2019 CVEs (page 37)
Page 37 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-19909 | High | 8.8 | 2019-12-19 | An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2. Code injection can occu… |
CVE-2019-18181 | High | 7.8 | 2019-12-19 | In CloudVision Portal all releases in the 2018.1 and 2018.2 Code train allows users with read-only permissions to bypass permissions for restricted functionali… |
CVE-2019-19907 | Critical | 9.8 | 2019-12-19 | HrAddFBBlock in libfreebusy/freebusyutil.cpp in Kopano Groupware Core before 8.7.7 allows out-of-bounds access, as demonstrated by mishandling of an array copy… |
CVE-2019-19906 | High | 7.5 | 2019-12-19 | cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The… |
CVE-2019-19905 | Critical | 9.8 | 2019-12-19 | NetHack 3.6.x before 3.6.4 is prone to a buffer overflow vulnerability when reading very long lines from configuration files. This affects systems that have Ne… |
CVE-2019-18955 | Medium | 6.1 | 2019-12-19 | The web console in Lansweeper 7.2.105.2 has XSS via the URL path. Product vulnerability has been fixed and disclosed within changelog as of 02 Dec 2019. |
CVE-2019-18615 | Medium | 4.9 | 2019-12-19 | In CloudVision Portal (CVP) for all releases in the 2018.2 Train, under certain conditions, the application logs user passwords in plain text for certain API c… |
CVE-2019-17633 | High | 8.8 | 2019-12-19 | For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of an arbitrary Che wo… |
CVE-2019-16465 | High | 7.5 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16464 | Critical | 9.8 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-11780 | High | 8.1 | 2019-12-19 | Improper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 allows remote authenticated attackers to… |
CVE-2019-16463 | Critical | 9.8 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16462 | Critical | 9.8 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16461 | High | 7.5 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16460 | Critical | 9.8 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16459 | Critical | 9.8 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16458 | High | 7.5 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16457 | High | 7.5 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16456 | High | 7.5 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16455 | Critical | 9.8 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16454 | Critical | 9.8 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16453 | Critical | 9.8 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16452 | Critical | 9.8 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16451 | Critical | 9.8 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16450 | Critical | 9.8 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16449 | High | 7.5 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16448 | Critical | 9.8 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16446 | Critical | 9.8 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16445 | Critical | 9.8 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-16444 | Critical | 9.8 | 2019-12-19 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… |
CVE-2019-19903 | Medium | 4.8 | 2019-12-19 | An issue was discovered in Backdrop CMS 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying file type descriptions created by administr… |
CVE-2019-19902 | High | 7.2 | 2019-12-19 | An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It allows the upload of entire-site configuration archives through the u… |
CVE-2019-19901 | Medium | 4.8 | 2019-12-19 | An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying certain block desc… |
CVE-2019-19900 | Medium | 4.8 | 2019-12-19 | An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying content type names… |
CVE-2019-7487 | High | 7.8 | 2019-12-19 | Installation of the SonicOS SSLVPN NACagent 3.5 on the Windows operating system, an autorun value is created does not put the path in quotes, so if a malicious… |
CVE-2019-7486 | High | 8.8 | 2019-12-19 | Code injection in SonicWall SMA100 allows an authenticated user to execute arbitrary code in viewcacert CGI script. This vulnerability impacted SMA100 version… |
CVE-2019-7485 | High | 8.8 | 2019-12-19 | Buffer overflow in SonicWall SMA100 allows an authenticated user to execute arbitrary code in DEARegister CGI script. This vulnerability impacted SMA100 versio… |
CVE-2019-7484 | Medium | 6.5 | 2019-12-19 | Authenticated SQL Injection in SonicWall SMA100 allow user to gain read-only access to unauthorized resources using viewcacert CGI script. This vulnerability i… |
CVE-2019-7483 | High | 7.5 | 2019-12-19 | In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on th… |
CVE-2019-7482 | Critical | 9.8 | 2019-12-19 | Stack-based buffer overflow in SonicWall SMA100 allows an unauthenticated user to execute arbitrary code in function libSys.so. This vulnerability impacted SMA… |
CVE-2019-15006 | Medium | 6.5 | 2019-12-19 | There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was u… |
CVE-2019-19899 | Critical | 9.8 | 2019-12-19 | Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism (intended to block access to instances of java.lang.Class) because getClass is accessi… |
CVE-2019-17390 | High | 7.8 | 2019-12-18 | An issue was discovered in the Outlook add-in in Pronestor Planner before 8.1.77. There is local privilege escalation in the Health Monitor service because Pro… |
CVE-2019-19788 | Medium | 5.5 | 2019-12-18 | Opera for Android before 54.0.2669.49432 is vulnerable to a sandboxed cross-origin iframe bypass attack. By using a service working inside a sandboxed iframe i… |
CVE-2019-18781 | Medium | 6.1 | 2019-12-18 | An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a craft… |
CVE-2019-11147 | High | 7.8 | 2019-12-18 | Insufficient access control in hardware abstraction driver for MEInfo software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0… |
CVE-2019-11132 | High | 8.4 | 2019-12-18 | Cross site scripting in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow a privileged user to potentially enable esc… |
CVE-2019-11131 | Critical | 9.8 | 2019-12-18 | Logic issue in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable escala… |
CVE-2019-11110 | Medium | 6.7 | 2019-12-18 | Authentication bypass in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before version… |
CVE-2019-11109 | Medium | 4.4 | 2019-12-18 | Logic issue in the subsystem for Intel(R) SPS before versions SPS_E5_04.01.04.275.0, SPS_SoC-X_04.00.04.100.0 and SPS_SoC-A_04.00.04.191.0 may allow a privileg… |
CVE-2019-11108 | Medium | 6.7 | 2019-12-18 | Insufficient input validation in subsystem for Intel(R) CSME before versions 12.0.45 and 13.0.10 may allow a privileged user to potentially enable escalation o… |
CVE-2019-11107 | Critical | 9.8 | 2019-12-18 | Insufficient input validation in the subsystem for Intel(R) AMT before version 12.0.45 may allow an unauthenticated user to potentially enable escalation of pr… |
CVE-2019-11106 | Medium | 6.7 | 2019-12-18 | Insufficient session validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 a… |
CVE-2019-11105 | Medium | 6.7 | 2019-12-18 | Logic issue in subsystem for Intel(R) CSME before versions 12.0.45, 13.0.10 and 14.0.10 may allow a privileged user to potentially enable escalation of privile… |
CVE-2019-11104 | High | 7.8 | 2019-12-18 | Insufficient input validation in MEInfo software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE befo… |
CVE-2019-11103 | High | 7.8 | 2019-12-18 | Insufficient input validation in firmware update software for Intel(R) CSME before versions 12.0.45,13.0.10 and 14.0.10 may allow an authenticated user to pote… |
CVE-2019-11102 | Medium | 4.4 | 2019-12-18 | Insufficient input validation in Intel(R) DAL software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TX… |
CVE-2019-11101 | Medium | 4.4 | 2019-12-18 | Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before… |
CVE-2019-11100 | Medium | 4.6 | 2019-12-18 | Insufficient input validation in the subsystem for Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to po… |
CVE-2019-11097 | High | 7.8 | 2019-12-18 | Improper directory permissions in the installer for Intel(R) Management Engine Consumer Driver for Windows before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45… |
CVE-2019-11090 | Medium | 5.9 | 2019-12-18 | Cryptographic timing conditions in the subsystem for Intel(R) PTT before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0 and 14.0.10; Intel(R) TXE 3.1.70… |
CVE-2019-11088 | High | 8.8 | 2019-12-18 | Insufficient input validation in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potenti… |
CVE-2019-11087 | Medium | 6.7 | 2019-12-18 | Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before… |
CVE-2019-11086 | Medium | 6.8 | 2019-12-18 | Insufficient input validation in subsystem for Intel(R) AMT before version 12.0.45 may allow an unauthenticated user to potentially enable escalation of privil… |
CVE-2019-0169 | High | 8.8 | 2019-12-18 | Heap overflow in subsystem in Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow an u… |
CVE-2019-0168 | Medium | 4.4 | 2019-12-18 | Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45 and 13.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 m… |
CVE-2019-0166 | High | 7.5 | 2019-12-18 | Insufficient input validation in the subsystem for Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to po… |
CVE-2019-0165 | Medium | 4.4 | 2019-12-18 | Insufficient Input validation in the subsystem for Intel(R) CSME before versions 12.0.45,13.0.10 and 14.0.10 may allow a privileged user to potentially enable… |
CVE-2019-0131 | High | 8.1 | 2019-12-18 | Insufficient input validation in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potenti… |
CVE-2019-5487 | Medium | 5.3 | 2019-12-18 | An improper access control vulnerability exists in Gitlab EE <v12.3.3, <v12.2.7, & <v12.1.13 that allowed the group search feature with Elasticsearch to return… |
CVE-2019-5486 | High | 8.8 | 2019-12-18 | A authentication bypass vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.10 in the Salesforce login integration that could be used by an att… |
CVE-2019-5469 | Medium | 6.5 | 2019-12-18 | An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archive to replace other users files potenti… |
CVE-2019-5080 | Critical | 9.1 | 2019-12-18 | An exploitable denial-of-service vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200 Firmware versions 03.01.07(13) and 03.0… |
CVE-2019-5079 | Critical | 9.8 | 2019-12-18 | An exploitable heap buffer overflow vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03… |
CVE-2019-5078 | Critical | 9.1 | 2019-12-18 | An exploitable denial of service vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00… |
CVE-2019-5075 | Critical | 9.8 | 2019-12-18 | An exploitable stack buffer overflow vulnerability exists in the command line utility getcouplerdetails of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00… |
CVE-2019-5073 | Medium | 5.3 | 2019-12-18 | An exploitable information exposure vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03… |
CVE-2019-1387 | High | 8.8 | 2019-12-18 | An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are cu… |
CVE-2019-19724 | High | 7.5 | 2019-12-18 | Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an informat… |
CVE-2019-18997 | Medium | 4.3 | 2019-12-18 | The HMISimulator component of ABB PB610 Panel Builder 600 uses the readFile/writeFile interface to manipulate the work file. Path configuration in PB610 HMISim… |
CVE-2019-18996 | High | 7.1 | 2019-12-18 | Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially al… |
CVE-2019-18995 | Medium | 4.3 | 2019-12-18 | The HMISimulator component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier fails to validate the content-length field for HTTP requests, exposing… |
CVE-2019-18994 | Low | 3.9 | 2019-12-18 | Due to a lack of file length check, the HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier crashes when trying to load an empty… |
CVE-2019-18573 | High | 8.8 | 2019-12-18 | The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authent… |
CVE-2019-18572 | Critical | 9.8 | 2019-12-18 | The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain an Improper Authentication vulnerability. A… |
CVE-2019-18571 | Medium | 5.4 | 2019-12-18 | The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a reflected cross-site scripting vulnerabili… |
CVE-2019-15600 | High | 7.5 | 2019-12-18 | A Path traversal exists in http_server which allows an attacker to read arbitrary system files. |
CVE-2019-15599 | Critical | 9.8 | 2019-12-18 | A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command. |
CVE-2019-15598 | Critical | 9.8 | 2019-12-18 | A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command. |
CVE-2019-15597 | Critical | 9.8 | 2019-12-18 | A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input. |
CVE-2019-15596 | High | 7.5 | 2019-12-18 | A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within the working director… |
CVE-2019-15591 | Medium | 6.5 | 2019-12-18 | An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge… |
CVE-2019-15589 | High | 8.8 | 2019-12-18 | An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to use GIT clone and pul… |
CVE-2019-15580 | Medium | 6.5 | 2019-12-18 | An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for… |
CVE-2019-15577 | Medium | 4.3 | 2019-12-18 | An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed project milestones to be disclosed via groups bro… |
CVE-2019-15576 | High | 7.5 | 2019-12-18 | An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private system notes from a G… |
CVE-2019-15575 | High | 7.5 | 2019-12-18 | A command injection exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope. |
CVE-2019-7621 | Medium | 5.4 | 2019-12-18 | Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visualizations. An attacker with the ability… |
CVE-2019-5081 | Critical | 9.8 | 2019-12-18 | An exploitable heap buffer overflow vulnerability exists in the iocheckd service ''I/O-Chec'' functionality of WAGO PFC 200 Firmware version 03.01.07(13) and 0… |
CVE-2019-5077 | Critical | 9.1 | 2019-12-18 | An exploitable denial-of-service vulnerability exists in the iocheckd service ‘’I/O-Chec’’ functionality of WAGO PFC 200 Firmware versions 03.01.07(13) and 03… |