Denial of Service vulnerability related to command handling has been identified in FlexNet Publisher lmadmin.exe version 11.16.2. The message reading functio… |
CVE-2019-19108 | Critical | 9.4 | 2020-04-20 | An authentication weakness in the SNMP service in B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthent… |
CVE-2019-20786 | Critical | 9.8 | 2020-04-19 | handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary un… |
CVE-2019-2056 | Medium | 5.5 | 2020-04-17 | There is a possible disclosure of RAM using a shared crypto key due to improperly used crypto. This could lead to local information disclosure with no addition… |
CVE-2019-6203 | Critical | 9.8 | 2020-04-17 | A logic issue was addressed with improved state management. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2. An attacker in a privileged netwo… |
CVE-2019-4749 | Medium | 5.4 | 2020-04-17 | IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus al… |
CVE-2019-4644 | Medium | 6.1 | 2020-04-17 | IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus al… |
CVE-2019-4446 | Medium | 5.4 | 2020-04-17 | IBM Maximo Asset Management 7.6 could allow an authenticated user perform actions they are not authorized to by modifying request parameters. IBM X-Force ID: 1… |
CVE-2019-20785 | Medium | 6.8 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 8.0 and 8.1 software for the DTAG carrier. RILD in the radio layer uses an uninitialized variable… |
CVE-2019-20784 | Medium | 5.5 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 (MTK chipsets) software. Interaction of GPS with 911 emergency calls i… |
CVE-2019-20783 | Critical | 9.1 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 (North America CDMA) software. The LTE protocol implementation allows… |
CVE-2019-20782 | Critical | 9.8 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. LG Advanced Flash (LAF) has a buffer overflow. The LG ID is… |
CVE-2019-20780 | Critical | 9.8 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. Certain security settings, related to whether packages are v… |
CVE-2019-20779 | Medium | 5.5 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. A TrustZone trusted application can crash via crafted i… |
CVE-2019-20778 | Critical | 9.8 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. The Backup subsystem does not properly restrict operati… |
CVE-2019-20777 | Critical | 9.8 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. WapService mishandles OTA Provisioning on V40 and G7 de… |
CVE-2019-20776 | Medium | 5.5 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. A TZ trusted application can crash via crafted input. The LG… |
CVE-2019-20775 | Medium | 5.5 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 9.0 (Qualcomm SDM450, SDM845, SM6150, and SM8150 chipsets) software. Weak encryption leads to loca… |