2019 CVEs (page 40)
Page 40 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-8552 | High | 7.8 | 2019-12-18 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A mal… |
CVE-2019-8551 | Medium | 6.1 | 2019-12-18 | A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7… |
CVE-2019-8550 | Medium | 4.3 | 2019-12-18 | An issue existed in the pausing of FaceTime video. The issue was resolved with improved logic. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, watchOS 5… |
CVE-2019-8549 | High | 7.8 | 2019-12-18 | Multiple input validation issues existed in MIG generated code. These issues were addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mo… |
CVE-2019-8548 | Low | 2.4 | 2019-12-18 | An issue existed where partially entered passcodes may not clear when the device went to sleep. This issue was addressed by clearing the passcode when a locked… |
CVE-2019-8546 | Medium | 5.5 | 2019-12-18 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, watchOS 5.2. A local user may be abl… |
CVE-2019-8545 | High | 7.1 | 2019-12-18 | A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A local… |
CVE-2019-8544 | High | 8.8 | 2019-12-18 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for… |
CVE-2019-8542 | High | 7.8 | 2019-12-18 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2, iTunes 12.9.4 for… |
CVE-2019-8541 | Low | 3.3 | 2019-12-18 | A privacy issue existed in motion sensor calibration. This issue was addressed with improved motion sensor processing. This issue is fixed in iOS 12.2, watchOS… |
CVE-2019-8540 | Medium | 5.5 | 2019-12-18 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A mal… |
CVE-2019-8537 | Medium | 5.5 | 2019-12-18 | An access issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. A local user may be able to view a user’s locked no… |
CVE-2019-8536 | High | 8.8 | 2019-12-18 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for… |
CVE-2019-8535 | High | 8.8 | 2019-12-18 | A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCl… |
CVE-2019-8533 | High | 7.8 | 2019-12-18 | A lock handling issue was addressed with improved lock handling. This issue is fixed in macOS Mojave 10.14.4. A Mac may not lock when disconnecting from an ext… |
CVE-2019-8530 | Medium | 5.5 | 2019-12-18 | This issue was addressed with improved checks. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2. A malicious application may be able to overwri… |
CVE-2019-8529 | High | 7.8 | 2019-12-18 | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. An application may be able to ex… |
CVE-2019-8527 | Critical | 9.1 | 2019-12-18 | A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A remote attacker… |
CVE-2019-8526 | High | 7.8 | 2019-12-18 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated… |
CVE-2019-8524 | High | 8.8 | 2019-12-18 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Wind… |
CVE-2019-8523 | High | 8.8 | 2019-12-18 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Wind… |
CVE-2019-8522 | Medium | 5.5 | 2019-12-18 | A logic issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.4. An encrypted volume may be unmounted and remounted by… |
CVE-2019-8521 | Medium | 5.5 | 2019-12-18 | This issue was addressed with improved checks. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A malicious application may be able to overwrite arbitrar… |
CVE-2019-8520 | Medium | 5.5 | 2019-12-18 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Mojave 10.14.4. A malicious application may be able to read res… |
CVE-2019-8519 | Medium | 5.5 | 2019-12-18 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Mojave 10.14.4. An application may be able to read restricted m… |
CVE-2019-8518 | High | 8.8 | 2019-12-18 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12… |
CVE-2019-8517 | Medium | 6.5 | 2019-12-18 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. Processing a… |
CVE-2019-8516 | High | 7.5 | 2019-12-18 | A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. Processing a maliciously c… |
CVE-2019-8515 | Medium | 6.5 | 2019-12-18 | A cross-origin issue existed with the fetch API. This was addressed with improved input validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iT… |
CVE-2019-8514 | High | 7.8 | 2019-12-18 | A logic issue was addressed with improved state management. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. An application may b… |
CVE-2019-8513 | High | 7.8 | 2019-12-18 | This issue was addressed with improved checks. This issue is fixed in macOS Mojave 10.14.4. A local user may be able to execute arbitrary shell commands. |
CVE-2019-8512 | Medium | 5.7 | 2019-12-18 | This issue was addressed with improved transparency. This issue is fixed in iOS 12.2. A user may authorize an enterprise administrator to remotely wipe their d… |
CVE-2019-8511 | High | 7.8 | 2019-12-18 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, watchOS 5.2. A malicious applicatio… |
CVE-2019-8510 | Medium | 5.5 | 2019-12-18 | An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in iOS… |
CVE-2019-8508 | High | 7.8 | 2019-12-18 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Mojave 10.14.4. Mounting a maliciously crafted NFS network share ma… |
CVE-2019-8507 | Medium | 5.5 | 2019-12-18 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Mojave 10.14.4. Processing malicious data may lea… |
CVE-2019-8506 | High | 8.8 | 2019-12-18 | A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Win… |
CVE-2019-8505 | Medium | 6.1 | 2019-12-18 | A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, Safari 12.1. Enabling the Safari Reader feature on a maliciously crafted… |
CVE-2019-8504 | Medium | 5.5 | 2019-12-18 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A local user may be able to r… |
CVE-2019-8503 | High | 8.8 | 2019-12-18 | A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7… |
CVE-2019-8502 | Low | 3.3 | 2019-12-18 | An API issue existed in the handling of dictation requests. This issue was addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mojave 10… |
CVE-2019-7293 | Medium | 5.5 | 2019-12-18 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A local u… |
CVE-2019-7292 | Medium | 6.5 | 2019-12-18 | A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud f… |
CVE-2019-7290 | Critical | 10.0 | 2019-12-18 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in Shortcuts 2.1.3 for iOS. A sandboxed process may be able to circumve… |
CVE-2019-7289 | Medium | 5.5 | 2019-12-18 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in Shortcuts 2.1.3 for iOS. A local user ma… |
CVE-2019-7287 | High | 7.8 | 2019-12-18 | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to execute arbitrary code… |
CVE-2019-7286 | High | 7.8 | 2019-12-18 | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An applica… |
CVE-2019-7285 | High | 8.8 | 2019-12-18 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iClou… |
CVE-2019-7284 | Medium | 4.3 | 2019-12-18 | This issue was addressed with improved checks. This issue is fixed in iOS 12.2. Processing a maliciously crafted mail message may lead to S/MIME signature spoo… |
CVE-2019-6239 | High | 7.8 | 2019-12-18 | This issue was addressed with improved handling of file metadata. This issue is fixed in macOS Mojave 10.14.4. A malicious application may bypass Gatekeeper ch… |
CVE-2019-6237 | High | 8.8 | 2019-12-18 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1… |
CVE-2019-6236 | High | 7.5 | 2019-12-18 | A race condition existed during the installation of iCloud for Windows. This was addressed with improved state handling. This issue is fixed in iCloud for Wind… |
CVE-2019-6232 | High | 7.5 | 2019-12-18 | A race condition existed during the installation of iTunes for Windows. This was addressed with improved state handling. This issue is fixed in iCloud for Wind… |
CVE-2019-6222 | Medium | 4.3 | 2019-12-18 | A consistency issue was addressed with improved state handling. This issue is fixed in iOS 12.2. A website may be able to access the microphone without the mic… |
CVE-2019-6207 | Medium | 5.5 | 2019-12-18 | An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in iOS… |
CVE-2019-6204 | Medium | 6.1 | 2019-12-18 | A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, Safari 12.1. Enabling the Safari Reader feature on a maliciously crafted… |
CVE-2019-6201 | High | 8.8 | 2019-12-18 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Wind… |
CVE-2019-19833 | Medium | 6.5 | 2019-12-18 | In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieved in applications t… |
CVE-2019-19832 | High | 8.8 | 2019-12-18 | Xerox AltaLink C8035 printers allow CSRF. A request to add users is made in the Device User Database form field to the xerox.set URI. (The frmUserName value mu… |
CVE-2019-19829 | Medium | 5.4 | 2019-12-18 | A cross-site scripting (XSS) vulnerability exists in SolarWinds Serv-U FTP Server 15.1.7 in the email parameter, a different vulnerability than CVE-2018-19934… |
CVE-2019-4716 | Critical | 9.8 | 2019-12-18 | IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute… |
CVE-2019-4609 | High | 7.5 | 2019-12-18 | IBM API Connect 2018.4.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2019-19882 | High | 7.8 | 2019-12-18 | shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs ar… |
CVE-2019-11992 | Medium | 6.1 | 2019-12-18 | A security vulnerability in HPE OneView for VMware vCenter 9.5 could be exploited remotely to allow Cross-Site Scripting. |
CVE-2019-5152 | High | 7.4 | 2019-12-18 | An exploitable information disclosure vulnerability exists in the network packet handling functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cip… |
CVE-2019-11400 | Critical | 9.8 | 2019-12-18 | An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices. A buffer overflow occurs through the get_set.ccp ccp_… |
CVE-2019-11399 | Critical | 9.8 | 2019-12-18 | An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices. OS command injection occurs through the get_set.ccp l… |
CVE-2019-19235 | High | 7.0 | 2019-12-18 | AsLdrSrv.exe in ASUS ATK Package before V1.0.0061 (for Windows 10 notebook PCs) could lead to unsigned code execution with no additional execution. The user mu… |
CVE-2019-4388 | Medium | 4.8 | 2019-12-18 | HCL AppScan Source 9.0.3.13 and earlier is susceptible to cross-site scripting (XSS) attacks by allowing users to embed arbitrary JavaScript code in the Web UI. |
CVE-2019-19742 | Medium | 4.8 | 2019-12-18 | On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field. |
CVE-2019-2304 | High | 7.8 | 2019-12-18 | Integer overflow to buffer overflow due to lack of validation of event arguments received from firmware. in Snapdragon Auto, Snapdragon Consumer Electronics Co… |
CVE-2019-2274 | High | 7.8 | 2019-12-18 | Improper Access Control for RPU write access from secure processor in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdr… |
CVE-2019-2242 | Critical | 9.8 | 2019-12-18 | Device memory may get corrupted because of buffer overflow/underflow. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Sna… |
CVE-2019-19880 | High | 7.5 | 2019-12-18 | exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses… |
CVE-2019-10614 | Critical | 9.8 | 2019-12-18 | Out of boundary access is possible as there is no validation of data accessed against the received size of the packet in case of malicious firmware in Snapdrag… |
CVE-2019-10607 | High | 7.8 | 2019-12-18 | Out of bounds memcpy can occur by providing the embedded NULL character string and length greater than the actual string length in Snapdragon Auto, Snapdragon… |
CVE-2019-10605 | High | 7.8 | 2019-12-18 | Buffer overwrite can occur in IEEE80211 header filling function due to lack of range check of array index received from firmware in Snapdragon Auto, Snapdragon… |
CVE-2019-10601 | High | 7.8 | 2019-12-18 | Out of bound access can occur while processing firmware event due to lack of validation of WMI message received from firmware in Snapdragon Auto, Snapdragon Co… |
CVE-2019-10600 | High | 7.8 | 2019-12-18 | Use of local variable as argument to netlink CB callback goes out of it scope when callback triggered lead to invalid stack memory in Snapdragon Auto, Snapdrag… |
CVE-2019-10598 | High | 7.8 | 2019-12-18 | Out of bound access can occur while processing peer info in IBSS connection mode due to lack of upper bounds check to ensure that for loop further will not cau… |
CVE-2019-10595 | High | 7.8 | 2019-12-18 | Possible buffer overwrite in message handler due to lack of validation of tid value calculated from packets received from firmware in Snapdragon Auto, Snapdrag… |
CVE-2019-10584 | High | 7.8 | 2019-12-18 | Possibility of out of bound access in debug queue, if packet size field is corrupted in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrago… |
CVE-2019-10572 | Critical | 9.8 | 2019-12-18 | Improper check in video driver while processing data from video firmware can lead to integer overflow and then buffer overflow in Snapdragon Auto, Snapdragon C… |
CVE-2019-10564 | High | 7.8 | 2019-12-18 | Possible OOB issue in EEPROM due to lack of check while accessing memory map array at the time of reading operation in Snapdragon Auto, Snapdragon Compute, Sna… |
CVE-2019-10557 | Critical | 9.8 | 2019-12-18 | Out-of-bound read in the wireless driver in the Linux kernel due to lack of check of buffer length. in Snapdragon Auto, Snapdragon Consumer Electronics Connect… |
CVE-2019-10544 | High | 7.8 | 2019-12-18 | Improper length check on source buffer to handle userspace data received can lead to out-of-bound access in diag handlers in Snapdragon Auto, Snapdragon Comput… |
CVE-2019-10537 | High | 7.8 | 2019-12-18 | Improper validation of event buffer extracted from FW response can lead to integer overflow, which will allow to pass the length check and eventually will lead… |
CVE-2019-10536 | High | 7.8 | 2019-12-18 | Potential double free scenario if driver receives another DIAG_EVENT_LOG_SUPPORTED event from firmware as the pointer is not set to NULL on first call in Snapd… |
CVE-2019-10525 | Critical | 9.8 | 2019-12-18 | Buffer overflow during SIB read when network configures complete sib list along with first and last segment of other SIB in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-10518 | High | 7.8 | 2019-12-18 | Use after free of a pointer in iWLAN scenario during netmgr state transition to CONNECT in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdr… |
CVE-2019-10517 | High | 7.8 | 2019-12-18 | Memory is being freed up twice when two concurrent threads are executing in parallel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdrago… |
CVE-2019-10516 | Critical | 9.8 | 2019-12-18 | Multiple read overflows in MM while decoding service accept,service reject,attach reject and MT detach in Snapdragon Auto, Snapdragon Compute, Snapdragon Consu… |
CVE-2019-10513 | Medium | 5.5 | 2019-12-18 | Possibility of Null pointer access if the SPDM commands are executed in the non-standard way in Trustzone in Snapdragon Auto, Snapdragon Compute, Snapdragon Co… |
CVE-2019-10500 | Critical | 9.8 | 2019-12-18 | While processing MT Secondary PDP request, Buffer overflow will happen due to incorrect calculation of buffer size in Snapdragon Auto, Snapdragon Compute, Snap… |
CVE-2019-10487 | Critical | 9.8 | 2019-12-18 | Buffer over read can happen while parsing SMS OTA messages at transport layer if network sends un-intended values in Snapdragon Auto, Snapdragon Compute, Snapd… |
CVE-2019-10482 | Medium | 5.9 | 2019-12-18 | Due to the use of non-time-constant comparison functions there is issue in timing side channels which can be used as a potential side channel for SUI corruptio… |
CVE-2019-10481 | High | 7.8 | 2019-12-18 | Out of bound access occurs while handling the WMI FW event due to lack of check of buffer argument which comes directly from the WLAN FW in Snapdragon Auto, Sn… |
CVE-2019-10480 | High | 7.8 | 2019-12-18 | Out of bound write can happen in WMI firmware event handler due to lack of validation of data received from WLAN firmware in Snapdragon Auto, Snapdragon Consum… |
CVE-2019-19846 | Critical | 9.8 | 2019-12-18 | In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors. |
CVE-2019-19845 | Medium | 5.3 | 2019-12-18 | In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure. |