2019 CVEs (page 30)
Page 30 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-20392 | Medium | 6.5 | 2020-01-22 | An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list k… |
CVE-2019-20391 | Medium | 6.5 | 2020-01-22 | An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. A… |
CVE-2019-19842 | Critical | 9.8 | 2020-01-22 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=spectra-ana… |
CVE-2019-19841 | Critical | 9.8 | 2020-01-22 | emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=packet-capt… |
CVE-2019-19840 | Critical | 9.8 | 2020-01-22 | A stack-based buffer overflow in zap_parse_args in zap.c in zap in Ruckus Unleashed through 200.7.10.102.64 allows remote code execution via an unauthenticated… |
CVE-2019-19843 | Critical | 9.8 | 2020-01-22 | Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP r… |
CVE-2019-19836 | Critical | 9.8 | 2020-01-22 | AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote code execution via a POST request that uses tools/_rcmdstat.jsp… |
CVE-2019-19834 | High | 7.2 | 2020-01-22 | Directory Traversal in ruckus_cli2 in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote attacker to jailbreak the CLI via enable->debug->script… |
CVE-2019-16792 | High | 7.1 | 2020-01-22 | Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header a… |
CVE-2019-5647 | Medium | 4.4 | 2020-01-22 | The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This b… |
CVE-2019-6146 | Medium | 6.1 | 2020-01-22 | It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 (Medium) (/A… |
CVE-2019-6858 | High | 7.8 | 2020-01-22 | A CWE-427:Uncontrolled Search Path Element vulnerability exists in MSX Configurator (Software Version prior to V1.0.8.1), which could cause privilege escalatio… |
CVE-2019-10781 | Critical | 9.8 | 2020-01-22 | In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspecto… |
CVE-2019-10780 | Critical | 9.8 | 2020-01-22 | BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through Bib… |
CVE-2019-12490 | Medium | 6.5 | 2020-01-22 | An issue was discovered in Simple Machines Forum (SMF) before 2.0.16. Reverse tabnabbing can occur because of use of _blank for external links. |
CVE-2019-16791 | Medium | 6.9 | 2020-01-22 | In postfix-mta-sts-resolver before 0.5.1, All users can receive incorrect response from daemon under rare conditions, rendering downgrade of effective STS poli… |
CVE-2019-20388 | High | 7.5 | 2020-01-21 | xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak. |
CVE-2019-20387 | High | 7.5 | 2020-01-21 | repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the length of the input… |
CVE-2019-19414 | High | 7.5 | 2020-01-21 | There is an integer overflow vulnerability in LDAP server of some Huawei products. Due to insufficient input validation, a remote attacker could exploit this v… |
CVE-2019-19413 | High | 7.5 | 2020-01-21 | There is an integer overflow vulnerability in LDAP client of some Huawei products. Due to insufficient input validation, a remote attacker could exploit this v… |
CVE-2019-19886 | High | 7.5 | 2020-01-21 | Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming… |
CVE-2019-18426 | High | 8.2 | 2020-01-21 | A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and l… |
CVE-2019-17584 | High | 7.5 | 2020-01-21 | The Meinberg SyncBox/PTP/PTPv2 devices have default SSH keys which allow attackers to get root access to the devices. All firmware versions up to v5.34o, v5.34… |
CVE-2019-19592 | Medium | 6.1 | 2020-01-21 | Jama Connect 8.44.0 is vulnerable to stored Cross-Site Scripting |
CVE-2019-19411 | Low | 3.7 | 2020-01-21 | USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 have an information l… |
CVE-2019-17357 | Medium | 6.5 | 2020-01-21 | Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id co… |
CVE-2019-19344 | Medium | 6.5 | 2020-01-21 | There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5… |
CVE-2019-18932 | High | 7.0 | 2020-01-21 | log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As… |
CVE-2019-14907 | Medium | 6.5 | 2020-01-21 | All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then th… |
CVE-2019-14902 | Medium | 5.4 | 2020-01-21 | There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the re… |
CVE-2019-19392 | Critical | 9.8 | 2020-01-21 | The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new users with Administrator priv… |
CVE-2019-3864 | High | 8.8 | 2020-01-21 | A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as… |
CVE-2019-14768 | High | 8.8 | 2020-01-21 | An Arbitrary File Upload issue in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to deploy a new WebApp WAR file to t… |
CVE-2019-14767 | High | 7.5 | 2020-01-21 | In DIMO YellowBox CRM before 6.3.4, Path Traversal in images/Apparence (dossier=../) and servletrecuperefichier (document=../) allows an unauthenticated user t… |
CVE-2019-14766 | Medium | 6.5 | 2020-01-21 | Path Traversal in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to browse the server filesystem. |
CVE-2019-14765 | High | 8.8 | 2020-01-21 | Incorrect Access Control in AfficheExplorateurParam() in DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to use administrative controllers. |
CVE-2019-2267 | High | 7.8 | 2020-01-21 | Locked regions may be modified through other interfaces in secure boot loader image due to improper access control. in Snapdragon Auto, Snapdragon Compute, Sna… |
CVE-2019-14036 | High | 7.8 | 2020-01-21 | Possible buffer overflow issue in error processing due to improper validation of array index value in Snapdragon Auto, Snapdragon Consumer Electronics Connecti… |
CVE-2019-14034 | High | 7.8 | 2020-01-21 | Use after free while processing eeprom query as there is a chance to not unlock mutex after error occurs in Snapdragon Auto, Snapdragon Compute, Snapdragon Con… |
CVE-2019-14024 | High | 7.8 | 2020-01-21 | Possible stack-use-after-scope issue in NFC usecase for card emulation in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile in MSM8917, MSM8953, Ni… |
CVE-2019-14023 | High | 7.8 | 2020-01-21 | String format issue will occur while processing HLOS data as there is no user input validation to ensure inputs are properly NULL terminated before string copy… |
CVE-2019-14017 | Critical | 9.8 | 2020-01-21 | Heap buffer overflow can occur while parsing invalid MKV clip which is not standard and have invalid vorbis codec data in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-14016 | Critical | 9.8 | 2020-01-21 | Integer overflow occurs while playing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, S… |
CVE-2019-14014 | Critical | 9.8 | 2020-01-21 | Possible buffer overflow when byte array receives incorrect input from reading source as array is not null terminated in Snapdragon Consumer IOT, Snapdragon In… |
CVE-2019-14013 | Critical | 9.8 | 2020-01-21 | While parsing invalid super index table, elements within super index table may exceed total chunk size and invalid data is read into the table in Snapdragon Au… |
CVE-2019-14010 | High | 7.5 | 2020-01-21 | The device may enter into error state when some tool or application gets failure at 1st buffer map all and performs 2nd buffer map which happens to be at same… |
CVE-2019-14008 | High | 7.5 | 2020-01-21 | Possible null pointer dereference issue in location assistance data processing due to missing null check on resources before using it in Snapdragon Auto, Snapd… |
CVE-2019-14006 | Critical | 9.8 | 2020-01-21 | Buffer overflow occur while playing the clip which is nonstandard due to lack of offset length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect… |
CVE-2019-14005 | Critical | 9.8 | 2020-01-21 | Buffer overflow occur while playing the clip which is nonstandard due to lack of check of size duration in Snapdragon Auto, Snapdragon Compute, Snapdragon Conn… |
CVE-2019-14004 | Critical | 9.8 | 2020-01-21 | Buffer overflow occurs while processing invalid MKV clip, which has invalid EBML size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrag… |
CVE-2019-14003 | High | 7.5 | 2020-01-21 | Null pointer exception can happen while parsing invalid MKV clip where cue information is parsed before segment information in Snapdragon Auto, Snapdragon Comp… |
CVE-2019-10611 | Critical | 9.8 | 2020-01-21 | Buffer overflow can occur while processing clip due to lack of check of object size before parsing in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectiv… |
CVE-2019-10606 | High | 7.8 | 2020-01-21 | Out-of-bound access will occur in USB driver due to lack of check to validate the frame size passed by user in Snapdragon Auto, Snapdragon Consumer Electronics… |
CVE-2019-10602 | High | 7.8 | 2020-01-21 | Potential use-after-free heap error during Validate/Present calls on display HW composer in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapd… |
CVE-2019-10585 | High | 7.8 | 2020-01-21 | Possible integer overflow happens when mmap find function will increment refcount every time when it invokes and can lead to use after free issue in Snapdragon… |
CVE-2019-10583 | High | 7.8 | 2020-01-21 | Use after free issue occurs when camera access sensors data through direct report mode in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdra… |
CVE-2019-10582 | High | 7.8 | 2020-01-21 | Use after free issue due to using of invalidated iterator to delete an object in sensors HAL in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial… |
CVE-2019-10581 | Critical | 9.8 | 2020-01-21 | NULL is assigned to local instance of audio device pointer after free instead of global static pointer and can lead to use after free issue in Snapdragon Auto… |
CVE-2019-10579 | Critical | 9.1 | 2020-01-21 | Buffer over-read can occur while playing the video clip which is not standard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consu… |
CVE-2019-10578 | High | 7.5 | 2020-01-21 | Null pointer dereference can occur while parsing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Cons… |
CVE-2019-10561 | Medium | 5.5 | 2020-01-21 | Improper initialization of local variables which are parameters to sfs api may cause invalid pointer dereference and leads to denial of service in Snapdragon A… |
CVE-2019-10558 | High | 7.8 | 2020-01-21 | While transferring data from APPS to DSP, Out of bound in FastRPC HLOS Driver due to the data buffer which can be controlled by DSP in Snapdragon Auto, Snapdra… |
CVE-2019-10548 | High | 7.8 | 2020-01-21 | While trying to obtain datad ipc handle during DPL initialization, Heap use-after-free issue can occur if modem SSR occurs at same time in Snapdragon Auto, Sna… |
CVE-2019-10532 | Critical | 9.8 | 2020-01-21 | Null-pointer dereference issue can occur while calculating string length when source string length is zero in Snapdragon Auto, Snapdragon Connectivity, Snapdra… |
CVE-2019-20386 | Low | 2.4 | 2020-01-21 | An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur. |
CVE-2019-20385 | High | 8.8 | 2020-01-21 | The CSV upload feature in /supervisor/procesa_carga.php on Logaritmo Aware CallManager 2012 devices allows upload of .php files with a text/* content type. The… |
CVE-2019-20384 | Medium | 5.5 | 2020-01-21 | Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios u… |
CVE-2019-20381 | Medium | 6.1 | 2020-01-20 | TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incomplete fix for CVE… |
CVE-2019-20357 | High | 7.8 | 2020-01-18 | A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could poten… |
CVE-2019-19697 | Medium | 6.7 | 2020-01-18 | An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain eleva… |
CVE-2019-19696 | Medium | 5.5 | 2020-01-18 | A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by… |
CVE-2019-15625 | Medium | 5.5 | 2020-01-18 | A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory process… |
CVE-2019-19339 | Medium | 6.5 | 2020-01-17 | It was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A flaw was found in the way Intel CPUs hand… |
CVE-2019-17635 | High | 7.8 | 2020-01-17 | Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a deserialization vulnerability if an index file of a parsed heap dump is replaced by a malicio… |
CVE-2019-17634 | Critical | 9.0 | 2020-01-17 | Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report from a malicious heap… |
CVE-2019-17127 | Medium | 6.1 | 2020-01-17 | A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker c… |
CVE-2019-17125 | Medium | 6.1 | 2020-01-17 | A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject… |
CVE-2019-14629 | Medium | 5.5 | 2020-01-17 | Improper permissions in Intel(R) DAAL before version 2020 Gold may allow an authenticated user to potentially enable information disclosure via local access. |
CVE-2019-14615 | Medium | 5.5 | 2020-01-17 | Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor Graphics may allow an unauthenticated user to potenti… |
CVE-2019-14613 | High | 7.8 | 2020-01-17 | Improper access control in driver for Intel(R) VTune(TM) Amplifier for Windows* before update 8 may allow an authenticated user to potentially enable escalatio… |
CVE-2019-14601 | High | 7.8 | 2020-01-17 | Improper permissions in the installer for Intel(R) RWC 3 for Windows before version 7.010.009.000 may allow an authenticated user to potentially enable escalat… |
CVE-2019-14600 | Medium | 6.7 | 2020-01-17 | Uncontrolled search path element in the installer for Intel(R) SNMP Subagent Stand-Alone for Windows* may allow an authenticated user to potentially enable esc… |
CVE-2019-14596 | Medium | 5.5 | 2020-01-17 | Improper access control in the installer for Intel(R) Chipset Device Software INF Utility before version 10.1.18 may allow an authenticated user to potentially… |
CVE-2019-10958 | High | 7.2 | 2020-01-17 | Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated attacke… |
CVE-2019-10957 | Medium | 4.8 | 2020-01-17 | Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated attacke… |
CVE-2019-10956 | High | 7.2 | 2020-01-17 | Geutebruck IP Cameras G-Code(EEC-2xxx), G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx): All versions 1.12.0.25 and prior may allow a remote authenticated user, u… |
CVE-2019-15855 | Critical | 9.1 | 2020-01-17 | An issue was discovered in Maarch RM before 2.5. A path traversal vulnerability allows an unauthenticated remote attacker to overwrite any files with a crafted… |
CVE-2019-15854 | High | 8.8 | 2020-01-17 | An issue was discovered in Maarch RM before 2.5. A privilege escalation vulnerability allows an authenticated user with lowest privileges to give herself highe… |
CVE-2019-20003 | Medium | 6.1 | 2020-01-17 | Feldtech easescreen Crystal 9.0 Web-Services 9.0.1.16265 allows Stored XSS via the Debug-Log and Display-Log components. This could be exploited when an attack… |
CVE-2019-3686 | Medium | 6.5 | 2020-01-17 | openQA before commit c172e8883d8f32fced5e02f9b6faaacc913df27b was vulnerable to XSS in the distri and version parameter. This was reported through the bug boun… |
CVE-2019-3683 | High | 8.8 | 2020-01-17 | The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/us… |
CVE-2019-3682 | High | 8.4 | 2020-01-17 | The docker-kubic package in SUSE CaaS Platform 3.0 before 17.09.1_ce-7.6.1 provided access to an insecure API locally on the Kubernetes master node. |
CVE-2019-19802 | Medium | 6.5 | 2020-01-17 | In Gallagher Command Centre Server v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prior to v7.80.960(MR2)… |
CVE-2019-19801 | Medium | 5.5 | 2020-01-17 | In Gallagher Command Centre Server versions of v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prior to v7… |
CVE-2019-19142 | High | 7.5 | 2020-01-17 | Intelbras WRN240 devices do not require authentication to replace the firmware via a POST request to the incoming/Firmware.cfg URI. |
CVE-2019-17361 | Critical | 9.8 | 2020-01-17 | In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacke… |
CVE-2019-15742 | High | 7.8 | 2020-01-17 | A local privilege-escalation vulnerability exists in the Poly Plantronics Hub before 3.14 for Windows client application. A local attacker can exploit this iss… |
CVE-2019-3997 | Medium | 4.6 | 2020-01-16 | Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.0-1.3 allows a local, unauthenticated attacker to pair a rogue keypad to… |
CVE-2019-5145 | High | 8.8 | 2020-01-16 | An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF document can trig… |
CVE-2019-5131 | High | 8.8 | 2020-01-16 | An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF… |