2019 CVEs (page 28)
Page 28 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-4551 | Medium | 5.3 | 2020-02-04 | IBM Security Directory Server 6.4.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protec… |
CVE-2019-4550 | Medium | 5.3 | 2020-02-04 | IBM Security Directory Server 6.4.0 is deployed with active debugging code that can create unintended entry points. IBM X-Force ID: 165952. |
CVE-2019-4548 | Medium | 6.1 | 2020-02-04 | IBM Security Directory Server 6.4.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web… |
CVE-2019-4541 | High | 7.2 | 2020-02-04 | IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct… |
CVE-2019-4540 | High | 7.5 | 2020-02-04 | IBM Security Directory Server 6.4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IB… |
CVE-2019-4451 | Medium | 5.4 | 2020-02-04 | IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu… |
CVE-2019-19273 | High | 7.8 | 2020-02-04 | On Samsung mobile devices with O(8.0) and P(9.0) software and an Exynos 8895 chipset, RKP (aka the Samsung Hypervisor EL2 implementation) allows arbitrary memo… |
CVE-2019-9674 | High | 7.5 | 2020-02-04 | Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. |
CVE-2019-19968 | Medium | 5.4 | 2020-02-04 | PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Builder components. An authenticated user c… |
CVE-2019-9502 | High | 7.9 | 2020-02-03 | The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than 164 bytes, a heap buffer over… |
CVE-2019-9501 | High | 7.9 | 2020-02-03 | The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. By supplying a vendor information element with a data length larger than 32 bytes, a heap… |
CVE-2019-20174 | Medium | 6.1 | 2020-02-03 | Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder. |
CVE-2019-18567 | Medium | 6.3 | 2020-02-03 | Bromium client version 4.0.3.2060 and prior to 4.1.7 Update 1 has an out of bound read results in race condition causing Kernel memory leaks or denial of servi… |
CVE-2019-4732 | Medium | 6.5 | 2020-02-03 | IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated att… |
CVE-2019-16893 | High | 7.5 | 2020-02-03 | The Web Management of TP-Link TP-SG105E V4 1.0.0 Build 20181120 devices allows an unauthenticated attacker to reboot the device via a reboot.cgi request. |
CVE-2019-11251 | Medium | 4.8 | 2020-02-03 | The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar… |
CVE-2019-19119 | Medium | 5.5 | 2020-02-03 | An issue was discovered in PRTG 7.x through 19.4.53. Due to insufficient access control on local registry keys for the Core Server Service, a non-administrativ… |
CVE-2019-18193 | High | 7.5 | 2020-02-03 | In Unisys Stealth (core) 3.4.108.0, 3.4.209.x, 4.0.027.x and 4.0.114, key material inadvertently logged under certain conditions. Fixed included in 3.4.109, 4… |
CVE-2019-20446 | Medium | 6.5 | 2020-02-02 | In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The at… |
CVE-2019-3016 | Medium | 6.2 | 2020-01-31 | In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the same guest. This p… |
CVE-2019-13000 | High | 7.5 | 2020-01-31 | Eclair through 0.3 allows attackers to trigger loss of funds because of Incorrect Access Control. NOTE: README.md states "it is beta-quality software and don't… |
CVE-2019-12999 | High | 7.5 | 2020-01-31 | Lightning Network Daemon (lnd) before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control. |
CVE-2019-12998 | High | 7.5 | 2020-01-31 | c-lightning before 0.7.1 allows attackers to trigger loss of funds because of Incorrect Access Control. NOTE: README.md states "It can be used for testing, but… |
CVE-2019-4720 | High | 7.5 | 2020-01-31 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker… |
CVE-2019-19550 | High | 7.5 | 2020-01-31 | Remote Authentication Bypass in Senior Rubiweb 6.2.34.28 and 6.2.34.37 allows admin access to sensitive information of affected users using vulnerable versions… |
CVE-2019-18913 | Medium | 6.8 | 2020-01-31 | A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks. This industry-wide issue requires phys… |
CVE-2019-10782 | Medium | 5.3 | 2020-01-30 | All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix for CVE-2019-9658. |
CVE-2019-20358 | High | 7.8 | 2020-01-30 | Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same dire… |
CVE-2019-17273 | Medium | 6.5 | 2020-01-30 | E-Series SANtricity OS Controller Software version 11.60.0 is susceptible to a vulnerability which allows an attacker to cause a Denial of Service (DoS) in IPv… |
CVE-2019-20050 | Medium | 6.8 | 2020-01-30 | Pandora FMS ≤ 7.42 suffers from a remote code execution vulnerability. To exploit the vulnerability, an authenticated user should create a new folder with a "t… |
CVE-2019-10783 | Critical | 9.8 | 2020-01-29 | All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse… |
CVE-2019-20445 | Critical | 9.1 | 2020-01-29 | HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding hea… |
CVE-2019-20444 | Critical | 9.1 | 2020-01-29 | HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect synta… |
CVE-2019-18634 | High | 7.8 | 2020-01-29 | In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is… |
CVE-2019-7656 | High | 7.8 | 2020-01-29 | A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges to root. The install… |
CVE-2019-7655 | Medium | 5.4 | 2020-01-29 | Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the (1) customList%5B0%5D.value field in enginemanager/server/serv… |
CVE-2019-7654 | Medium | 6.5 | 2020-01-29 | Wowza Streaming Engine 4.8.0 and earlier suffers from multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into ma… |
CVE-2019-20217 | Critical | 9.8 | 2020-01-29 | D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htd… |
CVE-2019-20216 | Critical | 9.8 | 2020-01-29 | D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method in ssdpcgi() in /htd… |
CVE-2019-20215 | Critical | 9.8 | 2020-01-29 | D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi() in /htdoc… |
CVE-2019-4707 | High | 7.1 | 2020-01-28 | IBM Security Access Manager Appliance 9.0.7.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could… |
CVE-2019-4679 | Medium | 4.3 | 2020-01-28 | IBM Content Navigator 3.0CD could allow an authenticated user to gain information about the hosting operating system and version that could be used in further… |
CVE-2019-4639 | High | 7.5 | 2020-01-28 | IBM Security Secret Server 10.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-… |
CVE-2019-4638 | Low | 3.7 | 2020-01-28 | IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive… |
CVE-2019-4637 | Medium | 4.3 | 2020-01-28 | IBM Security Secret Server 10.7 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct imp… |
CVE-2019-4636 | Low | 2.7 | 2020-01-28 | IBM Security Secret Server 10.7 could disclose sensitive information to an authenticated user from generated error messages. IBM X-Force ID: 170013. |
CVE-2019-4635 | Low | 2.7 | 2020-01-28 | IBM Security Secret Server 10.7 could allow a privileged user to perform unauthorized command injection due to imporoper input neutralization of special elemen… |
CVE-2019-4633 | Medium | 4.3 | 2020-01-28 | IBM Security Secret Server 10.7 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 170007. |
CVE-2019-4632 | Medium | 6.1 | 2020-01-28 | IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus al… |
CVE-2019-4631 | Medium | 6.1 | 2020-01-28 | IBM Security Secret Server 10.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a spe… |
CVE-2019-4620 | High | 7.8 | 2020-01-28 | IBM MQ Appliance 8.0 and 9.0 LTS could allow a local attacker to bypass security restrictions caused by improper validation of environment variables. IBM X-For… |
CVE-2019-4614 | Medium | 6.5 | 2020-01-28 | IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS client connecting to a Queue Manager could cause a SIGSEGV denial of service caused by converting an invalid messag… |
CVE-2019-4568 | Medium | 5.9 | 2020-01-28 | IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS could allow a remote attacker with intimate knowledge of the server to cause a denial of service when receiving dat… |
CVE-2019-17338 | Medium | 5.4 | 2020-01-28 | The user interface component of TIBCO Software Inc.'s TIBCO Patterns - Search contains multiple vulnerabilities that theoretically allow authenticated users to… |
CVE-2019-5474 | Medium | 6.5 | 2020-01-28 | An authorization issue was discovered in GitLab EE < 12.1.2, < 12.0.4, and < 11.11.6 allowing the merge request approval rules to be overridden without appropr… |
CVE-2019-5472 | High | 7.5 | 2020-01-28 | An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments. |
CVE-2019-5470 | High | 7.5 | 2020-01-28 | An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of… |
CVE-2019-5468 | High | 8.8 | 2020-01-28 | An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used with a blocked accoun… |
CVE-2019-5466 | Medium | 4.3 | 2020-01-28 | An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names. |
CVE-2019-5465 | Medium | 4.3 | 2020-01-28 | An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclosure of the newly cr… |
CVE-2019-5464 | Critical | 9.8 | 2020-01-28 | A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is u… |
CVE-2019-5462 | High | 8.8 | 2020-01-28 | A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed. |
CVE-2019-15607 | Medium | 5.4 | 2020-01-28 | A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Things. This issue wi… |
CVE-2019-15590 | High | 7.5 | 2020-01-28 | An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests… |
CVE-2019-15586 | Medium | 6.1 | 2020-01-28 | A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin. |
CVE-2019-15585 | Critical | 9.8 | 2020-01-28 | Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the GitLab SAML integratio… |
CVE-2019-15583 | High | 7.5 | 2020-01-28 | An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). When an issue was moved to… |
CVE-2019-15582 | Medium | 5.3 | 2020-01-28 | An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a maintainer to add any… |
CVE-2019-15581 | Medium | 5.3 | 2020-01-28 | An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project owner or maintainer to… |
CVE-2019-15579 | Medium | 5.3 | 2020-01-28 | An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) where the assignee(s) of a… |
CVE-2019-15578 | Medium | 5.3 | 2020-01-28 | An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The path of a private proj… |
CVE-2019-20439 | Medium | 4.8 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in defining a scope in th… |
CVE-2019-20438 | Medium | 4.8 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0. A potential stored Cross-Site Scripting (XSS) vulnerability has been identified in the inline API documentat… |
CVE-2019-20437 | Medium | 6.1 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. When a custom claim dialect with an XSS payloa… |
CVE-2019-20436 | Medium | 6.1 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. If there is a claim dialect configured with an… |
CVE-2019-20435 | Medium | 4.8 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0. A reflected XSS attack could be performed in the inline API documentation editor page of the API Publisher b… |
CVE-2019-20434 | Medium | 4.8 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Datasource creatio… |
CVE-2019-17651 | Medium | 5.4 | 2020-01-28 | An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM version 5.2.5 and below… |
CVE-2019-10779 | Medium | 6.1 | 2020-01-28 | All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cross-site Scripting. An attacker website is… |
CVE-2019-10770 | Medium | 6.1 | 2020-01-28 | All versions of io.ratpack:ratpack-core from 0.9.10 inclusive and before 1.7.6 are vulnerable to Cross-site Scripting (XSS). This affects the development mode… |
CVE-2019-8257 | Critical | 9.8 | 2020-01-28 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-7131 | Critical | 9.8 | 2020-01-28 | Adobe Acrobat and Reader versions 2019.010.20064 and earlier, 2019.010.20064 and earlier, 2017.011.30110 and earlier version, and 2015.006.30461 and earlier ha… |
CVE-2019-20443 | Medium | 4.8 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential… |
CVE-2019-20442 | Medium | 4.8 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential… |
CVE-2019-20441 | Medium | 4.8 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0. A potential Stored Cross-Site Scripting (XSS) vulnerability has been identified in the 'implement phase' of… |
CVE-2019-20440 | Medium | 4.8 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the update API documen… |
CVE-2019-13521 | High | 7.8 | 2020-01-27 | A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlier may result in t… |
CVE-2019-13519 | High | 7.8 | 2020-01-27 | A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlier may result in t… |
CVE-2019-8947 | Medium | 6.1 | 2020-01-27 | Zimbra Collaboration 8.7.x - 8.8.11P2 contains non-persistent XSS. |
CVE-2019-8946 | Medium | 6.1 | 2020-01-27 | Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS. |
CVE-2019-8945 | Medium | 6.1 | 2020-01-27 | Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS. |
CVE-2019-19539 | Medium | 5.5 | 2020-01-27 | An issue was discovered in Idelji Web ViewPoint H01ABO-H01BY and L01ABP-L01ABZ, Web ViewPoint Plus H01AAG-H01AAQ and L01AAH-L01AAR, and Web ViewPoint Enterpris… |
CVE-2019-19143 | Medium | 6.1 | 2020-01-27 | TP-LINK TL-WR849N 0.9.1 4.16 devices do not require authentication to replace the firmware via a POST request to the cgi/softup URI. |
CVE-2019-15313 | Medium | 6.1 | 2020-01-27 | In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability. |
CVE-2019-12427 | Medium | 4.8 | 2020-01-27 | Zimbra Collaboration before 8.8.15 Patch 1 is vulnerable to a non-persistent XSS via the Admin Console. |
CVE-2019-11318 | Medium | 5.4 | 2020-01-27 | Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS. |
CVE-2019-11288 | High | 7.0 | 2020-01-27 | In Pivotal tc Server, 3.x versions prior to 3.2.19 and 4.x versions prior to 4.0.10, and Pivotal tc Runtimes, 7.x versions prior to 7.0.99.B, 8.x versions prio… |
CVE-2019-19824 | High | 8.8 | 2020-01-27 | On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd UR… |
CVE-2019-19823 | High | 7.5 | 2020-01-27 | A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and… |
CVE-2019-19822 | High | 7.5 | 2020-01-27 | A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configuration, includ… |