2019 CVEs (page 31)
Page 31 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-5130 | High | 8.8 | 2020-01-16 | An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.7.0.29435. A specially crafted PDF d… |
CVE-2019-5126 | High | 8.8 | 2020-01-16 | An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF document can trig… |
CVE-2019-9503 | High | 7.9 | 2020-01-16 | The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver r… |
CVE-2019-9500 | High | 7.9 | 2020-01-16 | The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless… |
CVE-2019-11998 | Medium | 5.5 | 2020-01-16 | HPE Superdome Flex Server is vulnerable to multiple remote vulnerabilities via improper input validation of administrator commands. This vulnerability could al… |
CVE-2019-11997 | Medium | 6.1 | 2020-01-16 | A potential security vulnerability has been identified in HPE enhanced Internet Usage Manager (eIUM) versions 8.3 and 9.0. The vulnerability could be used for… |
CVE-2019-17573 | Medium | 6.1 | 2020-01-16 | By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected C… |
CVE-2019-13524 | High | 7.5 | 2020-01-16 | GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versions(End of Life) may allow… |
CVE-2019-12423 | High | 7.5 | 2020-01-16 | Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the si… |
CVE-2019-19278 | Medium | 6.8 | 2020-01-16 | A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR32..-.....-.... MLFB 6SR4...-.....-.... MLFB 6SR5...-.....-.... With optio… |
CVE-2019-18282 | Medium | 5.3 | 2020-01-16 | The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the… |
CVE-2019-13939 | High | 7.1 | 2020-01-16 | A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions < V2.8.2), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact… |
CVE-2019-13933 | High | 8.6 | 2020-01-16 | A vulnerability has been identified in SCALANCE X204RNA (HSR), SCALANCE X204RNA (PRP), SCALANCE X204RNA EEC (HSR), SCALANCE X204RNA EEC (PRP), SCALANCE X204RNA… |
CVE-2019-10940 | Critical | 9.9 | 2020-01-16 | A vulnerability has been identified in SINEMA Server (All versions < V14.0 SP2 Update 1). Incorrect session validation could allow an attacker with a valid ses… |
CVE-2019-10934 | High | 7.8 | 2020-01-16 | A vulnerability has been identified in TIA Portal V14 (All versions), TIA Portal V15 (All versions < V15.1 Update 7), TIA Portal V16 (All versions < V16 Update… |
CVE-2019-20327 | High | 7.8 | 2020-01-16 | Insecure permissions in cwrapper_perl in Centreon Infrastructure Monitoring Software through 19.10 allow local attackers to gain privileges. (cwrapper_perl is… |
CVE-2019-19859 | Medium | 5.3 | 2020-01-15 | An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The Add Collaborator allows unlimited data via the author paramete… |
CVE-2019-19858 | Medium | 4.8 | 2020-01-15 | An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. admin/add_user/UID allows stored XSS via the author parameter. |
CVE-2019-19857 | Medium | 6.5 | 2020-01-15 | An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. An admin can change their password without providing the current p… |
CVE-2019-19856 | Medium | 4.8 | 2020-01-15 | An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The User Type on the admin/list_user page allows stored XSS via th… |
CVE-2019-19855 | Medium | 4.8 | 2020-01-15 | An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. admin/list_user allows stored XSS via the auth_type parameter. |
CVE-2019-19854 | High | 8.8 | 2020-01-15 | An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. It does not use CSRF Tokens to mitigate against CSRF; it uses the… |
CVE-2019-20097 | High | 8.8 | 2020-01-15 | Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from… |
CVE-2019-15012 | High | 8.8 | 2020-01-15 | Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6… |
CVE-2019-15010 | High | 8.8 | 2020-01-15 | Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 be… |
CVE-2019-18275 | Medium | 6.5 | 2020-01-15 | OSIsoft PI Vision, All versions of PI Vision prior to 2019. The affected product is vulnerable to an improper access control, which may return unauthorized tag… |
CVE-2019-18273 | Medium | 4.8 | 2020-01-15 | OSIsoft PI Vision, PI Vision 2017 R2 and PI Vision 2017 R2 SP1. The affected product is vulnerable to cross-site scripting, which may allow invalid input to be… |
CVE-2019-18271 | High | 8.8 | 2020-01-15 | OSIsoft PI Vision, All versions of PI Vision prior to 2019. The affected product is vulnerable to a cross-site request forgery that may be introduced on the PI… |
CVE-2019-18244 | Medium | 4.7 | 2020-01-15 | In OSIsoft PI System multiple products and versions, a local attacker could view sensitive information in log files when service accounts are customized during… |
CVE-2019-15961 | High | 7.5 | 2020-01-15 | A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacke… |
CVE-2019-9510 | Medium | 5.3 | 2020-01-15 | A vulnerability in Microsoft Windows 10 1803 and Windows Server 2019 and later systems can allow authenticated RDP-connected clients to gain access to user ses… |
CVE-2019-9493 | Medium | 6.5 | 2020-01-15 | The MyCar Controls of AutoMobility Distribution Inc., mobile application contains hard-coded admin credentials. A remote unauthenticated attacker may be able t… |
CVE-2019-16469 | High | 7.5 | 2020-01-15 | Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an expression language injection vulnerability. Successful exploitation could lead to s… |
CVE-2019-16468 | High | 7.5 | 2020-01-15 | Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an user interface injection vulnerability. Successful exploitation could lead to sensit… |
CVE-2019-16467 | Medium | 6.1 | 2020-01-15 | Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to s… |
CVE-2019-16466 | Medium | 6.1 | 2020-01-15 | Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to s… |
CVE-2019-18412 | High | 7.5 | 2020-01-15 | JetBrains IDETalk plugin before version 193.4099.10 allows XXE |
CVE-2019-16784 | High | 7.0 | 2020-01-14 | In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a software using PyInstal… |
CVE-2019-3981 | Low | 3.7 | 2020-01-14 | MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. A man in the middle can downgrade the client's authentication protocol and recover t… |
CVE-2019-13722 | Medium | 6.5 | 2020-01-14 | Inappropriate implementation in WebRTC in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2019-13537 | High | 7.5 | 2020-01-14 | The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buffer overflow vulnerability that could res… |
CVE-2019-19548 | High | 7.8 | 2020-01-14 | Norton Power Eraser, prior to 5.3.0.67, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to… |
CVE-2019-12398 | Medium | 4.8 | 2020-01-14 | In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to… |
CVE-2019-10995 | High | 8.8 | 2020-01-14 | ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phase of the HMI interf… |
CVE-2019-12399 | High | 7.5 | 2020-01-14 | When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is cr… |
CVE-2019-0219 | Critical | 9.8 | 2020-01-14 | A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab… |
CVE-2019-20144 | Medium | 4.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 10.8 through 12.6.1. It has Incorrect Access Control. |
CVE-2019-20143 | Medium | 5.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.6. It has Incorrect Access Control. |
CVE-2019-20142 | Medium | 4.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.3 through 12.6.1. It allows Denial of Service. |
CVE-2019-19680 | High | 8.8 | 2020-01-13 | A file-extension filtering vulnerability in Proofpoint Enterprise Protection (PPS / PoD), in the unpatched versions of PPS through 8.9.22 and 8.14.2 respective… |
CVE-2019-20148 | Medium | 5.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 8.13 through 12.6.1. It has Incorrect Access Control. |
CVE-2019-20147 | Medium | 5.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 9.1 through 12.6.1. It has Incorrect Access Control. |
CVE-2019-20146 | Medium | 5.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.0 through 12.6. It allows Uncontrolled Resource Consumption. |
CVE-2019-20145 | Medium | 4.3 | 2020-01-13 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.4 through 12.6.1. It has Incorrect Access Control. |
CVE-2019-19728 | High | 7.5 | 2020-01-13 | SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 executes srun --uid with incorrect privileges. |
CVE-2019-19727 | Medium | 5.5 | 2020-01-13 | SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has weak slurmdbd.conf permissions. |
CVE-2019-20212 | Medium | 6.1 | 2020-01-13 | The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message… |
CVE-2019-20211 | Medium | 6.1 | 2020-01-13 | The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing Address, Listing Lat… |
CVE-2019-20210 | Medium | 6.1 | 2020-01-13 | The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query. |
CVE-2019-20209 | High | 7.5 | 2020-01-13 | The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference (IDOR) via wp-a… |
CVE-2019-19891 | Medium | 5.9 | 2020-01-13 | An encryption key vulnerability on Mitel SIP-DECT wireless devices 8.0 and 8.1 could allow an attacker to launch a man-in-the-middle attack. A successful explo… |
CVE-2019-18894 | High | 7.8 | 2020-01-13 | In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Ban… |
CVE-2019-18893 | Medium | 6.1 | 2020-01-13 | XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code… |
CVE-2019-19547 | Medium | 6.1 | 2020-01-13 | Symantec Endpoint Detection and Response (SEDR), prior to 4.3.0, may be susceptible to a cross site scripting (XSS) issue. XSS is a type of issue that can enab… |
CVE-2019-20377 | Medium | 6.1 | 2020-01-11 | TopList before 2019-09-03 allows XSS via a title. |
CVE-2019-20379 | Medium | 6.1 | 2020-01-11 | ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter. |
CVE-2019-20378 | Medium | 6.1 | 2020-01-11 | ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php ce parameter. |
CVE-2019-19475 | High | 8.8 | 2020-01-10 | An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-in in Applications Manager is prone to a… |
CVE-2019-13767 | High | 8.8 | 2020-01-10 | Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the renderer process to potentially exploit… |
CVE-2019-18588 | Medium | 5.4 | 2020-01-10 | Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMax OS 5978.221.221 an… |
CVE-2019-19819 | Medium | 5.5 | 2020-01-10 | The JBIG2Globals library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x90ec NULL Pointer Dereferen… |
CVE-2019-19817 | Medium | 5.5 | 2020-01-10 | The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x2e8a Out-of-Bounds Read via… |
CVE-2019-18194 | High | 7.8 | 2020-01-10 | TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory junction to restore a malicious DLL from quara… |
CVE-2019-14306 | High | 7.5 | 2020-01-10 | Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 2 of 2). |
CVE-2019-14304 | High | 8.8 | 2020-01-10 | Ricoh SP C250DN 1.06 devices allow CSRF. |
CVE-2019-14302 | Medium | 6.8 | 2020-01-10 | On Ricoh SP C250DN 1.06 devices, a debug port can be used. |
CVE-2019-14301 | High | 7.5 | 2020-01-10 | Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 1 of 2). |
CVE-2019-19820 | High | 7.8 | 2020-01-10 | An invalid pointer vulnerability in IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escalatio… |
CVE-2019-4559 | Medium | 5.3 | 2020-01-10 | IBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system… |
CVE-2019-4508 | High | 7.8 | 2020-01-10 | IBM QRadar SIEM 7.3.0 through 7.3.3 uses weak credential storage in some instances which could be decrypted by a local attacker. IBM X-Force ID: 164429. |
CVE-2019-20376 | Medium | 6.1 | 2020-01-10 | A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG… |
CVE-2019-20375 | Medium | 6.1 | 2020-01-10 | A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via the value para… |
CVE-2019-20374 | Critical | 9.6 | 2020-01-09 | A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid co… |
CVE-2019-20373 | High | 7.8 | 2020-01-09 | LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the user's shell lacks support for Bourne s… |
CVE-2019-20184 | High | 7.8 | 2020-01-09 | KeePass 2.4.1 allows CSV injection in the title field of a CSV export. |
CVE-2019-20183 | High | 7.2 | 2020-01-09 | uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only on the client side… |
CVE-2019-20182 | Medium | 4.8 | 2020-01-09 | The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter. |
CVE-2019-20181 | Medium | 4.8 | 2020-01-09 | The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter. |
CVE-2019-20179 | High | 8.8 | 2020-01-09 | SOPlanning 1.45 has SQL injection via the user_list.php "by" parameter. |
CVE-2019-20178 | Medium | 6.5 | 2020-01-09 | Advisto PEEL Shopping 9.2.1 has CSRF via administrer/utilisateurs.php to delete a user. |
CVE-2019-20372 | Medium | 5.3 | 2020-01-09 | NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized… |
CVE-2019-20180 | Medium | 6.8 | 2020-01-09 | The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and argues that this resp… |
CVE-2019-18859 | Medium | 6.1 | 2020-01-09 | Digi AnywhereUSB 14 allows XSS via a link for the Digi Page. |
CVE-2019-6319 | High | 8.1 | 2020-01-09 | HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmware version SWP1FN1912BR or higher) hav… |
CVE-2019-6332 | Medium | 4.8 | 2020-01-09 | A potential security vulnerability has been identified with certain HP InkJet printers. The vulnerability could be exploited to allow cross-site scripting (XSS… |
CVE-2019-6331 | Low | 3.3 | 2020-01-09 | An issue was found in Samsung Mobile Print (Android) versions prior to 4.08.007. A potential security vulnerability caused by incomplete obfuscation of applica… |
CVE-2019-6330 | Critical | 9.8 | 2020-01-09 | A potential security vulnerability has been identified in the software solution HP Access Control versions prior to 16.7. This vulnerability could potentially… |
CVE-2019-6320 | High | 8.1 | 2020-01-09 | Certain HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmware version SWP1FN1912BR or hig… |
CVE-2019-4651 | Critical | 9.8 | 2020-01-09 | IBM Jazz Reporting Service (JRS) 6.0.6.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the a… |
CVE-2019-14920 | High | 8.8 | 2020-01-09 | Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an authenticated attacker to gain root execution privileges over the device via a hidden etc_ro/w… |