2019 CVEs (page 26)
Page 26 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-18846 | Medium | 5.0 | 2020-02-21 | OX App Suite through 7.10.2 allows SSRF. |
CVE-2019-19866 | High | 7.5 | 2020-02-21 | Atos Unify OpenScape UC Web Client V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows remote attackers to obtain sensitive information. By i… |
CVE-2019-19865 | Medium | 6.1 | 2020-02-21 | Atos Unify OpenScape UC Application V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows XSS. An attacker could exploit this by convincing an… |
CVE-2019-19452 | High | 7.8 | 2020-02-21 | A buffer overflow was found in Patriot Viper RGB through 1.1 when processing IoControlCode 0x80102040. Local attackers (including low integrity processes) can… |
CVE-2019-19694 | Medium | 4.7 | 2020-02-20 | The Trend Micro Security 2019 (15.0.0.1163 and below) consumer family of products is vulnerable to a denial of service (DoS) attack in which a malicious actor… |
CVE-2019-14688 | High | 7.0 | 2020-02-20 | Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnera… |
CVE-2019-16302 | High | 7.5 | 2020-02-20 | An issue was discovered in Open Network Operating System (ONOS) 1.14. In the Ethernet VPN application (org.onosproject.evpnopenflow), the host event listener d… |
CVE-2019-16301 | High | 7.5 | 2020-02-20 | An issue was discovered in Open Network Operating System (ONOS) 1.14. In the virtual tenant network application (org.onosproject.vtn), the host event listener… |
CVE-2019-16300 | High | 7.5 | 2020-02-20 | An issue was discovered in Open Network Operating System (ONOS) 1.14. In the access control application (org.onosproject.acl), the host event listener does not… |
CVE-2019-16299 | High | 7.5 | 2020-02-20 | An issue was discovered in Open Network Operating System (ONOS) 1.14. In the mobility application (org.onosproject.mobility), the host event listener does not… |
CVE-2019-16298 | High | 7.5 | 2020-02-20 | An issue was discovered in Open Network Operating System (ONOS) 1.14. In the virtual broadband network gateway application (org.onosproject.virtualbng), the ho… |
CVE-2019-16297 | High | 7.5 | 2020-02-20 | An issue was discovered in Open Network Operating System (ONOS) 1.14. In the P4 tutorial application (org.onosproject.p4tutorial), the host event listener does… |
CVE-2019-11189 | High | 7.5 | 2020-02-20 | Authentication Bypass by Spoofing in org.onosproject.acl (access control) and org.onosproject.mobility (host mobility) in ONOS v2.0 and earlier allows attacker… |
CVE-2019-4752 | High | 8.8 | 2020-02-20 | IBM Emptoris Spend Analysis and IBM Emptoris Strategic Supply Management Platform 10.1.0.x, 10.1.1.x, and 10.1.3.x is vulnerable to SQL injection. A remote att… |
CVE-2019-4583 | Medium | 4.3 | 2020-02-20 | IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from a stack trace that could be used to aid… |
CVE-2019-19741 | High | 7.8 | 2020-02-20 | Electronic Arts Origin 10.5.55.33574 is vulnerable to local privilege escalation due to arbitrary directory DACL manipulation, a different issue than CVE-2019-… |
CVE-2019-20479 | Medium | 6.1 | 2020-02-20 | A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a slash and backslash at the beginning. |
CVE-2019-1950 | High | 8.4 | 2020-02-19 | A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, local attacker to gain unauthorized access to an affected device. The vulnerabi… |
CVE-2019-17333 | Medium | 5.4 | 2020-02-19 | The Web server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows authenticated users to perform stored cross-site… |
CVE-2019-10797 | Medium | 6.5 | 2020-02-19 | Netty in WSO2 transport-http before v6.3.1 is vulnerable to HTTP Response Splitting due to HTTP Header validation being disabled. |
CVE-2019-12437 | High | 8.8 | 2020-02-19 | In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations, |
CVE-2019-12246 | Medium | 4.3 | 2020-02-19 | SilverStripe through 4.3.3 allows a Denial of Service on flush and development URL tools. |
CVE-2019-4640 | Critical | 9.8 | 2020-02-19 | IBM Security Secret Server 10.7 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code which co… |
CVE-2019-4457 | Medium | 6.5 | 2020-02-19 | IBM Jazz Foundation 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 could allow an authenticated user to obtain sensitive information that could be… |
CVE-2019-4429 | Medium | 5.4 | 2020-02-19 | IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the We… |
CVE-2019-20478 | Critical | 9.8 | 2020-02-19 | In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, th… |
CVE-2019-20477 | Critical | 9.8 | 2020-02-19 | PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in t… |
CVE-2019-10791 | Critical | 9.8 | 2020-02-18 | promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by user… |
CVE-2019-5613 | Critical | 9.8 | 2020-02-18 | In FreeBSD 12.0-RELEASE before 12.0-RELEASE-p13, a missing check in the ipsec packet processor allows reinjection of an old packet to be accepted by the ipsec… |
CVE-2019-18352 | High | 8.2 | 2020-02-18 | Improper access control exists on PHOENIX CONTACT FL NAT 2208 devices before V2.90 and FL NAT 2304-2GC-2SFP devices before V2.90 when using MAC-based port secu… |
CVE-2019-15875 | Low | 3.3 | 2020-02-18 | In FreeBSD 12.1-STABLE before r354734, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r354735, and 11.3-RELEASE… |
CVE-2019-10795 | Medium | 6.3 | 2020-02-18 | undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object.prototype using a… |
CVE-2019-10794 | Medium | 6.3 | 2020-02-18 | All versions of component-flatten are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties of Object.prototyp… |
CVE-2019-10793 | Medium | 6.3 | 2020-02-18 | dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Object.prototype using a… |
CVE-2019-10792 | Medium | 6.3 | 2020-02-18 | bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Object.prototype using… |
CVE-2019-19325 | Medium | 6.1 | 2020-02-17 | SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML… |
CVE-2019-10790 | High | 7.5 | 2020-02-17 | taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-input processed by t… |
CVE-2019-20474 | Medium | 4.3 | 2020-02-17 | An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configuration suffers from an authorization issue… |
CVE-2019-18998 | High | 7.1 | 2020-02-17 | Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full acce… |
CVE-2019-12954 | Medium | 5.4 | 2020-02-17 | SolarWinds Network Performance Monitor (Orion Platform 2018, NPM 12.3, NetPath 1.1.3) allows XSS by authenticated users via a crafted onerror attribute of a VI… |
CVE-2019-12825 | Medium | 4.3 | 2020-02-17 | Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated remote attackers ca… |
CVE-2019-20456 | High | 7.8 | 2020-02-16 | Goverlan Reach Console before 9.50, Goverlan Reach Server before 3.50, and Goverlan Client Agent before 9.20.50 have an Untrusted Search Path that leads to Com… |
CVE-2019-5187 | High | 8.8 | 2020-02-14 | An exploitable out-of-bounds write vulnerability exists in the TIFreadstripdata function of the igcore19d.dll library of Accusoft ImageGear 19.5.0. A specially… |
CVE-2019-4392 | Critical | 9.8 | 2020-02-14 | HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access to the system. |
CVE-2019-15594 | Medium | 4.3 | 2020-02-14 | GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint. |
CVE-2019-15592 | Medium | 4.3 | 2020-02-14 | GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via… |
CVE-2019-13967 | High | 7.5 | 2020-02-14 | iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) via many requests to launch a compile operation. The request… |
CVE-2019-13966 | Medium | 6.1 | 2020-02-14 | In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard. This is similar to CVE-201… |
CVE-2019-13965 | Medium | 6.1 | 2020-02-14 | Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via the param_file parameter to webservices… |
CVE-2019-11215 | High | 8.1 | 2020-02-14 | In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader wit… |
CVE-2019-6195 | Medium | 4.8 | 2020-02-14 | An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user… |
CVE-2019-6194 | Medium | 5.7 | 2020-02-14 | An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow information… |
CVE-2019-6193 | High | 7.5 | 2020-02-14 | An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauthenticated access to… |
CVE-2019-6190 | Medium | 5.0 | 2020-02-14 | Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and ThinkStati… |
CVE-2019-20046 | Critical | 9.8 | 2020-02-14 | The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. The affected product does not requi… |
CVE-2019-20045 | High | 7.5 | 2020-02-14 | The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. Specially crafted malicious packets… |
CVE-2019-19879 | High | 7.5 | 2020-02-14 | HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions. Fixed in 0.10.2. |
CVE-2019-19758 | Medium | 6.1 | 2020-02-14 | A vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1.406.34763 and prior could allow an unauthenticated, remote at… |
CVE-2019-19757 | Medium | 5.4 | 2020-02-14 | An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability in… |
CVE-2019-20455 | Medium | 5.9 | 2020-02-14 | Gateways/Gateway.php in Heartland & Global Payments PHP SDK before 2.0.0 does not enforce SSL certificate validations. |
CVE-2019-20454 | High | 7.5 | 2020-02-14 | An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. App… |
CVE-2019-3998 | Medium | 5.5 | 2020-02-13 | Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated attacker to modify the Wi-Fi network th… |
CVE-2019-14598 | Medium | 6.7 | 2020-02-13 | Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versions 14.0 through 1… |
CVE-2019-10785 | Medium | 6.1 | 2020-02-13 | dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xm… |
CVE-2019-4666 | Low | 2.3 | 2020-02-13 | IBM UrbanCode Deploy (UCD) 7.0.3 and IBM UrbanCode Build 6.1.5 could allow a local user to obtain sensitive information by unmasking certain secure values in d… |
CVE-2019-4592 | High | 7.5 | 2020-02-13 | IBM Tivoli Monitoring Service 6.3.0.7.3 through 6.3.0.7.10 could allow an unauthorized user to access and modify operation aspects of the ITM monitoring server… |
CVE-2019-18791 | Medium | 5.4 | 2020-02-13 | Lexmark printer MS812 and multiple older generation Lexmark devices have a stored XSS vulnerability in the embedded web server. The vulnerability can be exploi… |
CVE-2019-2200 | High | 7.3 | 2020-02-13 | In updatePermissions of PermissionManagerService.java, it may be possible for a malicious app to obtain a custom permission from another app due to a permissio… |
CVE-2019-14652 | Medium | 6.1 | 2020-02-13 | explorer.js in Amazon AWS JavaScript S3 Explorer (aka aws-js-s3-explorer) v2 alpha before 2019-08-02 allows XSS in certain circumstances. |
CVE-2019-5322 | High | 7.5 | 2020-02-13 | A remotely exploitable information disclosure vulnerability is present in Aruba Intelligent Edge Switch models 5400, 3810, 2920, 2930, 2530 with GigT port, 253… |
CVE-2019-18915 | High | 7.8 | 2020-02-13 | A potential security vulnerability has been identified with certain versions of HP System Event Utility prior to version 1.4.33. This vulnerability may allow a… |
CVE-2019-19192 | Medium | 6.5 | 2020-02-12 | The Bluetooth Low Energy implementation on STMicroelectronics BLE Stack through 1.3.1 for STM32WB5x devices does not properly handle consecutive Attribute Prot… |
CVE-2019-17519 | High | 8.8 | 2020-02-12 | The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers… |
CVE-2019-16336 | Medium | 6.5 | 2020-02-12 | The Bluetooth Low Energy implementation in Cypress PSoC 4 BLE component 3.61 and earlier processes data channel frames with a payload length larger than the co… |
CVE-2019-11867 | Medium | 5.5 | 2020-02-12 | Realtek NDIS driver rt640x64.sys, file version 10.1.505.2015, fails to do any size checking on an input buffer from user space, which the driver assumes has a… |
CVE-2019-4741 | Medium | 5.3 | 2020-02-12 | IBM Content Navigator 3.0CD is vulnerable to Server Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from… |
CVE-2019-4431 | Medium | 5.4 | 2020-02-12 | IBM Rational Publishing Engine 6.0.6 and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t… |
CVE-2019-4427 | High | 7.5 | 2020-02-12 | IBM Cloud CLI 0.6.0 through 0.16.1 windows installers are signed using SHA1 certificate. An attacker might be able to exploit the weak algorithm to generate a… |
CVE-2019-19921 | High | 7.0 | 2020-02-12 | runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker… |
CVE-2019-19196 | Medium | 6.5 | 2020-02-12 | The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0… |
CVE-2019-19194 | High | 8.8 | 2020-02-12 | The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0… |
CVE-2019-20100 | Medium | 4.7 | 2020-02-12 | The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). The following versions are affected: all versions prior to 5.4.21, f… |
CVE-2019-20099 | Medium | 4.3 | 2020-02-12 | The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSR… |
CVE-2019-20098 | Medium | 4.3 | 2020-02-12 | The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CS… |
CVE-2019-13946 | High | 7.5 | 2020-02-11 | Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent… |
CVE-2019-13941 | High | 7.5 | 2020-02-11 | A vulnerability has been identified in OZW672 (All versions < V10.00), OZW772 (All versions < V10.00). Vulnerable versions of OZW Web Server use predictable pa… |
CVE-2019-13940 | Medium | 5.3 | 2020-02-11 | A vulnerability has been identified in SIMATIC ET 200pro IM154-8 PN/DP CPU (All versions < V3.X.17), SIMATIC ET 200pro IM154-8F PN/DP CPU (All versions < V3.X… |
CVE-2019-13926 | High | 7.5 | 2020-02-11 | A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All ver… |
CVE-2019-13925 | High | 7.5 | 2020-02-11 | A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All ver… |
CVE-2019-13924 | Medium | 5.4 | 2020-02-11 | A vulnerability has been identified in SCALANCE S602 (All versions < V4.1), SCALANCE S612 (All versions < V4.1), SCALANCE S623 (All versions < V4.1), SCALANCE… |
CVE-2019-18210 | Medium | 5.4 | 2020-02-11 | Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the session of another u… |
CVE-2019-14514 | Critical | 9.8 | 2020-02-11 | An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd… |
CVE-2019-6744 | Medium | 4.3 | 2020-02-10 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Samsung Knox 1.2.02.39 on Samsung Galaxy S9 build G960… |
CVE-2019-19195 | Medium | 6.5 | 2020-02-10 | The Bluetooth Low Energy implementation on Microchip Technology BluSDK Smart through 6.2 for ATSAMB11 devices does not properly restrict link-layer data length… |
CVE-2019-19193 | Medium | 6.5 | 2020-02-10 | The Bluetooth Low Energy peripheral implementation on Texas Instruments SIMPLELINK-CC2640R2-SDK through 3.30.00.20 and BLE-STACK through 1.5.0 before Q4 2019 f… |
CVE-2019-17520 | Medium | 6.5 | 2020-02-10 | The Bluetooth Low Energy implementation on Texas Instruments SDK through 3.30.00.20 for CC2640R2 devices does not properly restrict the SM Public Key packet on… |
CVE-2019-17518 | Medium | 6.5 | 2020-02-10 | The Bluetooth Low Energy implementation on Dialog Semiconductor SDK through 1.0.14.1081 for DA1468x devices responds to link layer packets with a payload lengt… |
CVE-2019-17517 | Medium | 5.7 | 2020-02-10 | The Bluetooth Low Energy implementation on Dialog Semiconductor SDK through 5.0.4 for DA14580/1/2/3 devices does not properly restrict the L2CAP payload length… |
CVE-2019-17137 | Critical | 9.4 | 2020-02-10 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart… |
CVE-2019-17061 | Medium | 6.5 | 2020-02-10 | The Bluetooth Low Energy (BLE) stack implementation on Cypress PSoC 4 through 3.62 devices does not properly restrict the BLE Link Layer header and executes ce… |