2019 CVEs (page 25)
Page 25 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10526 | Critical | 9.8 | 2020-03-05 | Out of bound write in WLAN driver due to NULL character not properly placed after SSID name in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electro… |
CVE-2019-17644 | High | 7.5 | 2020-03-04 | An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. It provides sensitive information via an unauthenticated direct request for… |
CVE-2019-17643 | High | 7.5 | 2020-03-04 | An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides sensitive information via an unauthenticated direct request for in… |
CVE-2019-19226 | High | 7.5 | 2020-03-04 | A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to enable or disable MAC addres… |
CVE-2019-19225 | High | 7.5 | 2020-03-04 | A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to change DNS servers without b… |
CVE-2019-19224 | High | 7.5 | 2020-03-04 | A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to download the configuration (… |
CVE-2019-19223 | High | 7.5 | 2020-03-04 | A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to reboot the router by submitt… |
CVE-2019-19222 | Medium | 5.4 | 2020-03-04 | A Stored XSS issue in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an authenticated attacker to inject arbitrary JavaScript code… |
CVE-2019-3404 | High | 7.5 | 2020-03-04 | By adding some special fields to the uri ofrouter app function, the user could abuse background app cgi functions withoutauthentication. This affects 360 route… |
CVE-2019-19792 | Medium | 6.7 | 2020-03-03 | A permissions issue in ESET Cyber Security before 6.8.300.0 for macOS allows a local attacker to escalate privileges by appending data to root-owned files. |
CVE-2019-17549 | Medium | 6.5 | 2020-03-03 | ESET Cyber Security before 6.8.1.0 is vulnerable to a denial-of-service allowing any user to stop (kill) ESET processes. An attacker can abuse this bug to stop… |
CVE-2019-3696 | High | 8.4 | 2020-03-03 | A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPO… |
CVE-2019-3695 | High | 8.4 | 2020-03-03 | A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterpr… |
CVE-2019-14893 | Critical | 9.8 | 2020-03-02 | A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious ob… |
CVE-2019-19608 | Critical | 9.8 | 2020-03-02 | A SQL injection vulnerability in in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficie… |
CVE-2019-19607 | Critical | 9.8 | 2020-03-02 | A SQL injection vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficient… |
CVE-2019-19371 | Medium | 6.1 | 2020-03-02 | A cross-site scripting (XSS) vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attacker to co… |
CVE-2019-19370 | Medium | 6.1 | 2020-03-02 | A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android could allow an unauthe… |
CVE-2019-18863 | Medium | 5.9 | 2020-03-02 | A key length vulnerability in the implementation of the SRTP 128-bit key on Mitel 6800 and 6900 SIP series phones, versions 5.1.0.2051 SP2 and earlier, could a… |
CVE-2019-18903 | High | 7.5 | 2020-03-02 | A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attacke… |
CVE-2019-18902 | High | 7.5 | 2020-03-02 | A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attacke… |
CVE-2019-14892 | Critical | 9.8 | 2020-03-02 | A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious obj… |
CVE-2019-20489 | Critical | 9.8 | 2020-03-02 | An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface (setup.cgi) has an authentication bypass and other problems that ul… |
CVE-2019-20488 | Critical | 9.8 | 2020-03-02 | An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the web management interface (setup.cgi) are vulnerable to command injec… |
CVE-2019-20487 | High | 8.8 | 2020-03-02 | An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the WNR1000V4 web management console are vulnerable to an unauthenticate… |
CVE-2019-20486 | Medium | 6.1 | 2020-03-02 | An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple pages (setup.cgi and adv_index.htm) within the web management console are vulnerable to… |
CVE-2019-18901 | Medium | 5.1 | 2020-03-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Ente… |
CVE-2019-18897 | High | 8.4 | 2020-03-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE F… |
CVE-2019-12183 | High | 7.5 | 2020-03-02 | Incorrect Access Control in Safescan Timemoto TM-616 and TA-8000 series allows remote attackers to read any file via the administrative API. |
CVE-2019-17026 | High | 8.8 | 2020-03-02 | Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild a… |
CVE-2019-7007 | High | 7.5 | 2020-02-28 | A directory traversal vulnerability has been found in the Avaya Equinox Management(iView)versions R9.1.9.0 and earlier. Successful exploitation could potential… |
CVE-2019-4301 | High | 8.4 | 2020-02-28 | BigFix Self-Service Application (SSA) is vulnerable to arbitrary code execution if Javascript code is included in Running Message or Post Message HTML. |
CVE-2019-10805 | High | 7.5 | 2020-02-28 | valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Vali… |
CVE-2019-10804 | Critical | 9.8 | 2020-02-28 | serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" function without an… |
CVE-2019-10803 | Critical | 9.8 | 2020-02-28 | push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable "opt.branch" is not validated before being provided t… |
CVE-2019-10802 | Critical | 9.8 | 2020-02-28 | giting version prior to 0.0.8 allows execution of arbritary commands. The first argument "repo" of function "pull()" is executed by the package without any val… |
CVE-2019-10801 | Critical | 9.8 | 2020-02-28 | enpeem through 2.2.0 allows execution of arbitrary commands. The "options.dir" argument is provided to the "exec" function without any sanitization. |
CVE-2019-19943 | High | 7.5 | 2020-02-28 | The HTTP service in quickweb.exe in Pablo Quick 'n Easy Web Server 3.3.8 allows Remote Unauthenticated Heap Memory Corruption via a large host or domain parame… |
CVE-2019-15609 | Critical | 9.8 | 2020-02-28 | The kill-port-process package version < 2.2.0 is vulnerable to a Command Injection vulnerability. |
CVE-2019-10064 | High | 7.5 | 2020-02-28 | hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which resul… |
CVE-2019-8741 | High | 7.5 | 2020-02-28 | A denial of service issue was addressed with improved input validation. |
CVE-2019-3698 | Medium | 5.7 | 2020-02-28 | UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; op… |
CVE-2019-5326 | High | 7.2 | 2020-02-27 | An administrative application user of or application user with write access to Aruba Airwave VisualRF is able to obtain code execution on the AMP platform. Thi… |
CVE-2019-5323 | High | 7.2 | 2020-02-27 | There are command injection vulnerabilities present in the AirWave application. Certain input fields controlled by an administrative user are not properly sani… |
CVE-2019-4669 | Medium | 6.3 | 2020-02-27 | IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through 19.0.0.3… |
CVE-2019-18238 | High | 7.5 | 2020-02-26 | In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, sensitive information is stored in conf… |
CVE-2019-17275 | Critical | 9.8 | 2020-02-26 | OnCommand Cloud Manager versions prior to 3.8.0 are susceptible to arbitrary code execution by remote attackers. |
CVE-2019-17274 | High | 7.8 | 2020-02-26 | NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that… |
CVE-2019-4726 | Medium | 4.3 | 2020-02-26 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malic… |
CVE-2019-4598 | Medium | 6.3 | 2020-02-26 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL stateme… |
CVE-2019-4597 | Medium | 6.3 | 2020-02-26 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL stateme… |
CVE-2019-4596 | Medium | 5.4 | 2020-02-26 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary… |
CVE-2019-4537 | Medium | 5.3 | 2020-02-26 | IBM WebSphere Service Registry and Repository 8.5 could allow a user to obtain sensitive version information that could be used in further attacks against the… |
CVE-2019-19994 | Critical | 9.8 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows blind Command Injection. An attacker without authentication is ab… |
CVE-2019-19993 | Medium | 5.3 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several full path disclosure vulnerability were discovered. A user, even wi… |
CVE-2019-19992 | Medium | 6.5 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. A user with valid credentials is able to read XML files on the filesystem v… |
CVE-2019-19991 | Medium | 5.4 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Multiple Reflected Cross-site scripting (XSS) vulnerabilities allow remote… |
CVE-2019-19990 | Medium | 5.4 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Multiple Stored Cross-site scripting (XSS) vulnerabilities allow remote aut… |
CVE-2019-19989 | High | 7.5 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several PHP pages, and other type of files, are reachable by any user witho… |
CVE-2019-19988 | High | 8.8 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. A user with valid credentials is able to create and write XML files on the… |
CVE-2019-19987 | Medium | 6.5 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows Cross-Site Request Forgery (CSRF) on any HTML form. An attacker c… |
CVE-2019-19986 | High | 7.5 | 2020-02-26 | An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. An attacker without authentication is able to execute arbitrary SQL SELECT… |
CVE-2019-19134 | Medium | 6.1 | 2020-02-26 | The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to su… |
CVE-2019-4000 | High | 7.8 | 2020-02-25 | Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attacker to execute arbit… |
CVE-2019-3999 | High | 7.8 | 2020-02-25 | Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attacker to execute arbi… |
CVE-2019-12863 | Medium | 4.8 | 2020-02-25 | SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings screen. |
CVE-2019-5165 | High | 7.2 | 2020-02-25 | An exploitable authentication bypass vulnerability exists in the hostname processing of the Moxa AWK-3131A firmware version 1.13. A specially configured device… |
CVE-2019-5162 | High | 8.8 | 2020-02-25 | An exploitable improper access control vulnerability exists in the iw_webs account settings functionality of the Moxa AWK-3131A firmware version 1.13. A specia… |
CVE-2019-5153 | High | 8.8 | 2020-02-25 | An exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality of the Moxa AWK-3131A firmware version 1.13. A spe… |
CVE-2019-5148 | High | 7.5 | 2020-02-25 | An exploitable denial-of-service vulnerability exists in ServiceAgent functionality of the Moxa AWK-3131A, firmware version 1.13. A specially crafted packet ca… |
CVE-2019-5143 | High | 8.8 | 2020-02-25 | An exploitable format string vulnerability exists in the iw_console conio_writestr functionality of the Moxa AWK-3131A firmware version 1.13. A specially craft… |
CVE-2019-5142 | High | 7.2 | 2020-02-25 | An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to n… |
CVE-2019-5141 | High | 8.8 | 2020-02-25 | An exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted iw_serverip… |
CVE-2019-5140 | High | 8.8 | 2020-02-25 | An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic s… |
CVE-2019-5139 | High | 7.1 | 2020-02-25 | An exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities of the Moxa AWK-3131A firmware version 1.13. The device operating… |
CVE-2019-5138 | Critical | 9.9 | 2020-02-25 | An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A firmware version 1.13. A specially cra… |
CVE-2019-5137 | High | 7.5 | 2020-02-25 | The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network from or to the Moxa… |
CVE-2019-5136 | High | 8.8 | 2020-02-25 | An exploitable privilege escalation vulnerability exists in the iw_console functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted menu… |
CVE-2019-4672 | Medium | 5.3 | 2020-02-25 | IBM QRadar Advisor 1.1 through 2.5 could allow an unauthorized attacker to obtain sensitive information from specially crafted HTTP requests that could aid in… |
CVE-2019-4557 | High | 7.5 | 2020-02-25 | IBM Qradar Advisor 1.1 through 2.5 with Watson uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive info… |
CVE-2019-17569 | Medium | 4.8 | 2020-02-24 | The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that… |
CVE-2019-17229 | Medium | 6.1 | 2020-02-24 | includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multipl… |
CVE-2019-17228 | Medium | 6.5 | 2020-02-24 | includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unau… |
CVE-2019-12513 | Medium | 6.1 | 2020-02-24 | In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending a DHCP discover request containing a malicious hostname field, an attacker may execute stored XSS a… |
CVE-2019-12512 | Medium | 6.1 | 2020-02-24 | In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, an attacker may execute stored XSS attacks against this device by supplying a malicious X-Forwarded-For header… |
CVE-2019-12511 | Critical | 9.8 | 2020-02-24 | In NETGEAR Nighthawk X10-R9000 prior to 1.0.4.26, an attacker may execute arbitrary system commands as root by sending a specially-crafted MAC address to the "… |
CVE-2019-12510 | Critical | 9.1 | 2020-02-24 | In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker may bypass all authentication checks on the device's "NETGEAR Genie" SOAP API ("/soap/server_sa")… |
CVE-2019-10799 | High | 8.2 | 2020-02-24 | compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExit(cssPath)" within "dist/index.js" is executed as part of th… |
CVE-2019-10798 | Medium | 5.3 | 2020-02-24 | rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method could be tricked into… |
CVE-2019-10796 | Critical | 9.8 | 2020-02-24 | rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of e… |
CVE-2019-4745 | Medium | 4.3 | 2020-02-24 | IBM Maximo Asset Management 7.6.1.0 could allow a remote attacker to disclose sensitive information to an authenticated user due to disclosing path information… |
CVE-2019-4703 | Medium | 5.3 | 2020-02-24 | IBM Spectrum Protect Plus 10.1.0 and 10.5.0, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with intimate knowledge of the system… |
CVE-2019-4595 | Medium | 6.1 | 2020-02-24 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack… |
CVE-2019-20481 | Critical | 9.8 | 2020-02-24 | In MIELE XGW 3000 ZigBee Gateway before 2.4.0, the Password Change Function does not require knowledge of the old password. This can be exploited in conjunctio… |
CVE-2019-20480 | High | 8.8 | 2020-02-24 | In MIELE XGW 3000 ZigBee Gateway before 2.4.0, a malicious website visited by an authenticated admin user or a malicious mail is allowed to make arbitrary chan… |
CVE-2019-18183 | Critical | 9.8 | 2020-02-24 | pacman before 5.2 is vulnerable to arbitrary command injection in lib/libalpm/sync.c in the apply_deltas() function. This can be exploited when unsigned databa… |
CVE-2019-18182 | Critical | 9.8 | 2020-02-24 | pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the download_with_xfercommand() function. This can be exploited when unsigned datab… |
CVE-2019-20044 | High | 7.8 | 2020-02-24 | In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the… |
CVE-2019-15299 | High | 8.8 | 2020-02-24 | An issue was discovered in Centreon Web through 19.04.3. When a user changes his password on his profile page, the contact_autologin_key field in the database… |
CVE-2019-3670 | High | 8.0 | 2020-02-24 | Remote Code Execution vulnerability in the web interface in McAfee Web Advisor (WA) 8.0.34745 and earlier allows remote unauthenticated attacker to execute arb… |