2019 CVEs (page 161)
Page 161 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-5886 | Critical | 9.8 | 2019-01-10 | An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lock file in the Add method, which allows… |
CVE-2019-5884 | Medium | 5.9 | 2019-01-10 | php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set. |
CVE-2019-5882 | Critical | 9.8 | 2019-01-09 | Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer. |
CVE-2019-3498 | Medium | 6.5 | 2019-01-09 | In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Com… |
CVE-2019-5748 | Critical | 9.8 | 2019-01-09 | In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks. |
CVE-2019-5747 | High | 7.5 | 2019-01-09 | An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a… |
CVE-2019-0542 | High | 8.8 | 2019-01-09 | A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." Thi… |
CVE-2019-3581 | High | 7.5 | 2019-01-09 | Improper input validation in the proxy component of McAfee Web Gateway 7.8.2.0 and later allows remote attackers to cause a denial of service via a crafted HTT… |
CVE-2019-5725 | High | 7.5 | 2019-01-08 | qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web s… |
CVE-2019-5721 | Medium | 5.5 | 2019-01-08 | In Wireshark 2.4.0 to 2.4.11, the ENIP dissector could crash. This was addressed in epan/dissectors/packet-enip.c by changing the memory-management approach so… |
CVE-2019-5719 | Medium | 5.5 | 2019-01-08 | In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the ISAKMP dissector could crash. This was addressed in epan/dissectors/packet-isakmp.c by properly handling t… |
CVE-2019-5718 | Medium | 5.5 | 2019-01-08 | In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the RTSE dissector and other ASN.1 dissectors could crash. This was addressed in epan/charsets.c by adding a g… |
CVE-2019-5717 | Medium | 5.5 | 2019-01-08 | In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the P_MUL dissector could crash. This was addressed in epan/dissectors/packet-p_mul.c by rejecting the invalid… |
CVE-2019-5716 | Medium | 5.5 | 2019-01-08 | In Wireshark 2.6.0 to 2.6.5, the 6LoWPAN dissector could crash. This was addressed in epan/dissectors/packet-6lowpan.c by avoiding use of a TVB before its crea… |
CVE-2019-0622 | Medium | 4.6 | 2019-01-08 | An elevation of privilege vulnerability exists when Skype for Andriod fails to properly handle specific authentication requests, aka "Skype for Android Elevati… |
CVE-2019-0588 | Medium | 6.5 | 2019-01-08 | An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka… |
CVE-2019-0586 | Critical | 9.8 | 2019-01-08 | A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchan… |
CVE-2019-0585 | High | 8.8 | 2019-01-08 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft Word Remote Code Exe… |
CVE-2019-0584 | High | 7.8 | 2019-01-08 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex… |
CVE-2019-0583 | High | 7.8 | 2019-01-08 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex… |
CVE-2019-0582 | High | 7.8 | 2019-01-08 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex… |
CVE-2019-0581 | High | 7.8 | 2019-01-08 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex… |
CVE-2019-0580 | High | 7.8 | 2019-01-08 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex… |
CVE-2019-0579 | High | 7.8 | 2019-01-08 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex… |
CVE-2019-0578 | High | 7.8 | 2019-01-08 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex… |
CVE-2019-0577 | High | 7.8 | 2019-01-08 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex… |
CVE-2019-0576 | High | 7.8 | 2019-01-08 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex… |
CVE-2019-0575 | High | 7.8 | 2019-01-08 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex… |
CVE-2019-0574 | High | 7.8 | 2019-01-08 | An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elev… |
CVE-2019-0573 | High | 7.8 | 2019-01-08 | An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elev… |
CVE-2019-0572 | High | 7.8 | 2019-01-08 | An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elev… |
CVE-2019-0571 | High | 7.8 | 2019-01-08 | An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elev… |
CVE-2019-0570 | High | 7.8 | 2019-01-08 | An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka "Windows Runtime Elevation of Privilege Vulne… |
CVE-2019-0569 | Medium | 5.5 | 2019-01-08 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2019-0568 | High | 7.5 | 2019-01-08 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2019-0567 | High | 7.5 | 2019-01-08 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2019-0566 | High | 8.8 | 2019-01-08 | An elevation of privilege vulnerability exists in Microsoft Edge Browser Broker COM object, aka "Microsoft Edge Elevation of Privilege Vulnerability." This aff… |
CVE-2019-0565 | High | 7.5 | 2019-01-08 | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T… |
CVE-2019-0564 | High | 7.5 | 2019-01-08 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects AS… |
CVE-2019-0562 | Medium | 5.4 | 2019-01-08 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share… |
CVE-2019-0561 | Medium | 5.5 | 2019-01-08 | An information disclosure vulnerability exists when Microsoft Word macro buttons are used improperly, aka "Microsoft Word Information Disclosure Vulnerability… |
CVE-2019-0560 | Medium | 5.5 | 2019-01-08 | An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka "Microsoft Office Information Disclos… |
CVE-2019-0559 | Medium | 6.5 | 2019-01-08 | An information disclosure vulnerability exists when Microsoft Outlook improperly handles certain types of messages, aka "Microsoft Outlook Information Disclosu… |
CVE-2019-0558 | Medium | 5.4 | 2019-01-08 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2019-0557 | Medium | 5.4 | 2019-01-08 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2019-0556 | Medium | 5.4 | 2019-01-08 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2019-0555 | High | 7.8 | 2019-01-08 | An elevation of privilege vulnerability exists in the Microsoft XmlDocument class that could allow an attacker to escape from the AppContainer sandbox in the b… |
CVE-2019-0554 | Medium | 5.5 | 2019-01-08 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2019-0553 | Medium | 5.5 | 2019-01-08 | An information disclosure vulnerability exists when Windows Subsystem for Linux improperly handles objects in memory, aka "Windows Subsystem for Linux Informat… |
CVE-2019-0552 | High | 8.8 | 2019-01-08 | An elevation of privilege exists in Windows COM Desktop Broker, aka "Windows COM Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Wi… |
CVE-2019-0551 | High | 8.4 | 2019-01-08 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2019-0550 | High | 8.4 | 2019-01-08 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2019-0549 | Medium | 5.5 | 2019-01-08 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2019-0548 | High | 7.5 | 2019-01-08 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects AS… |
CVE-2019-0547 | Critical | 9.8 | 2019-01-08 | A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka "Windows DHCP Clie… |
CVE-2019-0546 | High | 7.8 | 2019-01-08 | A remote code execution vulnerability exists in Visual Studio when the C++ compiler improperly handles specific combinations of C++ constructs, aka "Visual Stu… |
CVE-2019-0545 | High | 7.5 | 2019-01-08 | An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka… |
CVE-2019-0543 | High | 7.8 | 2019-01-08 | An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerabi… |
CVE-2019-0541 | High | 8.8 | 2019-01-08 | A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerabili… |
CVE-2019-0539 | High | 7.5 | 2019-01-08 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2019-0538 | High | 7.8 | 2019-01-08 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Ex… |
CVE-2019-0537 | Medium | 5.5 | 2019-01-08 | An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicious .vscontent file… |
CVE-2019-0536 | Medium | 5.5 | 2019-01-08 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2019-0249 | High | 7.5 | 2019-01-08 | Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwise be restricted. |
CVE-2019-0248 | Medium | 5.9 | 2019-01-08 | Under certain conditions SAP Gateway of ABAP Application Server (fixed in SAP_GWFND 7.5, 7.51, 7.52, 7.53; SAP_BASIS 7.5) allows an attacker to access informat… |
CVE-2019-0247 | Critical | 9.8 | 2019-01-08 | SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the be… |
CVE-2019-0246 | Critical | 9.8 | 2019-01-08 | SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity. |
CVE-2019-0245 | Medium | 5.4 | 2019-01-08 | SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resul… |
CVE-2019-0244 | Medium | 5.4 | 2019-01-08 | SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resul… |
CVE-2019-0243 | High | 8.8 | 2019-01-08 | Under some circumstances, masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform necessary authorization checks for an a… |
CVE-2019-0241 | High | 7.5 | 2019-01-08 | SAP Work and Inventory Manager (Agentry_SDK , before 7.0, 7.1) allows an attacker to prevent legitimate users from accessing a service, either by crashing or f… |
CVE-2019-0240 | High | 7.5 | 2019-01-08 | SAP Business Objects Mobile for Android (before 6.3.5) application allows an attacker to provide malicious input in the form of a SAP BI link, preventing legit… |
CVE-2019-0238 | Medium | 6.1 | 2019-01-08 | SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Script… |
CVE-2019-5720 | Critical | 9.8 | 2019-01-08 | includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability in the reference field that can allow the attacker to grab th… |
CVE-2019-5489 | Medium | 5.5 | 2019-01-07 | The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other process… |
CVE-2019-5488 | High | 7.5 | 2019-01-07 | EARCLINK ESPCMS-P8 has SQL injection in the install_pack/index.php?ac=Member&at=verifyAccount verify_key parameter. install_pack/espcms_public/espcms_db.php ma… |
CVE-2019-5312 | Critical | 9.8 | 2019-01-04 | An issue was discovered in weixin-java-tools v3.3.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file. NOTE: this issue e… |
CVE-2019-5311 | Medium | 6.1 | 2019-01-04 | An issue was discovered in YUNUCMS V1.1.8. app/index/controller/Show.php has an XSS vulnerability via the index.php/index/show/index cw parameter. |
CVE-2019-5310 | Medium | 6.1 | 2019-01-04 | YUNUCMS 1.1.8 has XSS in app/admin/controller/System.php because crafted data can be written to the sys.php file, as demonstrated by site_title in an admin/sys… |
CVE-2019-5009 | High | 7.2 | 2019-01-04 | Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size… |
CVE-2019-5007 | High | 7.1 | 2019-01-03 | An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. It is an Out-of-Bounds Read Information Disclosure and crash due to a NULL pointe… |
CVE-2019-5006 | Medium | 5.5 | 2019-01-03 | An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. It is a NULL pointer dereference during PDF parsing. |
CVE-2019-5005 | Medium | 5.5 | 2019-01-03 | An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. They allowed Denial of Service (application crash) via image data, because two by… |
CVE-2019-3905 | Critical | 10.0 | 2019-01-03 | Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF. |
CVE-2019-3575 | High | 7.8 | 2019-01-03 | Sqla_yaml_fixtures 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in sqla_yaml_fixtures.load. |
CVE-2019-3701 | Medium | 4.4 | 2019-01-03 | An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN frame modification rules allow bitwise logical operation… |
CVE-2019-3580 | High | 7.5 | 2019-01-03 | OpenRefine through 3.1 allows arbitrary file write because Directory Traversal can occur during the import of a crafted project file. |
CVE-2019-3577 | Critical | 9.8 | 2019-01-02 | An issue was discovered in Waimai Super Cms 20150505. web/Lib/Action/ProductAction.class.php allows blind SQL Injection via the id[0] parameter to the /product… |
CVE-2019-3576 | Critical | 9.8 | 2019-01-02 | inxedu through 2018-12-24 has a SQL Injection vulnerability that can lead to information disclosure via the deleteFaveorite/ PATH_INFO. The vulnerable code loc… |
CVE-2019-3574 | High | 7.8 | 2019-01-02 | In libsixel v1.8.2, there is a heap-based buffer over-read in the function load_jpeg() in the file loader.c, as demonstrated by img2sixel. |
CVE-2019-3573 | Medium | 5.5 | 2019-01-02 | In libsixel v1.8.2, there is an infinite loop in the function sixel_decode_raw_impl() in the file fromsixel.c, as demonstrated by sixel2png. |
CVE-2019-3572 | Medium | 6.5 | 2019-01-02 | An issue was discovered in libming 0.4.8. There is a heap-based buffer over-read in the function writePNG in the file util/dbl2png.c of the dbl2png command-lin… |
CVE-2019-3501 | Medium | 4.8 | 2019-01-02 | The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profile. |
CVE-2019-3500 | High | 7.8 | 2019-01-02 | aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sen… |
CVE-2019-3494 | High | 7.5 | 2019-01-01 | Simply-Blog through 2019-01-01 has SQL Injection via the admin/deleteCategories.php delete parameter. |