2019 CVEs (page 21)
Page 21 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-12767 | Critical | 9.8 | 2020-03-21 | An issue was discovered on D-Link DAP-1650 devices before 1.04B02_J65H Hot Fix. Attackers can execute arbitrary commands. |
CVE-2019-11574 | Critical | 9.8 | 2020-03-20 | An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17. There is SSRF related to Subs-Package.php and Subs.php because user-supplied data… |
CVE-2019-18860 | Medium | 6.1 | 2020-03-20 | Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi. |
CVE-2019-18641 | Critical | 9.8 | 2020-03-20 | Rock RMS before 1.8.6 mishandles vCard access control within the People/GetVCard/REST controller. |
CVE-2019-16528 | High | 7.5 | 2020-03-20 | An issue was discovered in the AbuseFilter extension for MediaWiki. includes/special/SpecialAbuseLog.php allows attackers to obtain sensitive information, such… |
CVE-2019-15522 | Critical | 9.8 | 2020-03-20 | An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a failure of a hello command when the configuration re… |
CVE-2019-13463 | Medium | 6.1 | 2020-03-20 | An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrar… |
CVE-2019-13389 | Medium | 6.1 | 2020-03-20 | RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation, the X-XSS-Protection header, and the Content-Security-Policy head… |
CVE-2019-12498 | Critical | 9.8 | 2020-03-20 | The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection mechanism. |
CVE-2019-19324 | High | 7.5 | 2020-03-20 | Xmidt cjwt through 1.0.1 before 2019-11-25 maps unsupported algorithms to alg=none, which sometimes leads to untrusted accidental JWT acceptance. |
CVE-2019-19148 | Critical | 9.8 | 2020-03-20 | Tellabs Optical Line Terminal (OLT) 1150 devices allow Remote Command Execution via the -l option to TELNET or SSH. Tellabs has addressed this issue in the SR3… |
CVE-2019-16258 | Medium | 6.8 | 2020-03-20 | The bootloader of the homee Brain Cube V2 through 2.23.0 allows attackers with physical access to gain root access by manipulating the U-Boot environment via t… |
CVE-2019-15665 | High | 7.2 | 2020-03-20 | An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120004 in KfeCo10X64.sys fails to validate an offset passed as a parameter duri… |
CVE-2019-15664 | Low | 2.7 | 2020-03-20 | An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120404 in KfeCo10X64.sys fails to validate an offset passed as a parameter duri… |
CVE-2019-15663 | Low | 2.7 | 2020-03-20 | An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120404 in KfeCo10X64.sys fails to validate an offset passed as a parameter duri… |
CVE-2019-15662 | Low | 2.7 | 2020-03-20 | An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120444 in KfeCo10X64.sys fails to validate an offset passed as a parameter duri… |
CVE-2019-15075 | High | 7.5 | 2020-03-20 | An issue was discovered in iNextrix ASTPP before 4.0.1. web_interface/astpp/application/config/config.php does not have strong random keys, as demonstrated by… |
CVE-2019-15661 | High | 7.2 | 2020-03-20 | An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120004 in KfeCo10X64.sys fails to validate parameters, leading to a stack-based… |
CVE-2019-14855 | High | 7.5 | 2020-03-20 | A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create… |
CVE-2019-19345 | High | 7.0 | 2020-03-20 | A vulnerability was found in all openshift/mediawiki-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file wa… |
CVE-2019-10221 | Medium | 4.3 | 2020-03-20 | A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused… |
CVE-2019-10179 | Medium | 4.3 | 2020-03-20 | A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request sear… |
CVE-2019-19487 | High | 8.8 | 2020-03-20 | Command Injection in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to achieve command injection via a plugin test. |
CVE-2019-19486 | Medium | 6.5 | 2020-03-20 | Local File Inclusion in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to traverse paths via a plugin test. |
CVE-2019-19484 | Medium | 6.1 | 2020-03-20 | Open redirect via parameter ‘p’ in login.php in Centreon (19.04.4 and below) allows an attacker to craft a payload and execute unintended behavior. |
CVE-2019-19029 | High | 7.2 | 2020-03-20 | Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal… |
CVE-2019-19026 | Medium | 4.9 | 2020-03-20 | Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivot… |
CVE-2019-19025 | High | 8.8 | 2020-03-20 | Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platform. |
CVE-2019-19023 | High | 8.8 | 2020-03-20 | Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivo… |
CVE-2019-18785 | High | 7.5 | 2020-03-20 | SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 mishandles API access tokens and credentials. |
CVE-2019-18782 | Medium | 5.3 | 2020-03-20 | SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism. |
CVE-2019-16108 | High | 7.5 | 2020-03-20 | phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode. |
CVE-2019-16072 | Critical | 9.8 | 2020-03-20 | An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an attacker to execute arbitrary code… |
CVE-2019-16071 | High | 8.8 | 2020-03-20 | Enigma NMS 65.0.0 and prior allows administrative users to create low-privileged accounts that do not have the ability to modify any settings in the system, on… |
CVE-2019-16529 | Medium | 5.3 | 2020-03-19 | An issue was discovered in the CheckUser extension through 1.35.0 for MediaWiki. Oversighted edit summaries are still visible in CheckUser results in violation… |
CVE-2019-16069 | Medium | 6.1 | 2020-03-19 | A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject m… |
CVE-2019-16068 | High | 8.8 | 2020-03-19 | A CSRF vulnerability exists in NETSAS ENIGMA NMS version 65.0.0 and prior that could allow an attacker to be able to trick a victim into submitting a malicious… |
CVE-2019-16063 | High | 7.5 | 2020-03-19 | NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data rendered within web pages. It is possible for an attacker to expose unencrypted sensitive da… |
CVE-2019-15539 | Medium | 6.1 | 2020-03-19 | The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of… |
CVE-2019-15124 | Medium | 6.1 | 2020-03-19 | In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. This affects REL1_31, REL1_32, and REL1_33. |
CVE-2019-20526 | Medium | 6.1 | 2020-03-19 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter. |
CVE-2019-20525 | Medium | 6.1 | 2020-03-19 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter. |
CVE-2019-20521 | Medium | 6.1 | 2020-03-19 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI. |
CVE-2019-20520 | Medium | 6.1 | 2020-03-19 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI. |
CVE-2019-20519 | Medium | 6.1 | 2020-03-19 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address. |
CVE-2019-20518 | Medium | 6.1 | 2020-03-19 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI. |
CVE-2019-20517 | Medium | 6.1 | 2020-03-19 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI. |
CVE-2019-20516 | Medium | 6.1 | 2020-03-19 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI. |
CVE-2019-20515 | Medium | 6.1 | 2020-03-19 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI. |
CVE-2019-20514 | Medium | 6.1 | 2020-03-19 | ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI. |
CVE-2019-20513 | Medium | 6.1 | 2020-03-19 | Open edX Ironwood.1 allows support/certificates?user= reflected XSS. |
CVE-2019-16375 | Medium | 5.4 | 2020-03-19 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.11, and Community Edition 5.0.x through 5.0.37 and 6.0.x through 6.0.22. An atta… |
CVE-2019-16338 | High | 7.8 | 2020-03-19 | The tfo_common component in HwordApp.dll in Hancom Office 9.6.1.7634 allows a use-after-free via a crafted .docx file. |
CVE-2019-16337 | High | 7.8 | 2020-03-19 | The hncbd90 component in Hancom Office 9.6.1.9403 allows a use-after-free via an unknown object in a crafted .docx file. |
CVE-2019-16070 | Medium | 6.1 | 2020-03-19 | A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject m… |
CVE-2019-16067 | High | 7.5 | 2020-03-19 | NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application. The use of weak authentication… |
CVE-2019-16066 | High | 8.8 | 2020-03-19 | An unrestricted file upload vulnerability exists in user and system file upload functions in NETSAS Enigma NMS 65.0.0 and prior. This allows an attacker to upl… |
CVE-2019-16065 | High | 8.8 | 2020-03-19 | A remote SQL injection web vulnerability was discovered in the Enigma NMS 65.0.0 and prior web application that allows an attacker to execute SQL commands to e… |
CVE-2019-16064 | Critical | 9.6 | 2020-03-19 | NETSAS Enigma NMS 65.0.0 and prior suffers from a directory traversal vulnerability that can allow an authenticated user to access files and directories stored… |
CVE-2019-16062 | Medium | 6.5 | 2020-03-19 | NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data stored within the SQL database. It is possible for an attacker to expose unencrypted sensiti… |
CVE-2019-16061 | High | 8.8 | 2020-03-19 | A number of files on the NETSAS Enigma NMS server 65.0.0 and prior are granted weak world-readable and world-writable permissions, allowing any low privileged… |
CVE-2019-15656 | High | 7.5 | 2020-03-19 | D-Link DSL-2875AL and DSL-2877AL devices through 1.00.05 are prone to information disclosure via a simple crafted request to index.asp on the web management se… |
CVE-2019-15655 | High | 7.5 | 2020-03-19 | D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management server. This request… |
CVE-2019-15654 | High | 7.5 | 2020-03-19 | Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the web management ser… |
CVE-2019-15653 | High | 7.5 | 2020-03-19 | Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source code of the login page… |
CVE-2019-12127 | Critical | 9.8 | 2020-03-19 | In ONAP OOM through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full acce… |
CVE-2019-12126 | Critical | 9.8 | 2020-03-19 | In ONAP DCAE through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full acc… |
CVE-2019-12125 | Critical | 9.8 | 2020-03-19 | In ONAP Logging through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full… |
CVE-2019-16382 | Critical | 9.8 | 2020-03-19 | An issue was discovered in Ivanti Workspace Control 10.3.110.0. One is able to bypass Ivanti's FileGuard folder protection by renaming the WMTemp work folder u… |
CVE-2019-11361 | High | 8.8 | 2020-03-19 | Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application… |
CVE-2019-16012 | High | 8.1 | 2020-03-19 | A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an af… |
CVE-2019-16010 | Medium | 4.8 | 2020-03-19 | A vulnerability in the web UI of the Cisco SD-WAN vManage software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack… |
CVE-2019-14878 | Medium | 6.5 | 2020-03-19 | In the __d2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, howev… |
CVE-2019-14877 | Medium | 6.5 | 2020-03-19 | In the __mdiff function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate big integers, howe… |
CVE-2019-14876 | Medium | 6.5 | 2020-03-19 | In the __lshift function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, ho… |
CVE-2019-14875 | Medium | 6.5 | 2020-03-19 | In the __multiply function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer… |
CVE-2019-14874 | Medium | 6.5 | 2020-03-19 | In the __i2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, howev… |
CVE-2019-14873 | Medium | 6.5 | 2020-03-19 | In the __multadd function of the newlib libc library, prior to versions 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a big integer, howev… |
CVE-2019-12416 | Medium | 6.1 | 2020-03-19 | we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which… |
CVE-2019-20527 | Medium | 6.1 | 2020-03-19 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter. |
CVE-2019-20524 | Medium | 6.1 | 2020-03-19 | ilchCMS 2.1.23 allows XSS via the index.php/partner/index Banner parameter. |
CVE-2019-20523 | Medium | 6.1 | 2020-03-19 | ilchCMS 2.1.23 allows XSS via the index.php/partner/index Name parameter. |
CVE-2019-20522 | Medium | 6.1 | 2020-03-19 | ilchCMS 2.1.23 allows XSS via the index.php/partner/index Link parameter. |
CVE-2019-19336 | Medium | 6.1 | 2020-03-19 | A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the… |
CVE-2019-12130 | Critical | 9.8 | 2020-03-19 | In ONAP CLI through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full acce… |
CVE-2019-12129 | Critical | 9.8 | 2020-03-19 | In ONAP MSB through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full acce… |
CVE-2019-12128 | Critical | 9.8 | 2020-03-19 | In ONAP SO through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attacker gains full acces… |
CVE-2019-14872 | Medium | 6.5 | 2020-03-19 | The _dtoa_r function of the newlib libc library, prior to version 3.3.0, performs multiple memory allocations without checking their return value. This could r… |
CVE-2019-20485 | Medium | 5.7 | 2020-03-19 | qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of… |
CVE-2019-19677 | Medium | 4.3 | 2020-03-18 | arxes-tolina 3.0.0 allows User Enumeration. |
CVE-2019-19676 | Critical | 9.6 | 2020-03-18 | A CSV injection in arxes-tolina 3.0.0 allows malicious users to gain remote control of other computers. By entering formula code in the following columns: Kund… |
CVE-2019-18979 | High | 7.8 | 2020-03-18 | Adaware antivirus 12.6.1005.11662 and 12.7.1055.0 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory junction to resto… |
CVE-2019-3762 | High | 7.5 | 2020-03-18 | Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulnerability. A remote unauthenticated attac… |
CVE-2019-20529 | High | 7.5 | 2020-03-18 | In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as public files (no authent… |
CVE-2019-20528 | Medium | 6.1 | 2020-03-18 | Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter. |
CVE-2019-20512 | Medium | 6.1 | 2020-03-18 | Open edX Ironwood.1 allows support/certificates?course_id= reflected XSS. |
CVE-2019-20511 | Medium | 6.1 | 2020-03-18 | ERPNext 11.1.47 allows blog?blog_category= Frame Injection. |
CVE-2019-18582 | High | 7.2 | 2020-03-18 | Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server-side template in… |
CVE-2019-18581 | High | 7.2 | 2020-03-18 | Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server missing authoriz… |
CVE-2019-12921 | Medium | 6.5 | 2020-03-18 | In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a crafted image because of TranslateTextEx for… |