2019 CVEs (page 22)
Page 22 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-12769 | High | 8.8 | 2020-03-18 | SolarWinds Serv-U Managed File Transfer (MFT) Web client before 15.1.6 Hotfix 2 is vulnerable to Cross-Site Request Forgery in the file upload functionality vi… |
CVE-2019-12370 | Medium | 6.1 | 2020-03-18 | The Spark application through 2.0.2 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the RE… |
CVE-2019-12369 | Medium | 6.1 | 2020-03-18 | The TypeApp application through 1.9.5.35 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has t… |
CVE-2019-12368 | Medium | 6.1 | 2020-03-18 | The Edison Mail application through 1.7.1 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has… |
CVE-2019-12367 | Medium | 6.1 | 2020-03-18 | The BlueMail application through 1.9.5.36 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has… |
CVE-2019-12366 | Medium | 6.1 | 2020-03-18 | The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the RE… |
CVE-2019-12365 | Medium | 6.1 | 2020-03-18 | The Newton application through 10.0.23 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the… |
CVE-2019-12132 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP SDNC before Dublin. By executing sla/dgUpload with a crafted filename parameter, an unauthenticated attacker can execute an arb… |
CVE-2019-12131 | Critical | 9.1 | 2020-03-18 | An issue was detected in ONAP APPC through Dublin and SDC through Dublin. By setting a USER_ID parameter in an HTTP header, an attacker may impersonate an arbi… |
CVE-2019-12124 | Critical | 9.1 | 2020-03-18 | An issue was discovered in ONAP APPC before Dublin. By using an exposed unprotected Jolokia interface, an unauthenticated attacker can read or overwrite an arb… |
CVE-2019-12123 | High | 8.8 | 2020-03-18 | An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsXml with a crafted module parameter, an authenticated user can execute an arbitrary… |
CVE-2019-12122 | Medium | 6.5 | 2020-03-18 | An issue was discovered in ONAP Portal through Dublin. By executing a call to ONAPPORTAL/portalApi/loggedinUser, an attacker who possesses a user's cookie may… |
CVE-2019-12121 | High | 7.5 | 2020-03-18 | An issue was detected in ONAP Portal through Dublin. By executing a padding oracle attack using the ONAPPORTAL/processSingleSignOn UserId field, an attacker is… |
CVE-2019-12120 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP VNFSDK through Dublin. By accessing port 8000 of demo-vnfsdk-vnfsdk, an unauthenticated attacker (who already has access to pod… |
CVE-2019-12119 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP SDC through Dublin. By accessing port 7000 of demo-sdc-sdc-wfd-fe pod, an unauthenticated attacker (who already has access to p… |
CVE-2019-12118 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP SDC through Dublin. By accessing port 7001 of demo-sdc-sdc-wfd-be pod, an unauthenticated attacker (who already has access to p… |
CVE-2019-12117 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP SDC through Dublin. By accessing port 4001 of demo-sdc-sdc-onboarding-be pod, an unauthenticated attacker (who already has acce… |
CVE-2019-12116 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP SDC through Dublin. By accessing port 6000 of demo-sdc-sdc-fe pod, an unauthenticated attacker (who already has access to pod-t… |
CVE-2019-12115 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP SDC through Dublin. By accessing port 4000 of demo-sdc-sdc-be pod, an unauthenticated attacker (who already has access to pod-t… |
CVE-2019-12114 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP HOLMES before Dublin. By accessing port 9202 of dep-holmes-engine-mgmt pod, an unauthenticated attacker (who already has access… |
CVE-2019-12113 | High | 8.8 | 2020-03-18 | An issue was discovered in ONAP SDNC before Dublin. By executing sla/printAsGv with a crafted module parameter, an authenticated user can execute an arbitrary… |
CVE-2019-12112 | Critical | 9.8 | 2020-03-18 | An issue was discovered in ONAP SDNC before Dublin. By executing sla/upload with a crafted filename parameter, an unauthenticated attacker can execute an arbit… |
CVE-2019-19355 | High | 7.0 | 2020-03-18 | An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. An attacker with access to the container co… |
CVE-2019-19351 | High | 7.0 | 2020-03-18 | An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacker with access to the container could use… |
CVE-2019-19335 | Medium | 4.4 | 2020-03-18 | During installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates an `auth` directory, with `kubeconfig` and `kubeadmin-password… |
CVE-2019-14871 | Medium | 6.5 | 2020-03-18 | The REENT_CHECK macro (see newlib/libc/include/sys/reent.h) as used by REENT_CHECK_TM, REENT_CHECK_MISC, REENT_CHECK_MP and other newlib macros in versions pri… |
CVE-2019-10178 | Medium | 4.6 | 2020-03-18 | It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (… |
CVE-2019-11689 | High | 8.1 | 2020-03-18 | An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl fail to properly validate server… |
CVE-2019-11688 | High | 7.4 | 2020-03-18 | An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl accept any certificate for asusto… |
CVE-2019-10682 | High | 7.5 | 2020-03-18 | django-nopassword before 5.0.0 stores cleartext secrets in the database. |
CVE-2019-10146 | Medium | 4.7 | 2020-03-18 | A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly saniti… |
CVE-2019-14884 | Medium | 6.1 | 2020-03-18 | A vulnerability was found in Moodle 3.7 before 3.73, 3.6 before 3.6.7 and 3.5 before 3.5.9, where a reflected XSS possible from some fatal error messages. |
CVE-2019-14883 | Medium | 5.3 | 2020-03-18 | A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disable… |
CVE-2019-14882 | Medium | 6.1 | 2020-03-18 | A vulnerability was found in Moodle 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9 and earlier where an open redirect existed in the Lesson edit page. |
CVE-2019-14881 | Medium | 6.1 | 2020-03-18 | A vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed. |
CVE-2019-11939 | High | 7.5 | 2020-03-18 | Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients co… |
CVE-2019-20498 | Critical | 9.8 | 2020-03-17 | cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534). |
CVE-2019-20497 | Medium | 5.4 | 2020-03-17 | cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533). |
CVE-2019-20496 | Medium | 5.5 | 2020-03-17 | cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532). |
CVE-2019-20495 | Medium | 6.5 | 2020-03-17 | cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531). |
CVE-2019-20494 | Low | 3.3 | 2020-03-17 | In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525). |
CVE-2019-20493 | Medium | 6.1 | 2020-03-17 | cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520). |
CVE-2019-20492 | High | 8.8 | 2020-03-17 | cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516). |
CVE-2019-20490 | High | 8.8 | 2020-03-17 | cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499). |
CVE-2019-11074 | High | 7.2 | 2020-03-17 | A Write to Arbitrary Location in Disk vulnerability exists in PRTG Network Monitor 19.1.49 and below that allows attackers to place files in arbitrary location… |
CVE-2019-20453 | High | 8.8 | 2020-03-17 | A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/uploader.http/HttpDownl… |
CVE-2019-20452 | High | 8.8 | 2020-03-17 | A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/core.access/src/Recycle… |
CVE-2019-20407 | Medium | 4.3 | 2020-03-17 | The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release v… |
CVE-2019-20105 | Medium | 4.9 | 2020-03-17 | The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, from version 6.1.0 b… |
CVE-2019-20326 | High | 7.8 | 2020-03-16 | A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb before 3.8.3 and Linu… |
CVE-2019-20191 | High | 7.5 | 2020-03-16 | Oxygen XML Editor 21.1.1 allows XXE to read any file. |
CVE-2019-20491 | Medium | 5.4 | 2020-03-16 | cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508). |
CVE-2019-19852 | Medium | 4.8 | 2020-03-16 | An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel module at the admin/c… |
CVE-2019-19615 | Medium | 4.8 | 2020-03-16 | Multiple XSS vulnerabilities exist in the Backup & Restore module \ v14.0.10.2 through v14.0.10.7 for FreePBX, as shown at /admin/config.php?display=backup on… |
CVE-2019-19613 | Medium | 5.2 | 2020-03-16 | An issue was discovered in Halvotec RaQuest 10.23.10801.0. The login page of the admin application is vulnerable to an Open Redirect attack allowing an attacke… |
CVE-2019-19612 | Medium | 5.4 | 2020-03-16 | An issue was discovered in Halvotec RaQuest 10.23.10801.0. Several features of the application allow stored Cross-site Scripting (XSS). Fixed in Release 24.202… |
CVE-2019-19610 | Medium | 5.4 | 2020-03-16 | An issue was discovered in Halvotec RaQuest 10.23.10801.0. It allows session fixation. Fixed in Release 24.2020.20608.0. |
CVE-2019-19538 | High | 7.2 | 2020-03-16 | In Sangoma FreePBX 13 through 15 and sysadmin (aka System Admin) 13.0.92 through 15.0.13.6 modules have a Remote Command Execution vulnerability that results i… |
CVE-2019-19937 | High | 7.2 | 2020-03-16 | In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "un… |
CVE-2019-19461 | Medium | 5.4 | 2020-03-16 | Post-authentication Stored XSS in Team Password Manager through 7.93.204 allows attackers to steal other users' credentials by creating a shared password with… |
CVE-2019-19212 | Critical | 9.8 | 2020-03-16 | Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen). |
CVE-2019-18917 | Medium | 6.5 | 2020-03-16 | A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassing account lockout. |
CVE-2019-11073 | High | 7.2 | 2020-03-16 | A Remote Code Execution vulnerability exists in PRTG Network Monitor before 19.4.54.1506 that allows attackers to execute code due to insufficient sanitization… |
CVE-2019-5543 | High | 7.8 | 2020-03-16 | For VMware Horizon Client for Windows (5.x and prior before 5.3.0), VMware Remote Console for Windows (10.x before 11.0.0), VMware Workstation for Windows (15… |
CVE-2019-19946 | Medium | 6.5 | 2020-03-16 | The API in Dradis Pro 3.4.1 allows any user to extract the content of a project, even if this user is not part of the project team. |
CVE-2019-19945 | High | 7.5 | 2020-03-16 | uhttpd in OpenWrt through 18.06.5 and 19.x through 19.07.0-rc2 has an integer signedness error. This leads to out-of-bounds access to a heap buffer and a subse… |
CVE-2019-19821 | High | 8.1 | 2020-03-16 | A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify informati… |
CVE-2019-4719 | Medium | 5.5 | 2020-03-16 | IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive… |
CVE-2019-4656 | Medium | 6.5 | 2020-03-16 | IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD is vulnerable to a denial of service attack that would allow an authenticated user to c… |
CVE-2019-4619 | Medium | 5.5 | 2020-03-16 | IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive… |
CVE-2019-4617 | Medium | 4.4 | 2020-03-16 | IBM Cloud Automation Manager 3.2.1.0 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnera… |
CVE-2019-19942 | High | 7.5 | 2020-03-16 | Missing output sanitation in Swisscom Centro Grande Centro Grande before 6.16.12, Centro Business 1.0 (ADB) before 7.10.18, and Centro Business 2.0 before 8.02… |
CVE-2019-19941 | Medium | 5.4 | 2020-03-16 | Missing hostname validation in Swisscom Centro Grande before 6.16.12 allows a remote attacker to inject its local IP address as a domain entry in the DNS servi… |
CVE-2019-19940 | High | 7.2 | 2020-03-16 | Incorrect input sanitation in text-oriented user interfaces (telnet, ssh) in Swisscom Centro Grande before 6.16.12 allows remote authenticated users to execute… |
CVE-2019-19851 | Medium | 4.8 | 2020-03-16 | An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Debug/Test page of the Superfecta module at the admin/config.php?… |
CVE-2019-19135 | High | 7.4 | 2020-03-16 | In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.35… |
CVE-2019-19211 | Medium | 6.1 | 2020-03-16 | Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS. |
CVE-2019-19210 | Medium | 5.4 | 2020-03-16 | Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files. |
CVE-2019-19209 | High | 7.5 | 2020-03-16 | Dolibarr ERP/CRM before 10.0.3 allows SQL Injection. |
CVE-2019-19208 | Critical | 9.8 | 2020-03-16 | Codiad Web IDE through 2.8.4 allows PHP Code injection. |
CVE-2019-14887 | Critical | 9.1 | 2020-03-16 | A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker… |
CVE-2019-14512 | Medium | 6.1 | 2020-03-16 | LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admin/labels/labelview_… |
CVE-2019-10091 | High | 7.4 | 2020-03-16 | When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate… |
CVE-2019-6696 | Medium | 6.1 | 2020-03-15 | An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to perform an URL redir… |
CVE-2019-17654 | High | 8.8 | 2020-03-15 | An Insufficient Verification of Data Authenticity vulnerability in FortiManager 6.2.1, 6.2.0, 6.0.6 and below may allow an unauthenticated attacker to perform… |
CVE-2019-15708 | Medium | 6.7 | 2020-03-15 | A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin c… |
CVE-2019-9474 | High | 7.5 | 2020-03-15 | In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional executi… |
CVE-2019-9473 | High | 7.5 | 2020-03-15 | In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional executi… |
CVE-2019-2216 | High | 7.3 | 2020-03-15 | In overlay notifications, there is a possible hidden notification due to improper input validation. This could lead to a local escalation of privilege because… |
CVE-2019-2089 | High | 7.8 | 2020-03-15 | In app uninstallation, there is a possible set of permissions that may not be removed from a shared app ID. This could lead to a local escalation of privilege… |
CVE-2019-2088 | Medium | 5.5 | 2020-03-15 | In StatsService, there is a possible out of bounds read. This could lead to local information disclosure if UBSAN were not enabled, with no additional executio… |
CVE-2019-2058 | Medium | 6.5 | 2020-03-15 | In libAACdec, there is a possible out of bounds read. This could lead to remote information disclosure, with no additional execution privileges needed. User in… |
CVE-2019-15608 | Medium | 5.9 | 2020-03-15 | The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not comput… |
CVE-2019-3770 | Medium | 6.4 | 2020-03-13 | Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability when unregistering a device. A remote authenticated mali… |
CVE-2019-3769 | Medium | 6.4 | 2020-03-13 | Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with low privileg… |
CVE-2019-18578 | Critical | 9.0 | 2020-03-13 | Dell EMC XtremIO XMS versions prior to 6.3.0 contain a stored cross-site scripting vulnerability. A low-privileged malicious remote user of XtremIO may exploit… |
CVE-2019-18577 | Medium | 6.7 | 2020-03-13 | Dell EMC XtremIO XMS versions prior to 6.3.0 contain an incorrect permission assignment vulnerability. A malicious local user with XtremIO xinstall privileges… |
CVE-2019-18576 | Medium | 6.7 | 2020-03-13 | Dell EMC XtremIO XMS versions prior to 6.3.0 contain an information disclosure vulnerability where OS users’ passwords are logged in local files. Malicious loc… |
CVE-2019-19611 | High | 7.5 | 2020-03-13 | An issue was discovered in Halvotec RaQuest 10.23.10801.0. One of the exposed web services allows an anonymous user to access the list of connected users as we… |
CVE-2019-14310 | Critical | 9.8 | 2020-03-13 | Ricoh SP C250DN 1.05 devices allow denial of service (issue 2 of 3). Unauthenticated crafted packets to the IPP service will cause a vulnerable device to crash… |