2019 CVEs (page 27)
Page 27 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-17060 | Medium | 6.5 | 2020-02-10 | The Bluetooth Low Energy (BLE) stack implementation on the NXP KW41Z (based on the MCUXpresso SDK with Bluetooth Low Energy Driver 2.2.1 and earlier) does not… |
CVE-2019-13322 | High | 8.8 | 2020-02-10 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Browser Prior to 10.4.0. User interaction is require… |
CVE-2019-13321 | High | 8.0 | 2020-02-10 | This vulnerability allows network adjacent attackers to execute arbitrary code on affected installations of Xiaomi Browser Prior to 10.4.0. User interaction is… |
CVE-2019-19668 | Medium | 4.3 | 2020-02-10 | A CSRF vulnerability exists in the File Types component of Web File Manager in Rumpus FTP 8.2.9.1 that allows an attacker to add or delete the file types that… |
CVE-2019-19670 | Medium | 6.1 | 2020-02-10 | A HTTP Response Splitting vulnerability was identified in the Web Settings Component of Web File Manager in Rumpus FTP Server 8.2.9.1. A successful exploit can… |
CVE-2019-19669 | Medium | 6.5 | 2020-02-10 | A CSRF vulnerability exists in the Upload Center Forms Component of Web File Manager in Rumpus FTP 8.2.9.1. This could allow an attacker to delete, create, and… |
CVE-2019-19667 | Medium | 5.4 | 2020-02-10 | A CSRF vulnerability exists in the Block Clients component of Web File Manager in Rumpus FTP 8.2.9.1 that could allow an attacker to whitelist or block any IP… |
CVE-2019-19666 | Medium | 4.3 | 2020-02-10 | A CSRF vulnerability exists in the Event Notices Settings of Web File Manager in Rumpus FTP 8.2.9.1. An attacker can create/update event notices via RAPR/Event… |
CVE-2019-19661 | Medium | 6.1 | 2020-02-10 | A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1, related to RumpusLoginUserName and snp. |
CVE-2019-19664 | High | 7.1 | 2020-02-10 | A CSRF vulnerability exists in the Web Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Ser… |
CVE-2019-19662 | Medium | 6.5 | 2020-02-10 | A CSRF vulnerability exists in the Web File Manager's Create/Delete Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can Crea… |
CVE-2019-19665 | Medium | 6.5 | 2020-02-10 | A CSRF vulnerability exists in the FTP Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Ser… |
CVE-2019-19663 | Medium | 6.5 | 2020-02-10 | A CSRF vulnerability exists in the Folder Sets Settings of Web File Manager in Rumpus FTP 8.2.9.1. This allows an attacker to Create/Delete Folders after explo… |
CVE-2019-19660 | Medium | 6.5 | 2020-02-10 | A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can manipulate… |
CVE-2019-19659 | High | 8.8 | 2020-02-10 | A CSRF vulnerability exists in the Web File Manager's Edit Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can take over a u… |
CVE-2019-20451 | Critical | 9.8 | 2020-02-10 | The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk and requesting /RE… |
CVE-2019-20062 | Critical | 9.8 | 2020-02-10 | MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash (the hash never expires until used). |
CVE-2019-20061 | High | 7.5 | 2020-02-10 | The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password if this email is sent in cleartext. In other wor… |
CVE-2019-20060 | High | 7.5 | 2020-02-10 | MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks, then third parties may discover password-reset has… |
CVE-2019-20059 | High | 8.8 | 2020-02-10 | payment_manage.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly insert values from the sSortDir_0 parameter into a SQ… |
CVE-2019-11485 | Low | 3.3 | 2020-02-08 | Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash handling. |
CVE-2019-11484 | Medium | 6.3 | 2020-02-08 | Kevin Backhouse discovered an integer overflow in bson_ensure_space, as used in whoopsie. |
CVE-2019-11483 | High | 7.0 | 2020-02-08 | Sander Bos discovered Apport mishandled crash dumps originating from containers. This could be used by a local attacker to generate a crash report for a privil… |
CVE-2019-11482 | Medium | 4.2 | 2020-02-08 | Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to cause core files to be written in arbitrary direc… |
CVE-2019-11481 | Low | 3.8 | 2020-02-08 | Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a us… |
CVE-2019-17136 | High | 7.8 | 2020-02-08 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to… |
CVE-2019-17135 | High | 7.8 | 2020-02-08 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to… |
CVE-2019-13334 | High | 7.8 | 2020-02-08 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to… |
CVE-2019-13333 | High | 7.8 | 2020-02-08 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to… |
CVE-2019-19356 | High | 7.5 | 2020-02-07 | Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in fir… |
CVE-2019-13163 | Medium | 5.9 | 2020-02-07 | The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage App… |
CVE-2019-18988 | High | 7.0 | 2020-02-07 | TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It use… |
CVE-2019-16155 | High | 7.1 | 2020-02-07 | A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to overwrite system files as root with arbitr… |
CVE-2019-15606 | Critical | 9.8 | 2020-02-07 | Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons |
CVE-2019-15605 | Critical | 9.8 | 2020-02-07 | HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed |
CVE-2019-15604 | High | 7.5 | 2020-02-07 | Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate |
CVE-2019-17268 | Critical | 9.8 | 2020-02-07 | The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0… |
CVE-2019-14088 | High | 7.8 | 2020-02-07 | Possible use after free issue while CRM is accessing the link pointer from device private data due to lack of resource protection in Snapdragon Auto, Snapdrago… |
CVE-2019-14063 | Critical | 9.1 | 2020-02-07 | Out of bound access due to Invalid inputs to dapm mux settings which results into kernel failure in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IO… |
CVE-2019-14060 | High | 7.8 | 2020-02-07 | Uninitialized stack data gets used If memory is not allocated for blob or if the allocated blob is less than the struct size required due to lack of check of r… |
CVE-2019-14057 | Critical | 9.1 | 2020-02-07 | Buffer Over read of codec private data while parsing an mkv file due to lack of check of buffer size before read in Snapdragon Auto, Snapdragon Compute, Snapdr… |
CVE-2019-14055 | High | 7.8 | 2020-02-07 | Possibility of use-after-free and double free because of not marking buffer as NULL after freeing can lead to dangling pointer access in Snapdragon Auto, Snapd… |
CVE-2019-14051 | High | 7.8 | 2020-02-07 | Subsequent additions performed during Module loading while allocating the memory would lead to integer overflow and then to buffer overflow in Snapdragon Indus… |
CVE-2019-14049 | High | 7.8 | 2020-02-07 | Stage-2 fault will occur while writing to an ION system allocation which has been assigned to non-HLOS memory which is non-standard in Snapdragon Auto, Snapdra… |
CVE-2019-14046 | High | 7.8 | 2020-02-07 | Out of bound access while allocating memory for an array in camera due to improper validation of elements parameters in Snapdragon Auto, Snapdragon Compute, Sn… |
CVE-2019-14044 | High | 7.8 | 2020-02-07 | Out of bound access due to access of uninitialized memory segment in an array of pointers while normal camera open close in Snapdragon Consumer IOT, Snapdragon… |
CVE-2019-14041 | High | 7.8 | 2020-02-07 | During listener modified response processing, a buffer overrun occurs due to lack of buffer size verification when updating message buffer with physical addres… |
CVE-2019-14040 | High | 7.8 | 2020-02-07 | Using memory after being freed in qsee due to wrong implementation can lead to unexpected behavior such as execution of unknown code in Snapdragon Auto, Snapdr… |
CVE-2019-14002 | High | 7.8 | 2020-02-07 | APKs without proper permission may bind to CallEnhancementService and can lead to unauthorized access to call status in Snapdragon Auto, Snapdragon Compute, Sn… |
CVE-2019-10590 | Critical | 9.8 | 2020-02-07 | Out of bound access while parsing dts atom, which is non-standard as it does not have valid number of tracks in Snapdragon Auto, Snapdragon Compute, Snapdragon… |
CVE-2019-10567 | High | 7.8 | 2020-02-07 | There is a way to deceive the GPU kernel driver into thinking there is room in the GPU ringbuffer and overwriting existing commands could allow unintended GPU… |
CVE-2019-19800 | Medium | 5.3 | 2020-02-06 | Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet. |
CVE-2019-12426 | Medium | 5.3 | 2020-02-06 | an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.11.06 |
CVE-2019-17652 | Medium | 6.5 | 2020-02-06 | A stack buffer overflow vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to cause FortiClient processes running under… |
CVE-2019-16152 | Medium | 6.5 | 2020-02-06 | A Denial of service (DoS) vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to cause FortiClient processes running un… |
CVE-2019-15711 | High | 7.8 | 2020-02-06 | A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to run system commands under root privilege… |
CVE-2019-10789 | Critical | 9.8 | 2020-02-06 | All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization. |
CVE-2019-20406 | High | 7.8 | 2020-02-06 | The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local syst… |
CVE-2019-20405 | Medium | 4.3 | 2020-02-06 | The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a C… |
CVE-2019-20404 | Medium | 4.3 | 2020-02-06 | The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access… |
CVE-2019-20403 | Medium | 5.3 | 2020-02-06 | The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an informati… |
CVE-2019-20402 | Medium | 4.9 | 2020-02-06 | Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user t… |
CVE-2019-20401 | Medium | 6.5 | 2020-02-06 | Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being install… |
CVE-2019-20400 | High | 7.8 | 2020-02-06 | The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global path environmental var… |
CVE-2019-20106 | Medium | 4.3 | 2020-02-06 | Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remo… |
CVE-2019-20104 | High | 7.5 | 2020-02-06 | The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Servi… |
CVE-2019-20447 | Critical | 9.8 | 2020-02-05 | Jobberbase 2.0 has SQL injection via the PATH_INFO to the jobs-in endpoint. |
CVE-2019-20173 | Medium | 6.1 | 2020-02-05 | The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php. |
CVE-2019-15253 | Medium | 4.8 | 2020-02-05 | A vulnerability in the web-based management interface of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to condu… |
CVE-2019-15126 | Low | 3.1 | 2020-02-05 | An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) i… |
CVE-2019-12180 | High | 7.8 | 2020-02-05 | An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically… |
CVE-2019-11516 | High | 8.1 | 2020-02-05 | An issue was discovered in the Bluetooth component of the Cypress (formerly owned by Broadcom) Wireless IoT codebase. Extended Inquiry Responses (EIRs) are imp… |
CVE-2019-4670 | Medium | 6.5 | 2020-02-05 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper data representation. I… |
CVE-2019-4616 | Low | 3.5 | 2020-02-05 | IBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie valu… |
CVE-2019-4613 | High | 8.8 | 2020-02-05 | IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… |
CVE-2019-16204 | High | 7.5 | 2020-02-05 | Brocade Fabric OS Versions before v7.4.2f, v8.2.2a, v8.1.2j and v8.2.1d could expose external passwords, common secrets or authentication keys used between the… |
CVE-2019-16203 | High | 7.5 | 2020-02-05 | Brocade Fabric OS Versions before v8.2.2a and v8.2.1d could expose the credentials of the remote ESRS server when these credentials are given as a command line… |
CVE-2019-12528 | High | 7.5 | 2020-02-04 | An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as informati… |
CVE-2019-10788 | Critical | 9.8 | 2020-02-04 | im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary commands as part of… |
CVE-2019-10787 | Critical | 9.8 | 2020-02-04 | im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled… |
CVE-2019-10786 | Critical | 9.8 | 2020-02-04 | network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument. |
CVE-2019-15624 | Medium | 4.9 | 2020-02-04 | Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders. |
CVE-2019-15623 | Medium | 5.3 | 2020-02-04 | Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any furthe… |
CVE-2019-15622 | Low | 2.4 | 2020-02-04 | Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom quer… |
CVE-2019-15621 | Medium | 6.5 | 2020-02-04 | Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a shar… |
CVE-2019-15620 | Low | 2.7 | 2020-02-04 | Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the proje… |
CVE-2019-15619 | Medium | 4.8 | 2020-02-04 | Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an X… |
CVE-2019-15618 | Medium | 4.8 | 2020-02-04 | Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location. |
CVE-2019-15617 | Medium | 5.4 | 2020-02-04 | A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login. |
CVE-2019-15616 | Medium | 4.3 | 2020-02-04 | Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long. |
CVE-2019-15615 | Medium | 6.1 | 2020-02-04 | A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past. |
CVE-2019-15614 | Medium | 5.4 | 2020-02-04 | Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files. |
CVE-2019-15613 | High | 8.0 | 2020-02-04 | A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes. |
CVE-2019-15612 | Medium | 5.9 | 2020-02-04 | A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset. |
CVE-2019-15611 | Medium | 4.9 | 2020-02-04 | Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federat… |
CVE-2019-15610 | Medium | 4.3 | 2020-02-04 | Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle. |
CVE-2019-10784 | Critical | 9.6 | 2020-02-04 | phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, "databas… |
CVE-2019-4675 | Critical | 9.8 | 2020-02-04 | IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2019-4674 | Medium | 4.9 | 2020-02-04 | IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request… |
CVE-2019-4562 | Medium | 5.3 | 2020-02-04 | IBM Security Directory Server 6.4.0 stores sensitive information in URLs. This may lead to information disclosure if unauthorized parties have access to the UR… |