2019 CVEs (page 42)
Page 42 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-11096 | Medium | 5.5 | 2019-12-16 | Insufficient memory protection for Intel(R) Ethernet I218 Adapter driver for Windows* 10 before version 24.1 may allow an authenticated user to potentially ena… |
CVE-2019-10773 | High | 7.8 | 2019-12-16 | In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" k… |
CVE-2019-0159 | High | 7.8 | 2019-12-16 | Insufficient memory protection in the Linux Administrative Tools for Intel(R) Network Adapters before version 24.3 may allow an authenticated user to potential… |
CVE-2019-0134 | High | 7.8 | 2019-12-16 | Improper permissions in the Intel(R) Dynamic Platform and Thermal Framework v8.3.10208.5643 and before may allow an authenticated user to potentially execute c… |
CVE-2019-19743 | Medium | 6.5 | 2019-12-16 | On D-Link DIR-615 devices, a normal user is able to create a root(admin) user from the D-Link portal. |
CVE-2019-19731 | High | 7.5 | 2019-12-16 | Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This… |
CVE-2019-18831 | Medium | 5.3 | 2019-12-16 | Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information Exposure. The encrypted ClickShare Button firmware contains the private key of a tes… |
CVE-2019-18830 | Critical | 9.8 | 2019-12-16 | Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection. The embedded 'dongle_bridge' program used to expose the functionalities of… |
CVE-2019-18828 | Medium | 6.8 | 2019-12-16 | Barco ClickShare Button R9861500D01 devices before 1.9.0 have Insufficiently Protected Credentials. The root account (present for access via debug interfaces… |
CVE-2019-18827 | Medium | 5.9 | 2019-12-16 | On Barco ClickShare Button R9861500D01 devices (before firmware version 1.9.0) JTAG access is disabled after ROM code execution. This means that JTAG access is… |
CVE-2019-18826 | Critical | 9.8 | 2019-12-16 | Barco ClickShare Button R9861500D01 devices before 1.9.0 have Improper Following of a Certificate's Chain of Trust. The embedded 'dongle_bridge' program used t… |
CVE-2019-4560 | Medium | 6.5 | 2019-12-16 | IBM MQ and IBM MQ Appliance 9.1 CD, 9.1 LTS, 9.0 LTS, and 8.0 is vulnerable to a denial of service attack caused by channels processing poorly formatted messag… |
CVE-2019-4444 | Medium | 5.5 | 2019-12-16 | IBM API Connect 2018.1 through 2018.4.1.7 Developer Portal's user registration page does not disable password autocomplete. An attacker with access to the brow… |
CVE-2019-19368 | Medium | 6.1 | 2019-12-16 | A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. An attacker can exploit it by sending a crafted link… |
CVE-2019-19331 | High | 7.5 | 2019-12-16 | knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be proces… |
CVE-2019-19783 | Medium | 6.5 | 2019-12-16 | An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-de… |
CVE-2019-19807 | High | 7.8 | 2019-12-15 | In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_t… |
CVE-2019-19797 | Medium | 5.5 | 2019-12-15 | read_colordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write. |
CVE-2019-5252 | Low | 3.5 | 2019-12-14 | There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficie… |
CVE-2019-5235 | Medium | 5.3 | 2019-12-14 | Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this v… |
CVE-2019-5277 | High | 7.5 | 2019-12-13 | Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by s… |
CVE-2019-5264 | Medium | 4.6 | 2019-12-13 | There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;H… |
CVE-2019-5258 | Medium | 5.5 | 2019-12-13 | Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG630… |
CVE-2019-5257 | Medium | 5.5 | 2019-12-13 | Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace) have a resource management v… |
CVE-2019-5256 | Medium | 5.5 | 2019-12-13 | Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG630… |
CVE-2019-5255 | Medium | 5.5 | 2019-12-13 | Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG630… |
CVE-2019-5254 | High | 8.6 | 2019-12-13 | Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG630… |
CVE-2019-5278 | Medium | 6.5 | 2019-12-13 | There is an out-of-bounds read vulnerability in the Advanced Packages feature of the Gauss100 OLTP database in CampusInsight before V100R019C00SPC200. Attacker… |
CVE-2019-5260 | Medium | 6.5 | 2019-12-13 | Huawei smartphones HUAWEI Y9 2019 and Honor View 20 have a denial of service vulnerability. Due to insufficient input validation of specific value when parsing… |
CVE-2019-5253 | Medium | 5.9 | 2019-12-13 | E5572-855 with versions earlier than 8.0.1.3(H335SP1C233) has an improper authentication vulnerability. The device does not perform a sufficient authentication… |
CVE-2019-19796 | High | 7.8 | 2019-12-13 | Yabasic 2.86.2 has a heap-based buffer overflow in myformat in function.c via a crafted BASIC source file. |
CVE-2019-19795 | High | 7.8 | 2019-12-13 | samurai 0.7 has a heap-based buffer overflow in canonpath in util.c via a crafted build file. |
CVE-2019-19794 | Medium | 5.9 | 2019-12-13 | The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The… |
CVE-2019-17364 | Critical | 9.8 | 2019-12-13 | The processCommandUploadLog() function of libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary… |
CVE-2019-16737 | Critical | 9.8 | 2019-12-13 | The processCommandSetMac() function of libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary sy… |
CVE-2019-16736 | Critical | 9.8 | 2019-12-13 | A stack-based buffer overflow in processCommandUploadSnapshot in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attacke… |
CVE-2019-16735 | Critical | 9.8 | 2019-12-13 | A stack-based buffer overflow in processCommandUploadLog in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to… |
CVE-2019-16734 | Critical | 9.8 | 2019-12-13 | Use of default credentials for the TELNET server in Petwant PF-103 firmware 4.3.2.50 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system… |
CVE-2019-16733 | Critical | 9.8 | 2019-12-13 | processCommandSetUid() in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands… |
CVE-2019-16732 | High | 8.1 | 2019-12-13 | Unencrypted HTTP communications for firmware upgrades in Petalk AI and PF-103 allow man-in-the-middle attackers to run arbitrary code as the root user. |
CVE-2019-16731 | High | 7.5 | 2019-12-13 | The udpServerSys service in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to initiate firmware upgrades and alter device set… |
CVE-2019-16730 | Critical | 9.8 | 2019-12-13 | processCommandUpgrade() in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system command… |
CVE-2019-19793 | High | 8.8 | 2019-12-13 | In Cyxtera AppGate SDP Client 4.1.x through 4.3.x before 4.3.2 on Windows, a local or remote user from the same domain can gain privileges. |
CVE-2019-19790 | Critical | 9.8 | 2019-12-13 | Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with extension .BMP, .EXIF, .GIF, .ICON, .JPEG… |
CVE-2019-19774 | High | 8.8 | 2019-12-13 | An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By running "select hostdetails from hostdetails" at the /event/runq… |
CVE-2019-17123 | High | 7.5 | 2019-12-13 | The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to /system/ws/v11/ss/email) are mishandled, as demonstrated by fro… |
CVE-2019-19722 | Medium | 5.3 | 2019-12-13 | In Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email when push notifications are used, because of a NULL Pointer De… |
CVE-2019-4426 | Medium | 5.4 | 2019-12-13 | The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripting. This vulnerabil… |
CVE-2019-19787 | High | 7.8 | 2019-12-13 | ATasm 1.06 has a stack-based buffer overflow in the get_signed_expression() function in setparse.c via a crafted .m65 file. |
CVE-2019-19786 | High | 7.8 | 2019-12-13 | ATasm 1.06 has a stack-based buffer overflow in the parse_expr() function in setparse.c via a crafted .m65 file. |
CVE-2019-19785 | High | 7.8 | 2019-12-13 | ATasm 1.06 has a stack-based buffer overflow in the to_comma() function in asm.c via a crafted .m65 file. |
CVE-2019-14344 | Medium | 6.1 | 2019-12-13 | TemaTres 3.0 has reflected XSS via the replace_string or search_string parameter to the vocab/admin.php?doAdmin=bulkReplace URI. |
CVE-2019-5291 | Medium | 5.9 | 2019-12-13 | Some Huawei products have an insufficient verification of data authenticity vulnerability. A remote, unauthenticated attacker has to intercept specific packets… |
CVE-2019-5290 | Medium | 6.5 | 2019-12-13 | Huawei S5700 and S6700 have a DoS security vulnerability. Attackers with certain permissions perform specific operations on affected devices. Because the point… |
CVE-2019-5251 | Medium | 5.5 | 2019-12-13 | There is a path traversal vulnerability in several Huawei smartphones. The system does not sufficiently validate certain pathnames from the application. An att… |
CVE-2019-5250 | High | 7.8 | 2019-12-13 | Mate 20 Pro smartphones with versions earlier than 9.1.0.135(C00E133R3P1) have an improper authorization vulnerability. The software does not properly restrict… |
CVE-2019-5248 | High | 7.4 | 2019-12-13 | CloudEngine 12800 has a DoS vulnerability. An attacker of a neighboring device sends a large number of specific packets. As a result, a memory leak occurs afte… |
CVE-2019-19397 | High | 7.5 | 2019-12-13 | There is a weak algorithm vulnerability in some Huawei products. The affected products use weak algorithms by default. Attackers may exploit the vulnerability… |
CVE-2019-17599 | Medium | 6.1 | 2019-12-13 | The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attack… |
CVE-2019-19501 | High | 7.8 | 2019-12-13 | VeraCrypt 1.24 allows Local Privilege Escalation during execution of VeraCryptExpander.exe. |
CVE-2019-18838 | High | 7.5 | 2019-12-13 | An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" res… |
CVE-2019-18802 | Critical | 9.8 | 2019-12-13 | An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will… |
CVE-2019-18801 | Critical | 9.8 | 2019-12-13 | An issue was discovered in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that write to the heap outside of the request buffers when the ups… |
CVE-2019-13347 | High | 7.5 | 2019-12-13 | An issue was discovered in the SAML Single Sign On (SSO) plugin for several Atlassian products affecting versions 3.1.0 through 3.2.2 for Jira and Confluence… |
CVE-2019-19782 | Critical | 9.8 | 2019-12-13 | The FTP client in AceaXe Plus 1.0 allows a buffer overflow via a long EHLO response from an FTP server. |
CVE-2019-19778 | High | 8.8 | 2019-12-13 | An issue was discovered in libsixel 1.8.2. There is a heap-based buffer over-read in the function load_sixel at loader.c. |
CVE-2019-19777 | High | 8.8 | 2019-12-13 | stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read in stbi__load_main. |
CVE-2019-16777 | High | 7.7 | 2019-12-13 | Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritt… |
CVE-2019-16776 | High | 7.7 | 2019-12-13 | Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules f… |
CVE-2019-16775 | High | 7.7 | 2019-12-13 | Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_m… |
CVE-2019-16774 | Medium | 4.4 | 2019-12-12 | In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver. |
CVE-2019-12420 | High | 7.5 | 2019-12-12 | In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended… |
CVE-2019-5144 | High | 8.1 | 2019-12-12 | An exploitable heap underflow vulnerability exists in the derive_taps_and_gains function in kdu_v7ar.dll of Kakadu Software SDK 7.10.2. A specially crafted jp2… |
CVE-2019-5062 | Medium | 6.5 | 2019-12-12 | An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By… |
CVE-2019-5061 | Medium | 6.5 | 2019-12-12 | An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before… |
CVE-2019-3951 | Critical | 9.8 | 2019-12-12 | Advantech WebAccess before 8.4.3 allows unauthenticated remote attackers to execute arbitrary code or cause a denial of service (memory corruption) due to a st… |
CVE-2019-19771 | High | 8.8 | 2019-12-12 | The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In particular, the Trojan… |
CVE-2019-19770 | High | 8.2 | 2019-12-12 | In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (which is used to remove a file or directory… |
CVE-2019-19769 | Medium | 6.7 | 2019-12-12 | In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h). |
CVE-2019-19768 | High | 7.5 | 2019-12-12 | In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_… |
CVE-2019-19767 | Medium | 5.5 | 2019-12-12 | The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and ext4_xattr_set_entr… |
CVE-2019-19766 | High | 7.5 | 2019-12-12 | The Bitwarden server through 1.32.0 has a potentially unwanted KDF. |
CVE-2019-18342 | Critical | 9.9 | 2019-12-12 | A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the Control Center Server… |
CVE-2019-18341 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The SFTP service (default port 22/tcp) of the Control Center Server… |
CVE-2019-18340 | Medium | 5.5 | 2019-12-12 | A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), Control Center Server (CCS) (All versions >= V1.5.0), SiNVR/SiVMS V… |
CVE-2019-18339 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0). The HTTP service (default port 5401/tcp) of the SiVMS/SiNVR Video Serv… |
CVE-2019-18338 | High | 7.7 | 2019-12-12 | A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) contains a directory traversal vuln… |
CVE-2019-18337 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) contains an authentication bypass v… |
CVE-2019-18335 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18334 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18333 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18332 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18331 | Medium | 5.3 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application… |
CVE-2019-18330 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could cause a De… |
CVE-2019-18329 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Deni… |
CVE-2019-18328 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Deni… |
CVE-2019-18327 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Deni… |
CVE-2019-18326 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Deni… |
CVE-2019-18325 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Deni… |
CVE-2019-18324 | Critical | 9.8 | 2019-12-12 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Deni… |