2019 CVEs (page 19)
Page 19 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-19300 | High | 7.5 | 2020-04-14 | A vulnerability has been identified in Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P, K… |
CVE-2019-10939 | Critical | 9.8 | 2020-04-14 | A vulnerability has been identified in TIM 3V-IE (incl. SIPLUS NET variants) (All versions < V2.8), TIM 3V-IE Advanced (incl. SIPLUS NET variants) (All version… |
CVE-2019-14326 | High | 7.8 | 2020-04-14 | An issue was discovered in AndyOS Andy versions up to 46.11.113. By default, it starts telnet and ssh (ports 22 and 23) with root privileges in the emulated An… |
CVE-2019-18822 | High | 8.8 | 2020-04-14 | A privilege escalation vulnerability in ZOOM Call Recording 6.3.1 allows its user account (i.e., the account under which the program runs - by default, the cal… |
CVE-2019-16879 | Critical | 9.8 | 2020-04-14 | The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has a Missing Authentication for Critical Function (CWE-306) vu… |
CVE-2019-11480 | High | 8.4 | 2020-04-14 | The pc-kernel snap build process hardcoded the --allow-insecure-repositories and --allow-unauthenticated apt options when creating the build chroot environment… |
CVE-2019-1866 | Low | 3.1 | 2020-04-13 | Cisco Webex Business Suite before 39.1.0 contains a vulnerability that could allow an unauthenticated, remote attacker to affect the integrity of the applicati… |
CVE-2019-13916 | High | 8.8 | 2020-04-13 | An issue was discovered in Cypress (formerly Broadcom) WICED Studio 6.2 CYW20735B1 and CYW20819A1. As a Bluetooth Low Energy (BLE) packet is received, it is co… |
CVE-2019-7305 | Medium | 5.8 | 2020-04-10 | Information Exposure vulnerability in eXtplorer makes the /usr/ and /etc/extplorer/ system directories world-accessible over HTTP. Introduced in the Makefile p… |
CVE-2019-18376 | Medium | 5.9 | 2020-04-10 | A CSRF token disclosure vulnerability allows a remote attacker, with access to an authenticated Management Center (MC) user's web browser history or a network… |
CVE-2019-18375 | Medium | 6.5 | 2020-04-10 | The ASG and ProxySG management consoles are susceptible to a session hijacking vulnerability. A remote attacker, with access to the appliance management interf… |
CVE-2019-20637 | High | 7.5 | 2020-04-08 | An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handli… |
CVE-2019-4746 | Medium | 5.4 | 2020-04-08 | IBM DOORS Next Generation (DNG/RRC) 6.0.2. 6.0.6, and 6.0.61 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri… |
CVE-2019-4740 | Medium | 5.4 | 2020-04-08 | IBM DOORS Next Generation (DNG/RRC) 6.0.2. 6.0.6, and 6.0.61 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri… |
CVE-2019-4737 | Medium | 5.4 | 2020-04-08 | IBM DOORS Next Generation (DNG/RRC) 6.0.2. 6.0.6, and 6.0.61 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri… |
CVE-2019-4603 | Medium | 4.3 | 2020-04-08 | IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to create keywords through the REST API and have them appear as if they wer… |
CVE-2019-4602 | Medium | 5.4 | 2020-04-08 | IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2019-4601 | Medium | 4.3 | 2020-04-08 | IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to obtain sensitive information from a stack trace that could aid in furthe… |
CVE-2019-20636 | Medium | 6.7 | 2020-04-08 | In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode table, as demonstrated by input_set_keycode, aka CID-cb… |
CVE-2019-15789 | High | 8.8 | 2020-04-08 | Privilege escalation vulnerability in MicroK8s allows a low privilege user with local access to obtain root access to the host by provisioning a privileged con… |
CVE-2019-17657 | High | 7.5 | 2020-04-07 | An Uncontrolled Resource Consumption vulnerability in Fortinet FortiSwitch below 3.6.11, 6.0.6 and 6.2.2, FortiAnalyzer below 6.2.3, FortiManager below 6.2.3 a… |
CVE-2019-13559 | High | 7.8 | 2020-04-07 | GE Mark VIe Controller is shipped with pre-configured hard-coded credentials that may allow root-user access to the controller. A limited application of the af… |
CVE-2019-13554 | High | 8.8 | 2020-04-07 | GE Mark VIe Controller has an unsecured Telnet protocol that may allow a user to create an authenticated session using generic default credentials. GE recommen… |
CVE-2019-4393 | Critical | 9.8 | 2020-04-07 | HCL AppScan Standard is vulnerable to excessive authorization attempts |
CVE-2019-4391 | High | 8.2 | 2020-04-07 | HCL AppScan Standard is vulnerable to XML External Entity Injection (XXE) attack when processing XML data |
CVE-2019-19699 | High | 7.2 | 2020-04-06 | There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, leading to system compr… |
CVE-2019-17231 | Medium | 6.1 | 2020-04-03 | includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues. |
CVE-2019-17230 | Medium | 5.3 | 2020-04-03 | includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes. |
CVE-2019-18905 | Medium | 4.8 | 2020-04-03 | A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows remote a… |
CVE-2019-18904 | Medium | 6.5 | 2020-04-03 | A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance C… |
CVE-2019-19348 | High | 7.0 | 2020-04-02 | An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/apb-base, affecting versions before the following 4.3.5, 4… |
CVE-2019-19346 | High | 7.0 | 2020-04-02 | An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mariadb-apb, affecting versions before the following 4.3.5… |
CVE-2019-19097 | Medium | 5.9 | 2020-04-02 | ABB eSOMS versions 4.0 to 6.0.3 accept connections using medium strength ciphers. If a connection is enabled using such a cipher, an attacker might be able to… |
CVE-2019-19096 | Medium | 6.1 | 2020-04-02 | The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text. If an attacker has file system access, this can po… |
CVE-2019-19095 | Medium | 5.4 | 2020-04-02 | Lack of adequate input/output validation for ABB eSOMS versions 4.0 to 6.0.2 might allow an attacker to attack such as stored cross-site scripting by storing m… |
CVE-2019-19094 | High | 7.6 | 2020-04-02 | Lack of input checks for SQL queries in ABB eSOMS versions 3.9 to 6.0.3 might allow an attacker SQL injection attacks against the backend database. |
CVE-2019-19093 | Medium | 6.5 | 2020-04-02 | eSOMS versions 4.0 to 6.0.3 do not enforce password complexity settings, potentially resulting in lower access security due to insecure user passwords. |
CVE-2019-19092 | Low | 3.5 | 2020-04-02 | ABB eSOMS versions 4.0 to 6.0.3 use ASP.NET Viewstate without Message Authentication Code (MAC). Alterations to Viewstate might thus not be noticed. |
CVE-2019-19091 | Medium | 4.3 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.3, HTTPS responses contain comments with sensitive information about the application. An attacker might use this detail infor… |
CVE-2019-19090 | Low | 3.5 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus… |
CVE-2019-19089 | Medium | 6.1 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted… |
CVE-2019-19003 | Medium | 5.3 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.2, the HTTPOnly flag is not set. This can allow Javascript to access the cookie contents, which in turn might enable Cross Si… |
CVE-2019-19002 | Medium | 6.3 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supportin… |
CVE-2019-19001 | Medium | 6.5 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an… |
CVE-2019-19000 | Medium | 6.5 | 2020-04-02 | For ABB eSOMS 4.0 to 6.0.3, the Cache-Control and Pragma HTTP header(s) have not been properly configured within the application response. This can potentially… |
CVE-2019-14868 | High | 7.4 | 2020-04-02 | In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environm… |
CVE-2019-20635 | Medium | 6.1 | 2020-04-02 | codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields. |
CVE-2019-17564 | Critical | 9.8 | 2020-04-01 | Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to com… |
CVE-2019-9163 | Critical | 9.8 | 2020-04-01 | The connection initiation process in March Networks Command Client before 2.7.2 allows remote attackers to execute arbitrary code via crafted XAML objects. |
CVE-2019-11254 | Medium | 6.5 | 2020-04-01 | The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML p… |
CVE-2019-3945 | High | 7.5 | 2020-04-01 | Web server running on Parrot ANAFI can be crashed due to the SDK command "Common_CurrentDateTime" being sent to control service with larger than expected date… |
CVE-2019-3944 | High | 7.5 | 2020-04-01 | Parrot ANAFI is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-fligh… |
CVE-2019-3942 | High | 7.5 | 2020-04-01 | Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files. An attacker can use this vulnerabilit… |
CVE-2019-13495 | Medium | 5.4 | 2020-03-31 | In firmware version 4.50 of Zyxel XGS2210-52HP, multiple stored cross-site scripting (XSS) issues allows remote authenticated users to inject arbitrary web scr… |
CVE-2019-14905 | Medium | 5.6 | 2020-03-31 | A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy… |
CVE-2019-10180 | Low | 2.4 | 2020-03-31 | A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the… |
CVE-2019-14880 | Critical | 9.1 | 2020-03-31 | A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier. OAuth 2 providers who do not verify users' email… |
CVE-2019-2391 | Medium | 4.2 | 2020-03-31 | Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data di… |
CVE-2019-9509 | Medium | 6.3 | 2020-03-30 | The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to reflected XSS in an HTTP POST parameter. The web application does not neutra… |
CVE-2019-9508 | Medium | 6.3 | 2020-03-30 | The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to stored XSS. A remote attacker authenticated with an administrator account co… |
CVE-2019-9507 | High | 8.3 | 2020-03-30 | The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to command injection because the application incorrectly neutralizes code synta… |
CVE-2019-19913 | Medium | 4.8 | 2020-03-30 | In Intland codeBeamer ALM 9.5 and earlier, there is stored XSS via the Trackers Title parameter. |
CVE-2019-19912 | Medium | 4.8 | 2020-03-30 | In Intland codeBeamer ALM 9.5 and earlier, a cross-site scripting (XSS) vulnerability in the Upload Flash File feature allows authenticated remote attackers to… |
CVE-2019-19606 | Critical | 9.8 | 2020-03-30 | X-Plane before 11.41 has multiple improper path validations that could allow reading and writing files from/to arbitrary paths (or a leak of OS credentials to… |
CVE-2019-19605 | Critical | 9.8 | 2020-03-30 | X-Plane before 11.41 allows Arbitrary Memory Write via crafted network packets, which could cause a denial of service or arbitrary code execution. |
CVE-2019-20634 | Low | 3.7 | 2020-03-30 | An issue was discovered in Proofpoint Email Protection through 2019-09-08. By collecting scores from Proofpoint email headers, it is possible to build a copy-c… |
CVE-2019-17561 | High | 7.5 | 2020-03-30 | The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apac… |
CVE-2019-17560 | Critical | 9.1 | 2020-03-30 | The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downlo… |
CVE-2019-7755 | High | 8.8 | 2020-03-30 | In webERP 4.15, the Import Bank Transactions function fails to sanitize the content of imported MT940 bank statement files, resulting in the execution of arbit… |
CVE-2019-5105 | High | 7.5 | 2020-03-26 | An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS GatewayService. A special… |
CVE-2019-15796 | Medium | 4.7 | 2020-03-26 | Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache… |
CVE-2019-15795 | Medium | 4.7 | 2020-03-26 | python-apt only checks the MD5 sums of downloaded files in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py in version 1.9.0ubuntu1 and… |
CVE-2019-18626 | Medium | 4.3 | 2020-03-25 | Harris Ormed Self Service before 2019.1.4 allows an authenticated user to view W-2 forms belonging to other users via an arbitrary empNo value to the ORMEDMIS/… |
CVE-2019-7630 | High | 7.2 | 2020-03-25 | An issue was discovered in gdrv.sys in Gigabyte APP Center before 19.0227.1. The vulnerable driver exposes a wrmsr instruction via IOCTL 0xC3502580 and does no… |
CVE-2019-7245 | High | 7.2 | 2020-03-25 | An issue was discovered in GPU-Z.sys in TechPowerUp GPU-Z before 2.23.0. The vulnerable driver exposes a wrmsr instruction via an IOCTL and does not properly f… |
CVE-2019-7244 | High | 7.2 | 2020-03-25 | An issue was discovered in kerneld.sys in AIDA64 before 5.99. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x80112084 and does not properly filt… |
CVE-2019-7240 | High | 7.2 | 2020-03-25 | An issue was discovered in WinRing0x64.sys in Moo0 System Monitor 1.83. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x9C402088 and does not pro… |
CVE-2019-20633 | Medium | 5.5 | 2020-03-25 | GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a… |
CVE-2019-19127 | High | 8.1 | 2020-03-25 | An authentication bypass vulnerability is present in the standalone SITS:Vision 9.7.0 component of Tribal SITS in its default configuration, related to unencry… |
CVE-2019-4001 | High | 7.8 | 2020-03-24 | Improper input validation in Druva inSync Client 6.5.0 allows a local, authenticated attacker to execute arbitrary NodeJS code. |
CVE-2019-20625 | Low | 3.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.1) and O(8.x) (Exynos chipsets) software. The ion debugfs driver allows information disclosure. The… |
CVE-2019-20624 | Medium | 5.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. S-Voice leaks keyboard learned words via the lock screen. The Samsung ID is… |
CVE-2019-20623 | Low | 3.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.1), O(8.x), and P(9.0) software. Gallery has uninitialized memory disclosure. The Samsung ID is SVE-… |
CVE-2019-20622 | Critical | 9.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (Exynos chipsets) software. There is a baseband stack overflow. The Samsung I… |
CVE-2019-20621 | Critical | 9.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (Exynos chipsets) software. There is a baseband heap overflow. The Samsung ID… |
CVE-2019-20620 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. The Settings application allows unauthenticated changes. The Samsung IDs are SVE-2019-1… |
CVE-2019-20619 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. Secure Startup leaks keyboard suggested words. The Samsung ID is SVE-2019-13773 (March… |
CVE-2019-20618 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. The Pin Window feature allows unauthenticated unpinning of an app. The Samsung ID is SV… |
CVE-2019-20617 | Medium | 5.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. Secure Folder leaks preview data of recent apps. The Samsung ID is SVE-2018-13764 (Marc… |
CVE-2019-20616 | Medium | 5.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. Gallery leaks a thumbnail of Private Mode content. The Samsung ID is SVE-201… |
CVE-2019-20615 | Medium | 4.6 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. Attackers can bypass Factory Reset Protection (FRP) via SVoice T&C. The Sams… |
CVE-2019-20614 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. Allshare allows attackers to access sensitive information. The Sams… |
CVE-2019-20613 | High | 8.1 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. There is time-based SQL injection in Contacts. The Samsung ID is SVE-2018-13… |
CVE-2019-20612 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) (Broadcom Wi-Fi, and SEC Wi-Fi chipsets) software. Wi-Fi allows a denial of service vi… |
CVE-2019-20611 | Critical | 9.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), Go(8.1), P(9.0), and Go(9.0) (Exynos chipsets) software. A baseband stack overflow leads… |
CVE-2019-20610 | High | 8.1 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.X) and O(8.X) (Exynos 7570, 7870, 7880, 7885, 8890, 8895, and 9810 chipsets) software. A double-fetc… |
CVE-2019-20609 | Medium | 6.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can use Smartwatch to view Secure Folder notification content. The Samsung ID… |
CVE-2019-20608 | High | 7.5 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. An attacker can use Emergency mode to disable features. The Samsung… |
CVE-2019-20607 | Critical | 9.8 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (MSM8996, MSM8998, Exynos7420, Exynos7870, Exynos8890, and Exynos8895 chipset… |
CVE-2019-20606 | Critical | 9.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with any (before May 2019) software. A phishing attack against OMACP can change the network and internet sett… |