2019 CVEs (page 24)
Page 24 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-19281 | High | 7.5 | 2020-03-10 | A vulnerability has been identified in SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V2.5 and < V20.8), SIMATIC S7-1… |
CVE-2019-19279 | High | 7.5 | 2020-03-10 | A vulnerability has been identified in SIPROTEC 4 and SIPROTEC Compact relays equipped with EN100 Ethernet communication modules (All versions). Specially craf… |
CVE-2019-19277 | Medium | 6.5 | 2020-03-10 | A vulnerability has been identified in SIPORT MP (All versions < 3.1.4). Vulnerable versions of the device allow the creation of special accounts ("service use… |
CVE-2019-18336 | High | 7.5 | 2020-03-10 | A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V3.X.17), SIMATIC TDC CP51M1 (A… |
CVE-2019-15034 | Medium | 5.8 | 2020-03-10 | hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended con… |
CVE-2019-13457 | Medium | 4.3 | 2020-03-10 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8. A customer user can use the search results to disclose information from their… |
CVE-2019-13121 | High | 7.5 | 2020-03-10 | An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. The GitHub project integration was vulnerable to an SSRF vulnerability which allowed… |
CVE-2019-13011 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. By using brute-force a user with access to a project, but not it's repository could… |
CVE-2019-13010 | Medium | 5.9 | 2020-03-10 | An issue was discovered in GitLab Enterprise Edition 8.3 through 12.0.2. The color codes decoder was vulnerable to a resource depletion attack if specific form… |
CVE-2019-13009 | Medium | 6.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. Uploaded files associated with unsaved personal snippets were accessible… |
CVE-2019-13007 | Medium | 4.9 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. When an admin enabled one of the service templates, it was triggering… |
CVE-2019-13006 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. Users with access to issues, but not the repository were able to vie… |
CVE-2019-17636 | High | 8.1 | 2020-03-10 | In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs… |
CVE-2019-13005 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Enterprise Edition and Community Edition 1.10 through 12.0.2. The GitLab graphql service was vulnerable to multiple authoriza… |
CVE-2019-13004 | Medium | 5.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. When specific encoded characters were added to comments, the comments… |
CVE-2019-13003 | High | 7.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. One of the parsers used by Gilab CI was vulnerable to a resource exhaustion a… |
CVE-2019-13002 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. Unauthorized users were able to read pipeline information of the last… |
CVE-2019-13001 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.9 and later through 12.0.2. GitLab Snippets were vulnerable to an authorization issue tha… |
CVE-2019-12446 | High | 7.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Message. |
CVE-2019-12445 | Medium | 5.4 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. A malicious user could execute JavaScript code on notes by importing a sp… |
CVE-2019-12444 | Medium | 6.1 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of input validation which resulted in a persi… |
CVE-2019-12443 | Critical | 9.8 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11. Multiple features contained Server-Side Request Forgery (SSRF) vulnerabi… |
CVE-2019-12442 | Medium | 6.1 | 2020-03-10 | An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epic details page contained a lack of input validation and output encoding issue w… |
CVE-2019-12441 | High | 7.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which res… |
CVE-2019-10705 | High | 7.5 | 2020-03-10 | Western Digital SanDisk X600 devices in certain configurations, a vulnerability in the access control mechanism of the drive may allow data to be decrypted wit… |
CVE-2019-12434 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. Users could guess the URL slug of private projects through the contrast… |
CVE-2019-12433 | Medium | 5.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11. It has Improper Input Validation. Restricted visibility settings allow c… |
CVE-2019-12432 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Non-member users who subscribed to issue notifications could access the… |
CVE-2019-12431 | Medium | 4.3 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. Restricted users could access the metadata of private milestones through… |
CVE-2019-12430 | High | 8.8 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.11. A specially crafted payload would allow an authenticated malicious user to execute co… |
CVE-2019-12429 | Medium | 6.5 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.9 through 11.11. Unprivileged users were able to access labels, status and merge request… |
CVE-2019-12428 | Critical | 9.8 | 2020-03-10 | An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authentication provider sign-in… |
CVE-2019-11345 | Medium | 6.1 | 2020-03-10 | Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow XSS. |
CVE-2019-9859 | High | 8.8 | 2020-03-10 | Vesta Control Panel (VestaCP) 0.9.7 through 0.9.8-23 is vulnerable to an authenticated command execution that can result in remote root access on the server. T… |
CVE-2019-11686 | Medium | 5.5 | 2020-03-10 | Western Digital SanDisk X300, X300s, X400, and X600 devices: A vulnerability in the wear-leveling algorithm of the drive may cause cryptographically sensitive… |
CVE-2019-10706 | Medium | 6.3 | 2020-03-10 | Western Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update authentication method relies on a symmetric HMAC digest. The key used… |
CVE-2019-10065 | Medium | 4.3 | 2020-03-10 | An issue was discovered in Open Ticket Request System (OTRS) 7.0 through 7.0.6. An attacker who is logged into OTRS as a customer user can use the search resul… |
CVE-2019-4608 | Medium | 5.4 | 2020-03-10 | IBM Tivoli Workload Scheduler 9.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2019-19614 | High | 7.5 | 2020-03-09 | An issue was discovered in Halvotec RAQuest 10.23.10801.0. The login page is vulnerable to wildcard injection, allowing an attacker to enumerate the list of us… |
CVE-2019-10806 | Medium | 4.3 | 2020-03-09 | vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying pro… |
CVE-2019-20504 | Critical | 9.8 | 2020-03-09 | service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attacker to execute code via shell metacharac… |
CVE-2019-19773 | Medium | 5.4 | 2020-03-06 | Various Lexmark products have stored XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support… |
CVE-2019-19772 | Medium | 5.4 | 2020-03-06 | Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://supp… |
CVE-2019-20503 | Medium | 6.5 | 2020-03-06 | usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init. |
CVE-2019-20502 | High | 7.5 | 2020-03-05 | An issue was discovered in EFS Easy Chat Server 3.1. There is a buffer overflow via a long body2.ghp message parameter. |
CVE-2019-17647 | Critical | 9.8 | 2020-03-05 | An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2. SQL Injection exists via the include/monitoring/status/Hosts/xml/hostXML.php… |
CVE-2019-17646 | High | 7.5 | 2020-03-05 | An issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2. It provides sensitive information via an unauthenticated direct request for api/exter… |
CVE-2019-20382 | Low | 3.5 | 2020-03-05 | QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation whe… |
CVE-2019-14886 | Medium | 6.5 | 2020-03-05 | A vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where encoded passwords are stored in errai_security_context. The enco… |
CVE-2019-17645 | High | 7.5 | 2020-03-05 | An issue was discovered in Centreon before 2.8.31, 18.10.9, 19.04.6, and 19.10.3. It provides sensitive information via an unauthenticated direct request for i… |
CVE-2019-17642 | High | 8.8 | 2020-03-05 | An issue was discovered in Centreon before 18.10.8, 19.10.1, and 19.04.2. It allows CSRF with resultant remote command execution via shell metacharacters in a… |
CVE-2019-20501 | High | 7.8 | 2020-03-05 | D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Upgrade Firmware functionality in the Web interface… |
CVE-2019-20500 | High | 7.8 | 2020-03-05 | D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface… |
CVE-2019-20499 | High | 7.8 | 2020-03-05 | D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the Web interf… |
CVE-2019-20107 | High | 8.8 | 2020-03-05 | Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id p… |
CVE-2019-2317 | Critical | 9.8 | 2020-03-05 | The secret key used to make the Initial Sequence Number in the TCP SYN packet could be brute forced and therefore can be predicted in Snapdragon Auto, Snapdrag… |
CVE-2019-2311 | Critical | 9.8 | 2020-03-05 | Possible buffer overflow in WLAN handler due to lack of validation of destination buffer size before copying it in Snapdragon Auto, Snapdragon Compute, Snapdra… |
CVE-2019-2300 | Critical | 9.8 | 2020-03-05 | Possible buffer overflow in WLAN handler due to lack of validation of destination buffer size before copying into it in Snapdragon Auto, Snapdragon Compute, Sn… |
CVE-2019-14098 | Critical | 9.8 | 2020-03-05 | Possible buffer overflow in data offload handler due to lack of check of keydata length when copying data in Snapdragon Auto, Snapdragon Compute, Snapdragon Co… |
CVE-2019-14097 | Critical | 9.8 | 2020-03-05 | Possible buffer overflow in WLAN Parser due to lack of length check when copying data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrag… |
CVE-2019-14095 | Critical | 9.8 | 2020-03-05 | Buffer overflow occurs while processing LMP packet in which name length parameter exceeds value specified in BT-specification in Snapdragon Auto, Snapdragon Co… |
CVE-2019-14086 | Critical | 9.8 | 2020-03-05 | Possible integer overflow while checking the length of frame which is a 32 bit integer and is added to another 32 bit integer which can lead to unexpected resu… |
CVE-2019-14085 | High | 7.8 | 2020-03-05 | Possible Integer underflow in WLAN function due to lack of check of data received from user side in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer El… |
CVE-2019-14083 | Critical | 9.8 | 2020-03-05 | While parsing Service Descriptor Extended Attribute received as part of SDF frame, there is a possibility that incorrect length is specified in the attribute l… |
CVE-2019-14082 | Critical | 9.1 | 2020-03-05 | Potential buffer over-read due to lack of bound check of memory offset passed in WLAN firmware in Snapdragon Compute, Snapdragon Consumer Electronics Connectiv… |
CVE-2019-14081 | High | 7.1 | 2020-03-05 | Buffer Over-read when WLAN module gets a WMI message for SAR limits with invalid number of limits to be enforced in Snapdragon Compute, Snapdragon Consumer Ele… |
CVE-2019-14079 | High | 7.8 | 2020-03-05 | Access to the uninitialized variable when the driver tries to unmap the dma buffer of a request which was never mapped in the first place leading to kernel fai… |
CVE-2019-14072 | High | 7.0 | 2020-03-05 | Unhandled paging request is observed due to dereferencing an already freed object because of race condition between sparse free and sparse bind ioctls which ac… |
CVE-2019-14071 | High | 7.8 | 2020-03-05 | Compromised reset handler may bypass access control due to AC config is being reset if debug path is enabled to collect secure or non-secure ram dumps in Snapd… |
CVE-2019-14068 | High | 7.8 | 2020-03-05 | Out of bound access in msm routing due to lack of check of size before accessing in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon In… |
CVE-2019-14061 | High | 7.5 | 2020-03-05 | Null-pointer dereference can occur while accessing the segment element info when it is not allocated and assigned in Snapdragon Auto, Snapdragon Compute, Snapd… |
CVE-2019-14050 | High | 7.8 | 2020-03-05 | Out-of-bound writes occurs due to lack of check of buffer size will cause buffer overflow only in 32bit architecture. in Snapdragon Auto, Snapdragon Compute, S… |
CVE-2019-14048 | High | 7.8 | 2020-03-05 | Possible out of bound memory access while playing a crafted clip in media player in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon In… |
CVE-2019-14045 | Critical | 9.8 | 2020-03-05 | Possible buffer overflow while processing clientlog and serverlog due to lack of validation of data received in logs in Snapdragon Auto, Snapdragon Consumer IO… |
CVE-2019-14032 | High | 7.8 | 2020-03-05 | Memory use after free issue in audio due to lack of resource control in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT… |
CVE-2019-14031 | Critical | 9.8 | 2020-03-05 | Buffer overflow can occur while parsing RSN IE containing list of PMK ID`s which are more than the buffer size in Snapdragon Auto, Snapdragon Compute, Snapdrag… |
CVE-2019-14030 | High | 7.8 | 2020-03-05 | The size of a buffer is determined by addition and multiplications operations that have the potential to overflow due to lack of bound check in Snapdragon Auto… |
CVE-2019-14029 | High | 7.8 | 2020-03-05 | Use-after-free in graphics module due to destroying already queued syncobj in error case in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapd… |
CVE-2019-14028 | High | 7.8 | 2020-03-05 | Buffer overwrite during memcpy due to lack of check on SSID length validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consu… |
CVE-2019-14027 | High | 7.8 | 2020-03-05 | Buffer overflow due to lack of upper bound check on channel length which is used for a loop. in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consume… |
CVE-2019-14026 | High | 7.8 | 2020-03-05 | Possible buffer overflow in WLAN WMI handler due to lack of ssid length check when copying data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2019-14015 | High | 7.8 | 2020-03-05 | A stack-based buffer overflow exists in the initialization of the identification stage due to lack of check on the number of templates provided. in Snapdragon… |
CVE-2019-14000 | High | 7.8 | 2020-03-05 | Lack of check that the RX FIFO write index that is read from shared RAM is less than the FIFO size results into memory corruption and potential information lea… |
CVE-2019-10616 | Medium | 5.5 | 2020-03-05 | Possibility of null pointer access if the SPDM commands are executed in the non-standard way in TZ. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connecti… |
CVE-2019-10612 | Critical | 9.8 | 2020-03-05 | UTCB object has a function pointer called by the reaper to deallocate its memory resources and this address can potentially be corrupted by stack overflow in S… |
CVE-2019-10604 | High | 7.8 | 2020-03-05 | Possibility of heap-buffer-overflow during last iteration of loop while populating image version information in diag command response packet, in Snapdragon Aut… |
CVE-2019-10603 | High | 7.8 | 2020-03-05 | Use after free issue occurs If the real device interface goes down and a route lookup is performed while sending a raw IPv6 message in Snapdragon Auto, Snapdra… |
CVE-2019-10594 | Critical | 9.8 | 2020-03-05 | Stack overflow can occur when SDP is received with multiple payload types in the FMTP attribute of a video M line in Snapdragon Auto, Snapdragon Compute, Snapd… |
CVE-2019-10593 | Critical | 9.8 | 2020-03-05 | Buffer overflow can occur when processing non standard SDP video Image attribute parameter in a VILTE\VOLTE call in Snapdragon Auto, Snapdragon Compute, Snapdr… |
CVE-2019-10591 | High | 7.5 | 2020-03-05 | Null pointer dereference can happen when parsing udta atom which is non-standard and having invalid depth in Snapdragon Auto, Snapdragon Compute, Snapdragon Co… |
CVE-2019-10587 | Critical | 9.8 | 2020-03-05 | Possible Stack overflow can occur when processing a large SDP body or non standard SDP body without right delimiters in Snapdragon Auto, Snapdragon Compute, Sn… |
CVE-2019-10586 | Critical | 9.8 | 2020-03-05 | Filling media attribute tag names without validating the destination buffer size which can result in the buffer overflow in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-10577 | Critical | 9.1 | 2020-03-05 | Improper input validation while processing SIP URI received from the network will lead to buffer over-read and then to denial of service in Snapdragon Auto, Sn… |
CVE-2019-10569 | High | 7.8 | 2020-03-05 | Stack buffer overflow due to instance id is misplaced inside definition of hardware accelerated effects in makefile in Snapdragon Auto, Snapdragon Compute, Sna… |
CVE-2019-10554 | Critical | 9.1 | 2020-03-05 | Multiple Read overflows issue due to improper length check while decoding Identity Request in CSdomain/Authentication Reject in CS domain/ PRAU accept/while lo… |
CVE-2019-10553 | Critical | 9.1 | 2020-03-05 | Multiple Read overflows due to improper length checks while decoding authentication in Cs domain/RAU Reject and TC cmd in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-10552 | Critical | 9.1 | 2020-03-05 | Multiple Buffer Over-read issue can happen due to improper length checks while decoding Service Reject/RAU Reject/PTMSI Realloc cmd in Snapdragon Auto, Snapdra… |
CVE-2019-10550 | Critical | 9.1 | 2020-03-05 | Buffer Over-read when UE is trying to process the message received form the network without zero termination in Snapdragon Auto, Snapdragon Compute, Snapdragon… |
CVE-2019-10549 | High | 7.5 | 2020-03-05 | Null pointer dereference issue can happen due to improper validation of CSEQ header response received from network in Snapdragon Auto, Snapdragon Compute, Snap… |
CVE-2019-10546 | Critical | 9.8 | 2020-03-05 | Buffer overflow can occur in WLAN firmware while parsing beacon/probe_response frames during roaming in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect… |