2019 CVEs (page 41)
Page 41 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10482 | Medium | 5.9 | 2019-12-18 | Due to the use of non-time-constant comparison functions there is issue in timing side channels which can be used as a potential side channel for SUI corruptio… |
CVE-2019-10481 | High | 7.8 | 2019-12-18 | Out of bound access occurs while handling the WMI FW event due to lack of check of buffer argument which comes directly from the WLAN FW in Snapdragon Auto, Sn… |
CVE-2019-10480 | High | 7.8 | 2019-12-18 | Out of bound write can happen in WMI firmware event handler due to lack of validation of data received from WLAN firmware in Snapdragon Auto, Snapdragon Consum… |
CVE-2019-19846 | Critical | 9.8 | 2019-12-18 | In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors. |
CVE-2019-19845 | Medium | 5.3 | 2019-12-18 | In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure. |
CVE-2019-19775 | Medium | 6.1 | 2019-12-18 | The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users. |
CVE-2019-15013 | Medium | 4.3 | 2019-12-18 | The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8… |
CVE-2019-7481 | High | 7.5 | 2019-12-17 | Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0… |
CVE-2019-18257 | Critical | 9.8 | 2019-12-17 | In Advantech DiagAnywhere Server, Versions 3.07.11 and prior, multiple stack-based buffer overflow vulnerabilities exist in the file transfer service listening… |
CVE-2019-11657 | High | 8.8 | 2019-12-17 | Cross-Site Request Forgery vulnerability in all Micro Focus ArcSight Logger affecting all product versions below version 7.0. The vulnerability could be exploi… |
CVE-2019-3996 | Medium | 6.5 | 2019-12-17 | ELOG 3.1.4-57bea22 and below can be used as an HTTP GET request proxy when unauthenticated remote attackers send crafted HTTP POST requests. |
CVE-2019-3995 | High | 7.5 | 2019-12-17 | ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference. A remote unauthenticated attacker can crash th… |
CVE-2019-3994 | High | 7.5 | 2019-12-17 | ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a use after free. A remote unauthenticated attacker can crash the ELOG ser… |
CVE-2019-3993 | High | 7.5 | 2019-12-17 | ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can recover a user's password hash by se… |
CVE-2019-3992 | High | 7.5 | 2019-12-17 | ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. A remote unauthenticated attacker can access the server's configuration fi… |
CVE-2019-17337 | Medium | 5.4 | 2019-12-17 | The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerabilit… |
CVE-2019-17336 | Medium | 6.5 | 2019-12-17 | The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vuln… |
CVE-2019-17335 | Medium | 6.5 | 2019-12-17 | The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vuln… |
CVE-2019-17334 | High | 8.0 | 2019-12-17 | The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment… |
CVE-2019-19241 | High | 7.8 | 2019-12-17 | In the Linux kernel before 5.4.2, the io_uring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e448d8709. This is rel… |
CVE-2019-0384 | High | 8.8 | 2019-12-17 | Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05… |
CVE-2019-0383 | High | 8.8 | 2019-12-17 | Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05… |
CVE-2019-19497 | Medium | 5.4 | 2019-12-17 | MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message. |
CVE-2019-19634 | Critical | 9.8 | 2019-12-17 | class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the… |
CVE-2019-19850 | High | 7.2 | 2019-12-17 | An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class… |
CVE-2019-19849 | High | 8.8 | 2019-12-17 | An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView… |
CVE-2019-19848 | High | 7.2 | 2019-12-17 | An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP… |
CVE-2019-19847 | High | 8.1 | 2019-12-17 | Libspiro through 20190731 has a stack-based buffer overflow in the spiro_to_bpath0() function in spiro.c. |
CVE-2019-18956 | Critical | 9.8 | 2019-12-17 | Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 <… |
CVE-2019-18670 | High | 7.8 | 2019-12-17 | In the Quick Access Service (QAAdminAgent.exe) in Acer Quick Access V2.01.3000 through 2.01.3027 and V3.00.3000 through V3.00.3008, a REGULAR user can load an… |
CVE-2019-15235 | Medium | 6.5 | 2019-12-17 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx… |
CVE-2019-14782 | Medium | 6.5 | 2019-12-17 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the /tmp directory, and… |
CVE-2019-19745 | High | 8.8 | 2019-12-17 | Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the… |
CVE-2019-19714 | Medium | 5.3 | 2019-12-17 | Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the… |
CVE-2019-19675 | High | 7.8 | 2019-12-17 | In Ivanti Workspace Control before 10.3.180.0. a locally authenticated user with low privileges can bypass Managed Application Security by leveraging an unspec… |
CVE-2019-19315 | High | 7.1 | 2019-12-17 | NLSSRV32.EXE in Nalpeiron Licensing Service 7.3.4.0, as used with Nitro PDF and other products, allows Elevation of Privilege via the \\.\mailslot\nlsX86ccMail… |
CVE-2019-16576 | Medium | 6.5 | 2019-12-17 | A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker… |
CVE-2019-16575 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an attacker-specified UR… |
CVE-2019-16574 | Medium | 6.5 | 2019-12-17 | A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-s… |
CVE-2019-16573 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attacker-specified URL… |
CVE-2019-16572 | Medium | 5.5 | 2019-12-17 | Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users… |
CVE-2019-16571 | Medium | 4.3 | 2019-12-17 | A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web… |
CVE-2019-16570 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers to connect to an attacker-specified web server. |
CVE-2019-16569 | Medium | 4.3 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to connect to an attacker-specified web server using atta… |
CVE-2019-16568 | Medium | 5.3 | 2019-12-17 | Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configuration, as well as i… |
CVE-2019-16567 | Medium | 4.3 | 2019-12-17 | A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credent… |
CVE-2019-16566 | Medium | 6.5 | 2019-12-17 | A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified U… |
CVE-2019-16565 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-specified URL using atta… |
CVE-2019-16564 | Medium | 5.4 | 2019-12-17 | Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a stored XSS vulnerability exploitable by a… |
CVE-2019-16563 | Medium | 5.4 | 2019-12-17 | Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a stored XSS vulnerability… |
CVE-2019-16562 | Medium | 5.4 | 2019-12-17 | Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored XSS vulnerability exploitable… |
CVE-2019-16561 | High | 7.1 | 2019-12-17 | Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire… |
CVE-2019-16560 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine wh… |
CVE-2019-16559 | Medium | 5.4 | 2019-12-17 | A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and… |
CVE-2019-16558 | High | 8.2 | 2019-12-17 | Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM. |
CVE-2019-16557 | Medium | 6.5 | 2019-12-17 | Jenkins Redgate SQL Change Automation Plugin 2.0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be v… |
CVE-2019-16556 | Medium | 6.5 | 2019-12-17 | Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master wher… |
CVE-2019-16555 | Medium | 6.5 | 2019-12-17 | A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attac… |
CVE-2019-16554 | Medium | 4.3 | 2019-12-17 | A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a… |
CVE-2019-16553 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationa… |
CVE-2019-16552 | Medium | 5.4 | 2019-12-17 | A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifie… |
CVE-2019-16551 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-specified HTTP URL or… |
CVE-2019-16550 | High | 8.8 | 2019-12-17 | A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins… |
CVE-2019-16549 | High | 8.1 | 2019-12-17 | Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle atta… |
CVE-2019-19712 | Medium | 5.3 | 2019-12-17 | Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for… |
CVE-2019-19264 | High | 7.5 | 2019-12-17 | In Simplifile RecordFusion through 2019-11-25, the logs and hist parameters allow remote attackers to access local files via a logger/logs?/../ or logger/hist?… |
CVE-2019-18833 | Medium | 5.9 | 2019-12-17 | Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information exposure (issue 2 of 2).. The encryption key of the media content which is shared be… |
CVE-2019-18832 | High | 8.1 | 2019-12-17 | Barco ClickShare Button R9861500D01 devices before 1.9.0 have incorrect Credentials Management. The ClickShare Button implements encryption at rest which uses… |
CVE-2019-18829 | High | 7.8 | 2019-12-17 | Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. The Barco signed 'Clickshare_For_Windows.exe' binary on… |
CVE-2019-18825 | High | 7.5 | 2019-12-17 | Barco ClickShare Huddle CS-100 devices before 1.9.0 and CSE-200 devices before 1.9.0 have incorrect Credentials Management. The ClickShare Base Unit implements… |
CVE-2019-18824 | Medium | 6.6 | 2019-12-17 | Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. The ClickShare Button does not verify the integrity of t… |
CVE-2019-19815 | Medium | 5.5 | 2019-12-17 | In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause a NULL pointer dereference in f2fs_recover_fsync_data in fs/f2fs/recovery.c. Thi… |
CVE-2019-19816 | High | 7.8 | 2019-12-17 | In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in __btrfs_map_b… |
CVE-2019-19814 | High | 7.8 | 2019-12-17 | In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause __remove_dirty_segment slab-out-of-bounds write access because an array is bound… |
CVE-2019-19813 | Medium | 5.5 | 2019-12-17 | In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after… |
CVE-2019-19830 | Medium | 6.5 | 2019-12-17 | _core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database. |
CVE-2019-15011 | Medium | 4.3 | 2019-12-17 | The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3… |
CVE-2019-19826 | Critical | 9.8 | 2019-12-16 | The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/views_handler_filter_dynamic_fields.inc, as demo… |
CVE-2019-5259 | Medium | 6.5 | 2019-12-16 | There is an information leakage vulnerability on some Huawei products(AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;AR2200;AR2200-S;AR3200;AR3600)… |
CVE-2019-12414 | Medium | 5.3 | 2019-12-16 | In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab |
CVE-2019-12413 | Medium | 5.3 | 2019-12-16 | In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specially crafted compl… |
CVE-2019-19818 | Medium | 5.5 | 2019-12-16 | The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0xa08a Out-of-Bounds Read via… |
CVE-2019-18191 | High | 8.8 | 2019-12-16 | A privilege escalation vulnerability in the Trend Micro Deep Security as a Service Quick Setup cloud formation template could allow an authenticated entity wit… |
CVE-2019-16778 | Low | 2.6 | 2019-12-16 | In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case data_size and n… |
CVE-2019-13182 | Medium | 5.4 | 2019-12-16 | A stored cross-site scripting (XSS) vulnerability exists in the web UI of SolarWinds Serv-U FTP Server 15.1.7. |
CVE-2019-13181 | Medium | 6.5 | 2019-12-16 | A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7. |
CVE-2019-18579 | Medium | 6.8 | 2019-12-16 | Settings for the Dell XPS 13 2-in-1 (7390) BIOS versions prior to 1.1.3 contain a configuration vulnerability. The BIOS configuration for the "Enable Thunderbo… |
CVE-2019-18269 | Critical | 9.8 | 2019-12-16 | Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability. |
CVE-2019-18261 | Critical | 9.8 | 2019-12-16 | In Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series, all versions, the software does not implement sufficient meas… |
CVE-2019-18259 | Critical | 9.8 | 2019-12-16 | In Omron PLC CJ series, all versions and Omron PLC CS series, all versions, an attacker could spoof arbitrary messages or execute commands. |
CVE-2019-16779 | Medium | 5.8 | 2019-12-16 | In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would… |
CVE-2019-14612 | Medium | 6.7 | 2019-12-16 | Out of bounds write in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2019-14611 | Medium | 6.7 | 2019-12-16 | Integer overflow in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2019-14610 | High | 7.8 | 2019-12-16 | Improper access control in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2019-14609 | Medium | 6.7 | 2019-12-16 | Improper input validation in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2019-14608 | High | 7.8 | 2019-12-16 | Improper buffer restrictions in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2019-14607 | Medium | 5.3 | 2019-12-16 | Improper conditions check in multiple Intel® Processors may allow an authenticated user to potentially enable partial escalation of privilege, denial of servic… |
CVE-2019-14605 | High | 7.8 | 2019-12-16 | Improper permissions in the installer for the Intel(R) SCS Platform Discovery Utility, all versions, may allow an authenticated user to potentially enable esca… |
CVE-2019-14604 | Medium | 5.5 | 2019-12-16 | Null pointer dereference in the FPGA kernel driver for Intel(R) Quartus(R) Prime Pro Edition before version 19.3 may allow an authenticated user to potentially… |
CVE-2019-14603 | High | 7.8 | 2019-12-16 | Improper permissions in the installer for the License Server software for Intel® Quartus® Prime Pro Edition before version 19.3 may allow an authenticated user… |