2019 CVEs (page 33)
Page 33 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-20343 | Critical | 9.8 | 2020-01-06 | The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element (within a plugin element) can s… |
CVE-2019-15999 | Medium | 6.3 | 2020-01-06 | A vulnerability in the application environment of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain unauthorized a… |
CVE-2019-15985 | High | 7.2 | 2020-01-06 | Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execut… |
CVE-2019-15984 | High | 7.2 | 2020-01-06 | Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execut… |
CVE-2019-15983 | Medium | 4.9 | 2020-01-06 | A vulnerability in the SOAP API of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain read access to information th… |
CVE-2019-15982 | High | 7.2 | 2020-01-06 | Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an au… |
CVE-2019-15981 | High | 7.2 | 2020-01-06 | Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an au… |
CVE-2019-15980 | High | 7.2 | 2020-01-06 | Multiple vulnerabilities in the REST and SOAP API endpoints and the Application Framework feature of Cisco Data Center Network Manager (DCNM) could allow an au… |
CVE-2019-15979 | High | 7.2 | 2020-01-06 | Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with admi… |
CVE-2019-15978 | High | 7.2 | 2020-01-06 | Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with admi… |
CVE-2019-15977 | High | 7.5 | 2020-01-06 | Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass… |
CVE-2019-15976 | Critical | 9.8 | 2020-01-06 | Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass… |
CVE-2019-15975 | Critical | 9.8 | 2020-01-06 | Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass… |
CVE-2019-5990 | High | 7.5 | 2020-01-06 | Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allow remote attackers to obtain a login password via HTTP referer. |
CVE-2019-5989 | Medium | 6.1 | 2020-01-06 | DOM-based cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrar… |
CVE-2019-5988 | Medium | 6.1 | 2020-01-06 | Stored cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrary w… |
CVE-2019-5987 | High | 8.8 | 2020-01-06 | Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote authenticated attackers to execute arbitrary OS commands via the Management… |
CVE-2019-20354 | Medium | 4.3 | 2020-01-06 | The web application component of piSignage before 2.6.4 allows a remote attacker (authenticated as a low-privilege user) to download arbitrary files from the R… |
CVE-2019-20352 | High | 7.1 | 2020-01-06 | In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand_one_smacro in asm/… |
CVE-2019-19265 | Medium | 6.1 | 2020-01-06 | IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts. |
CVE-2019-19266 | Medium | 5.4 | 2020-01-06 | IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 2 of 2) in notes for objects. |
CVE-2019-20155 | High | 8.8 | 2020-01-05 | An issue was discovered in report_edit.jsp in Determine (formerly Selectica) Contract Lifecycle Management (CLM) v5.4. Any authenticated user may execute Groov… |
CVE-2019-20154 | Medium | 6.1 | 2020-01-05 | An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) v5.4. A cross-site scripting (XSS) vulnerability in multiple getc… |
CVE-2019-20153 | Medium | 4.9 | 2020-01-05 | An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) in v5.4. An XML external entity (XXE) vulnerability in the upload… |
CVE-2019-20077 | Medium | 4.3 | 2020-01-05 | The Typesetter CMS 5.1 logout functionality is affected by a CSRF vulnerability. The logout function of the admin panel is not protected by any CSRF tokens. An… |
CVE-2019-20004 | High | 8.8 | 2020-01-05 | An issue was discovered on Intelbras IWR 3000N 1.8.7 devices. When the administrator password is changed from a certain client IP address, administrative autho… |
CVE-2019-20337 | High | 7.2 | 2020-01-05 | In PHP Scripts Mall advanced-real-estate-script 4.0.9, the news_edit.php news_id parameter is vulnerable to SQL Injection. |
CVE-2019-20336 | Medium | 6.1 | 2020-01-05 | In PHP Scripts Mall advanced-real-estate-script 4.0.9, the search-results.php searchtext parameter is vulnerable to XSS. |
CVE-2019-19911 | High | 7.5 | 2020-01-05 | There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of ba… |
CVE-2019-19629 | High | 7.5 | 2020-01-05 | In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed via the Group Sear… |
CVE-2019-19628 | Critical | 9.8 | 2020-01-05 | In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and… |
CVE-2019-19314 | High | 7.5 | 2020-01-05 | GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext. |
CVE-2019-19313 | High | 7.5 | 2020-01-05 | GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service. Certain characters were making it impossible to create, edit, or view issues and comm… |
CVE-2019-19312 | Medium | 5.8 | 2020-01-05 | GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked repositories were still abl… |
CVE-2019-20334 | Medium | 5.5 | 2020-01-04 | In Netwide Assembler (NASM) 2.14.02, stack consumption occurs in expr# functions in asm/eval.c. This potentially affects the relationships among expr0, expr1… |
CVE-2019-5846 | Medium | 6.5 | 2020-01-03 | Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2019-5845 | Medium | 6.5 | 2020-01-03 | Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2019-5844 | Medium | 6.5 | 2020-01-03 | Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2019-3768 | Medium | 6.5 | 2020-01-03 | RSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability. A remote authenticated malicious user could potentially expl… |
CVE-2019-13766 | Medium | 6.5 | 2020-01-03 | Use-after-free in accessibility in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13765 | Medium | 6.5 | 2020-01-03 | Use-after-free in content delivery manager in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2019-9542 | Medium | 6.1 | 2020-01-03 | : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in itemlookup.asp of Telos Automated Message Handling Syst… |
CVE-2019-9541 | Medium | 6.1 | 2020-01-03 | : Information Exposure vulnerability in itemlookup.asp of Telos Automated Message Handling System allows a remote attacker to inject arbitrary script into an A… |
CVE-2019-9540 | Medium | 6.1 | 2020-01-03 | : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prefs.asp of Telos Automated Message Handling System al… |
CVE-2019-9539 | Medium | 6.1 | 2020-01-03 | : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ModalWindowPopup.asp of Telos Automated Message Handlin… |
CVE-2019-9538 | Medium | 6.1 | 2020-01-03 | : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the LDAP cbURL parameter of Telos Automated Message Han… |
CVE-2019-9537 | Medium | 6.1 | 2020-01-03 | : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uploaditem.asp of Telos Automated Message Handling Syst… |
CVE-2019-19959 | High | 7.5 | 2020-01-03 | ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-m… |
CVE-2019-11994 | Critical | 9.8 | 2020-01-03 | A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, S… |
CVE-2019-11993 | High | 7.5 | 2020-01-03 | A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, S… |
CVE-2019-5064 | High | 8.8 | 2020-01-03 | An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted J… |
CVE-2019-5063 | High | 8.8 | 2020-01-03 | An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0. A specially crafted XML file can caus… |
CVE-2019-19310 | Medium | 4.9 | 2020-01-03 | GitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure. |
CVE-2019-19309 | Medium | 4.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 8.90 and later through 12.5 has Incorrect Access Control. |
CVE-2019-19263 | Medium | 4.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 8.2 and later through 12.5 has Insecure Permissions. |
CVE-2019-19262 | Medium | 4.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 11.9 and later through 12.5 has Insecure Permissions. |
CVE-2019-19261 | High | 8.8 | 2020-01-03 | GitLab Enterprise Edition (EE) 6.7 and later through 12.5 allows SSRF. |
CVE-2019-19260 | Medium | 5.4 | 2020-01-03 | GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 2 of 2). |
CVE-2019-19259 | Medium | 4.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 11.3 and later through 12.5 allows an Insecure Direct Object Reference (IDOR). |
CVE-2019-19258 | Medium | 5.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 10.8 and later through 12.5 has Incorrect Access Control. |
CVE-2019-19257 | Medium | 5.3 | 2020-01-03 | GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 1 of 2). |
CVE-2019-19256 | Medium | 5.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 12.2 and later through 12.5 has Incorrect Access Control. |
CVE-2019-19255 | Medium | 4.3 | 2020-01-03 | GitLab Enterprise Edition (EE) 12.3 and later through 12.5 has Incorrect Access Control. |
CVE-2019-19311 | Medium | 5.4 | 2020-01-03 | GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields. |
CVE-2019-19254 | Medium | 5.3 | 2020-01-03 | GitLab Community Edition (CE) and Enterprise Edition (EE). 9.6 and later through 12.5 has Incorrect Access Control. |
CVE-2019-19088 | Critical | 9.8 | 2020-01-03 | Gitlab Enterprise Edition (EE) 11.3 through 12.4.2 allows Directory Traversal. |
CVE-2019-19087 | Medium | 4.3 | 2020-01-03 | Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 2 of 2). |
CVE-2019-19086 | Medium | 4.3 | 2020-01-03 | Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 1 of 2). |
CVE-2019-5304 | High | 7.5 | 2020-01-03 | Some Huawei products have a buffer error vulnerability. An unauthenticated, remote attacker could send specific MPLS Echo Request messages to the target produc… |
CVE-2019-19441 | Medium | 6.5 | 2020-01-03 | HUAWEI P30 smart phones with versions earlier than 10.0.0.166(C00E66R1P11) have an information leak vulnerability. An attacker could send specific command in t… |
CVE-2019-20330 | Critical | 9.8 | 2020-01-03 | FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking. |
CVE-2019-20329 | High | 8.1 | 2020-01-03 | OpenLambda 2019-09-10 allows DNS rebinding attacks against the OL server for the REST API on TCP port 5000. |
CVE-2019-10205 | Medium | 6.3 | 2020-01-02 | A flaw was found in the way Red Hat Quay stores robot account tokens in plain text. An attacker able to perform database queries in the Red Hat Quay database c… |
CVE-2019-20225 | Medium | 6.1 | 2020-01-02 | MyBB before 1.8.22 allows an open redirect on login. |
CVE-2019-20219 | High | 8.8 | 2020-01-02 | ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor in ngiflib.c. |
CVE-2019-14864 | Medium | 6.5 | 2020-01-02 | Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumolo… |
CVE-2019-14863 | Medium | 6.1 | 2020-01-02 | There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers dat… |
CVE-2019-14862 | Medium | 6.1 | 2020-01-02 | There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to i… |
CVE-2019-14859 | Critical | 9.1 | 2020-01-02 | A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification… |
CVE-2019-10775 | High | 7.5 | 2020-01-02 | ecstatic have a denial of service vulnerability. Successful exploitation could lead to crash of an application. |
CVE-2019-10158 | Critical | 9.8 | 2020-01-02 | A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration ca… |
CVE-2019-20223 | Medium | 6.1 | 2020-01-02 | In Support Incident Tracker (SiT!) 3.67, the id parameter is affected by XSS on all endpoints that use this parameter, a related issue to CVE-2012-2235. |
CVE-2019-20222 | Medium | 6.1 | 2020-01-02 | In Support Incident Tracker (SiT!) 3.67, the Short Application Name and Application Name inputs in the config.php page are affected by XSS. |
CVE-2019-20221 | Medium | 6.1 | 2020-01-02 | In Support Incident Tracker (SiT!) 3.67, Load Plugins input in the config.php page is affected by XSS. The XSS payload is, for example, executed on the about.p… |
CVE-2019-20220 | Medium | 6.1 | 2020-01-02 | In Support Incident Tracker (SiT!) 3.67, the search_id parameter in the search_incidents_advanced.php page is affected by XSS. |
CVE-2019-20218 | High | 7.5 | 2020-01-02 | selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error. |
CVE-2019-20213 | High | 7.5 | 2020-01-02 | D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php. |
CVE-2019-20208 | Medium | 5.5 | 2020-01-02 | dimC_Read in isomedia/box_code_3gpp.c in GPAC from 0.5.2 to 0.8.0 has a stack-based buffer overflow. |
CVE-2019-20205 | High | 8.8 | 2020-01-02 | libsixel 1.8.4 has an integer overflow in sixel_frame_resize in frame.c. |
CVE-2019-20204 | Medium | 5.4 | 2020-01-02 | The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element. |
CVE-2019-20203 | Medium | 5.3 | 2020-01-02 | The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an emai… |
CVE-2019-20202 | Medium | 6.5 | 2019-12-31 | An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content() tries to use realloc on a block that was not allocated, leading to an i… |
CVE-2019-20201 | Medium | 6.5 | 2019-12-31 | An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxml_parse_* functions mishandle XML entities, leading to an infinite loop in which memory allocatio… |
CVE-2019-20200 | Medium | 6.5 | 2019-12-31 | An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing crafted a XML file, performs incorrect memory handling, leading… |
CVE-2019-20199 | Medium | 6.5 | 2019-12-31 | An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted XML file, performs incorrect memory handling, leading… |
CVE-2019-20198 | Medium | 6.5 | 2019-12-31 | An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_ent_ok() mishandles recursion, leading to stack consumption for a crafted XML file. |
CVE-2019-18568 | High | 8.8 | 2019-12-31 | Avira Free Antivirus 15.0.1907.1514 is prone to a local privilege escalation through the execution of kernel code from a restricted user. |
CVE-2019-20197 | High | 8.8 | 2019-12-31 | In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the c… |
CVE-2019-3984 | Critical | 9.8 | 2019-12-31 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the… |
CVE-2019-14466 | Medium | 6.5 | 2019-12-31 | The GOsa_Filter_Settings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file… |