2019 CVEs (page 29)
Page 29 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-17099 | Medium | 5.3 | 2020-01-27 | An Untrusted Search Path vulnerability in EPSecurityService.exe as used in Bitdefender Endpoint Security Tools versions prior to 6.6.11.163 allows an attacker… |
CVE-2019-17095 | High | 8.1 | 2020-01-27 | A command injection vulnerability has been discovered in the bootstrap stage of Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45. The API method `/api/downl… |
CVE-2019-17094 | High | 8.3 | 2020-01-27 | A Stack-based Buffer Overflow vulnerability in libbelkin_api.so component of Belkin WeMo Insight Switch firmware allows a local attacker to obtain code executi… |
CVE-2019-19825 | Critical | 9.8 | 2020-01-27 | On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, lead… |
CVE-2019-17096 | Critical | 9.0 | 2020-01-27 | A OS Command Injection vulnerability in the bootstrap stage of Bitdefender BOX 2 allows the manipulation of the `get_image_url()` function in special circumsta… |
CVE-2019-17190 | High | 7.8 | 2020-01-27 | A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpd… |
CVE-2019-20433 | Critical | 9.1 | 2020-01-27 | libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of… |
CVE-2019-17103 | Medium | 4.9 | 2020-01-27 | An Incorrect Default Permissions vulnerability in the BDLDaemon component of Bitdefender AV for Mac allows an attacker to elevate permissions to read protected… |
CVE-2019-17102 | High | 8.3 | 2020-01-27 | An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method `/api/update_setup` does… |
CVE-2019-17100 | Medium | 5.2 | 2020-01-27 | An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issu… |
CVE-2019-6036 | Medium | 6.1 | 2020-01-27 | Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML v… |
CVE-2019-20432 | High | 7.5 | 2020-01-27 | In the Lustre file system before 2.12.3, the mdt module has an out-of-bounds access and panic due to the lack of validation for specific fields of packets sent… |
CVE-2019-20431 | High | 7.5 | 2020-01-27 | In the Lustre file system before 2.12.3, the ptlrpc module has an osd_map_remote_to_local out-of-bounds access and panic due to the lack of validation for spec… |
CVE-2019-20430 | High | 7.5 | 2020-01-27 | In the Lustre file system before 2.12.3, the mdt module has an LBUG panic (via a large MDT Body eadatasize field) due to the lack of validation for specific fi… |
CVE-2019-20429 | High | 7.5 | 2020-01-27 | In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds read and panic (via a modified lm_bufcount field) due to the lack of validation… |
CVE-2019-20428 | High | 7.5 | 2020-01-27 | In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds read and panic due to the lack of validation for specific fields of packets sen… |
CVE-2019-20427 | Critical | 9.8 | 2020-01-27 | In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic, and possibly remote code execution, due to the lack of validation f… |
CVE-2019-20426 | High | 7.5 | 2020-01-27 | In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of validation for specific fields of packets s… |
CVE-2019-20425 | High | 7.5 | 2020-01-27 | In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of validation for specific fields of packets s… |
CVE-2019-20424 | High | 7.5 | 2020-01-27 | In the Lustre file system before 2.12.3, mdt_object_remote in the mdt module has a NULL pointer dereference and panic due to the lack of validation for specifi… |
CVE-2019-20423 | High | 7.5 | 2020-01-27 | In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic due to the lack of validation for specific fields of packets sent by… |
CVE-2019-20422 | Medium | 5.5 | 2020-01-27 | In the Linux kernel before 5.3.4, fib6_rule_lookup in net/ipv6/ip6_fib.c mishandles the RT6_LOOKUP_F_DST_NOREF flag in a reference-count decision, leading to (… |
CVE-2019-20421 | High | 7.5 | 2020-01-27 | In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Remote attackers… |
CVE-2019-16029 | Critical | 9.1 | 2020-01-26 | A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to chang… |
CVE-2019-16027 | Medium | 6.5 | 2020-01-26 | A vulnerability in the implementation of the Intermediate System–to–Intermediate System (IS–IS) routing protocol functionality in Cisco IOS X… |
CVE-2019-16026 | Medium | 5.9 | 2020-01-26 | A vulnerability in the implementation of the Stream Control Transmission Protocol (SCTP) on Cisco Mobility Management Entity (MME) could allow an unauthenticat… |
CVE-2019-16024 | Medium | 6.1 | 2020-01-26 | A vulnerability in the web-based management interface of Cisco Crosswork Change Automation could allow an unauthenticated, remote attacker to conduct a cross-s… |
CVE-2019-16022 | High | 8.6 | 2020-01-26 | Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unaut… |
CVE-2019-16020 | High | 8.6 | 2020-01-26 | Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unaut… |
CVE-2019-16018 | Medium | 6.5 | 2020-01-26 | A vulnerability in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticate… |
CVE-2019-16015 | Medium | 6.1 | 2020-01-26 | A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker… |
CVE-2019-16008 | Medium | 5.4 | 2020-01-26 | A vulnerability in the web-based GUI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an authenticated, remote attacker to… |
CVE-2019-16005 | High | 7.2 | 2020-01-26 | A vulnerability in the web-based management interface of Cisco Webex Video Mesh could allow an authenticated, remote attacker to execute arbitrary commands on… |
CVE-2019-16003 | Medium | 5.3 | 2020-01-26 | A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to download system log files from a… |
CVE-2019-15989 | High | 8.6 | 2020-01-26 | A vulnerability in the implementation of the Border Gateway Protocol (BGP) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attack… |
CVE-2019-15278 | Medium | 6.1 | 2020-01-26 | A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to bypass authorization and access sensi… |
CVE-2019-15255 | Medium | 6.5 | 2020-01-26 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass authoriza… |
CVE-2019-12629 | High | 7.2 | 2020-01-26 | A vulnerability in the WebUI of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject and execute arbitrary commands with vmanage u… |
CVE-2019-12619 | Medium | 6.5 | 2020-01-26 | A vulnerability in the web interface for Cisco SD-WAN Solution vManage could allow an authenticated, remote attacker to impact the integrity of an affected sys… |
CVE-2019-5183 | Critical | 9.0 | 2020-01-25 | An exploitable type confusion vulnerability exists in AMD ATIDXX64.DLL driver, versions 26.20.13031.10003, 26.20.13031.15006 and 26.20.13031.18002. A specially… |
CVE-2019-5147 | High | 8.6 | 2020-01-25 | An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13003.1007. A specially crafted pixel shader can cause a denia… |
CVE-2019-5146 | High | 8.6 | 2020-01-25 | An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13025.10004. A specially crafted pixel shader can cause a deni… |
CVE-2019-5124 | High | 8.6 | 2020-01-25 | An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.50005. A specially crafted pixel shader can cause a deni… |
CVE-2019-1353 | Critical | 9.8 | 2020-01-24 | An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the… |
CVE-2019-1348 | Low | 3.3 | 2020-01-24 | An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks opti… |
CVE-2019-1460 | Medium | 4.6 | 2020-01-24 | A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing… |
CVE-2019-1454 | Medium | 5.5 | 2020-01-24 | An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows User Profile Service E… |
CVE-2019-1414 | High | 7.8 | 2020-01-24 | An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer, aka 'Visual Studio Code Ele… |
CVE-2019-1354 | High | 8.8 | 2020-01-24 | A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerabil… |
CVE-2019-1352 | High | 8.8 | 2020-01-24 | A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerabil… |
CVE-2019-1351 | High | 7.5 | 2020-01-24 | A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'. |
CVE-2019-1350 | High | 8.8 | 2020-01-24 | A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerabil… |
CVE-2019-1349 | High | 8.8 | 2020-01-24 | A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerabil… |
CVE-2019-19363 | High | 7.8 | 2020-01-24 | An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attackers local privilege escalation. Affected… |
CVE-2019-19631 | High | 8.8 | 2020-01-24 | An issue was discovered in Big Switch Big Monitoring Fabric 6.2 through 6.2.4, 6.3 through 6.3.9, 7.0 through 7.0.3, and 7.1 through 7.1.3; Big Cloud Fabric 4… |
CVE-2019-18900 | Medium | 4.0 | 2020-01-24 | : Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed lo… |
CVE-2019-19632 | Medium | 6.1 | 2020-01-24 | An issue was discovered in Big Switch Big Monitoring Fabric 6.2 through 6.2.4, 6.3 through 6.3.9, 7.0 through 7.0.3, and 7.1 through 7.1.3; Big Cloud Fabric 4… |
CVE-2019-3700 | Low | 2.9 | 2020-01-24 | yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were move… |
CVE-2019-3699 | High | 7.7 | 2020-01-24 | UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user pr… |
CVE-2019-3697 | High | 7.7 | 2020-01-24 | UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of gnump3d in openSUSE Leap 15.1 allows local attackers to escalate from user gnump3d to… |
CVE-2019-3694 | High | 7.7 | 2020-01-24 | A Symbolic Link (Symlink) Following vulnerability in the packaging of munin in openSUSE Factory, Leap 15.1 allows local attackers to escalate from user munin t… |
CVE-2019-3693 | High | 7.7 | 2020-01-24 | A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed l… |
CVE-2019-3692 | High | 7.7 | 2020-01-24 | The packaging of inn on SUSE Linux Enterprise Server 11; openSUSE Factory, Leap 15.1 allows local attackers to escalate from user inn to root via symlink attac… |
CVE-2019-3687 | Medium | 4.0 | 2020-01-24 | The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This… |
CVE-2019-17570 | Critical | 9.8 | 2020-01-23 | An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malic… |
CVE-2019-14885 | Medium | 4.3 | 2020-01-23 | A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA. Confidential information of the system property's security attribute value is r… |
CVE-2019-19898 | High | 7.5 | 2020-01-23 | In IXP EasyInstall 6.2.13723, there are cleartext credentials in network communication on TCP port 20050 when using the Administrator console remotely. |
CVE-2019-19897 | Critical | 9.8 | 2020-01-23 | In IXP EasyInstall 6.2.13723, there is Remote Code Execution via the Agent Service. An unauthenticated attacker can communicate with the Agent Service over TCP… |
CVE-2019-19896 | Critical | 9.9 | 2020-01-23 | In IXP EasyInstall 6.2.13723, there is Remote Code Execution via weak permissions on the Engine Service share. The default file permissions of the IXP$ share o… |
CVE-2019-19895 | High | 7.8 | 2020-01-23 | In IXP EasyInstall 6.2.13723, there is Lateral Movement (using the Agent Service) against other users on a client system. An authenticated attacker can, by mod… |
CVE-2019-19894 | Medium | 5.5 | 2020-01-23 | In IXP EasyInstall 6.2.13723, it is possible to temporarily disable UAC by using the Agent Service on a client system. An authenticated attacker (non-admin) ca… |
CVE-2019-19893 | High | 7.5 | 2020-01-23 | In IXP EasyInstall 6.2.13723, there is Directory Traversal on TCP port 8000 via the Engine Service by an unauthenticated attacker, who can access the server's… |
CVE-2019-16517 | Critical | 9.8 | 2020-01-23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin… |
CVE-2019-16516 | Medium | 5.3 | 2020-01-23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability, allowing an unauth… |
CVE-2019-16515 | Medium | 6.5 | 2020-01-23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. Certain HTTP security headers are not used. |
CVE-2019-16514 | High | 7.2 | 2020-01-23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users… |
CVE-2019-16513 | High | 8.8 | 2020-01-23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. CSRF can be used to send API requests. |
CVE-2019-16512 | Medium | 4.8 | 2020-01-23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is stored XSS in the Appearance modifier. |
CVE-2019-15712 | High | 7.2 | 2020-01-23 | An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they s… |
CVE-2019-15707 | Medium | 4.9 | 2020-01-23 | An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup con… |
CVE-2019-5593 | Medium | 5.5 | 2020-01-23 | Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builti… |
CVE-2019-18222 | Medium | 4.7 | 2020-01-23 | The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the blinded scalar before computing the invers… |
CVE-2019-16153 | Critical | 9.8 | 2020-01-23 | A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attackers to access the device database via… |
CVE-2019-14888 | High | 7.5 | 2020-01-23 | A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out… |
CVE-2019-3691 | High | 7.7 | 2020-01-23 | A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to esc… |
CVE-2019-19839 | Critical | 9.8 | 2020-01-23 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=import-cate… |
CVE-2019-19838 | Critical | 9.8 | 2020-01-23 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=get-platfor… |
CVE-2019-18899 | Medium | 6.2 | 2020-01-23 | The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root privileges. This can allow local attackers… |
CVE-2019-17202 | High | 7.8 | 2020-01-23 | FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at wil… |
CVE-2019-17201 | High | 7.8 | 2020-01-23 | FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at wil… |
CVE-2019-18898 | High | 7.7 | 2020-01-23 | UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers e… |
CVE-2019-19837 | Medium | 5.3 | 2020-01-23 | Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote information disclosure of bin/web.conf via HTT… |
CVE-2019-19835 | High | 7.5 | 2020-01-23 | SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the too… |
CVE-2019-20399 | Medium | 5.9 | 2020-01-23 | A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a s… |
CVE-2019-20398 | Medium | 6.5 | 2020-01-22 | A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved extensions in lys_re… |
CVE-2019-20397 | High | 8.8 | 2020-01-22 | A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. Applications that use libyang to par… |
CVE-2019-20396 | Medium | 6.5 | 2020-01-22 | A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsing. |
CVE-2019-20395 | Medium | 6.5 | 2020-01-22 | A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to par… |
CVE-2019-20394 | High | 8.8 | 2020-01-22 | A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use l… |
CVE-2019-20393 | High | 8.8 | 2020-01-22 | A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untruste… |