2019 CVEs (page 44)
Page 44 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-3989 | Critical | 9.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when retr… |
CVE-2019-3988 | High | 8.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when conf… |
CVE-2019-3987 | High | 8.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when conf… |
CVE-2019-3986 | High | 8.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when conf… |
CVE-2019-3985 | High | 8.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when conf… |
CVE-2019-3983 | Medium | 6.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary code and commands on the device due to insufficient UART protectio… |
CVE-2019-18245 | High | 7.8 | 2019-12-11 | Reliable Controls LicenseManager versions 3.4 and prior may allow an authenticated user to insert malicious code into the system root path, which may allow exe… |
CVE-2019-18232 | High | 7.8 | 2019-12-11 | SafeNet Sentinel LDK License Manager, all versions prior to 7.101(only Microsoft Windows versions are affected) is vulnerable when configured as a service. Thi… |
CVE-2019-17087 | High | 7.5 | 2019-12-11 | Unauthorized file download vulnerability in all supported versions of Micro Focus AcuToWeb. The vulnerability could be exploited to enumerate and download file… |
CVE-2019-0405 | High | 7.5 | 2019-12-11 | SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of users, leading to a us… |
CVE-2019-0404 | High | 7.5 | 2019-12-11 | SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information Disclosure. |
CVE-2019-0403 | Critical | 9.8 | 2019-12-11 | SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading to CSV Command Inject… |
CVE-2019-0402 | Medium | 4.4 | 2019-12-11 | SAP Adaptive Server Enterprise, before versions 15.7 and 16.0, under certain conditions exposes some sensitive information to the admin, leading to Information… |
CVE-2019-0399 | Medium | 6.5 | 2019-12-11 | SAP Portfolio and Project Management, before versions S4CORE 102, 103, EPPM 100 and CPRXRPM 500_702, 600_740, 610_740; unintentionally allows a user to discove… |
CVE-2019-0398 | High | 8.8 | 2019-12-11 | Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 and 4.3, may lead to… |
CVE-2019-0395 | Medium | 5.4 | 2019-12-11 | SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows execution of JavaScript in a text module in Fiori BI Launch… |
CVE-2019-19729 | High | 7.5 | 2019-12-11 | An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js. ObjectID() allows an attacker to generate a malformed objectid by i… |
CVE-2019-19374 | Critical | 9.1 | 2019-12-11 | An issue was discovered in core/assets/form/form_question_types/form_question_type_file_upload/form_question_type_file_upload.inc in Squiz Matrix CMS 5.5.0 pri… |
CVE-2019-19373 | High | 7.5 | 2019-12-11 | An issue was discovered in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2 prior to 5.5.2.4, and 5.5.3 prior to 5.5.3.3 where a user can… |
CVE-2019-19725 | Critical | 9.8 | 2019-12-11 | sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c. |
CVE-2019-19650 | High | 8.8 | 2019-12-11 | Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to the Agent.java proce… |
CVE-2019-19649 | Critical | 9.8 | 2019-12-11 | Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter to the SyncEventSe… |
CVE-2019-19583 | High | 7.5 | 2019-12-11 | An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service (guest OS crash) because VMX VMEntry checks mish… |
CVE-2019-19582 | Medium | 6.5 | 2019-12-11 | An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service (infinite loop) because certain bit iteration is mishand… |
CVE-2019-19581 | Medium | 6.5 | 2019-12-11 | An issue was discovered in Xen through 4.12.x allowing 32-bit Arm guest OS users to cause a denial of service (out-of-bounds access) because certain bit iterat… |
CVE-2019-19580 | Medium | 6.6 | 2019-12-11 | An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion an… |
CVE-2019-19578 | High | 8.8 | 2019-12-11 | An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via degenerate chains of linear pagetables, because o… |
CVE-2019-19577 | High | 7.2 | 2019-12-11 | An issue was discovered in Xen through 4.12.x allowing x86 AMD HVM guest OS users to cause a denial of service or possibly gain privileges by triggering data-s… |
CVE-2019-14317 | Medium | 5.3 | 2019-12-11 | wolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) generate biased DSA nonces. This allows a remote attacker to compute the long term private k… |
CVE-2019-18379 | High | 7.3 | 2019-12-11 | Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a server-side request forgery (SSRF) exploit, which is a type of issue that can let an attac… |
CVE-2019-18378 | Medium | 4.8 | 2019-12-11 | Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers to… |
CVE-2019-18377 | High | 7.2 | 2019-12-11 | Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attem… |
CVE-2019-10772 | Medium | 6.1 | 2019-12-11 | It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer. |
CVE-2019-4715 | High | 8.8 | 2019-12-11 | IBM Spectrum Scale 4.2 and 5.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request… |
CVE-2019-4665 | Medium | 5.4 | 2019-12-11 | IBM Spectrum Scale 4.2 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alt… |
CVE-2019-15009 | Medium | 4.3 | 2019-12-11 | The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user's favourite… |
CVE-2019-15008 | Medium | 6.1 | 2019-12-11 | The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScrip… |
CVE-2019-15007 | Medium | 4.8 | 2019-12-11 | The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scri… |
CVE-2019-14899 | High | 7.4 | 2019-12-11 | A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user, to determine if a… |
CVE-2019-18960 | Critical | 9.8 | 2019-12-11 | Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result in potentially exploitable crashes. |
CVE-2019-18935 | Critical | 9.8 | 2019-12-11 | Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when… |
CVE-2019-3667 | Medium | 6.6 | 2019-12-11 | DLL Search Order Hijacking vulnerability in the Microsoft Windows client in McAfee Tech Check 3.0.0.17 and earlier allows local users to execute arbitrary code… |
CVE-2019-19720 | High | 8.8 | 2019-12-11 | Yabasic 2.86.1 has a heap-based buffer overflow in the yylex() function in flex.c via a crafted BASIC source file. |
CVE-2019-19719 | Medium | 6.1 | 2019-12-11 | Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page. |
CVE-2019-19709 | Medium | 6.1 | 2019-12-11 | MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable… |
CVE-2019-19708 | Medium | 6.1 | 2019-12-11 | The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute. |
CVE-2019-19707 | High | 7.5 | 2019-12-11 | On Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices (with firmware through 6.0), denial of service can occur via PROFINET DCE-RPC endpoint discovery packets. |
CVE-2019-5815 | High | 7.5 | 2019-12-11 | Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data. |
CVE-2019-19604 | High | 7.8 | 2019-12-11 | Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 becaus… |
CVE-2019-14889 | High | 8.8 | 2019-12-10 | A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp… |
CVE-2019-14870 | Medium | 5.4 | 2019-12-10 | All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes… |
CVE-2019-14861 | Medium | 5.3 | 2019-12-10 | All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides admi… |
CVE-2019-1490 | Medium | 5.4 | 2019-12-10 | A spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business Server Spoofin… |
CVE-2019-1489 | High | 7.5 | 2019-12-10 | An information disclosure vulnerability exists when the Windows Remote Desktop Protocol (RDP) fails to properly handle objects in memory, aka 'Remote Desktop P… |
CVE-2019-1488 | Low | 3.3 | 2019-12-10 | A security feature bypass vulnerability exists when Microsoft Defender improperly handles specific buffers, aka 'Microsoft Defender Security Feature Bypass Vul… |
CVE-2019-1487 | Medium | 6.5 | 2019-12-10 | An information disclosure vulnerability in Android Apps using Microsoft Authentication Library (MSAL) 0.3.1-Alpha or later exists under specific conditions, ak… |
CVE-2019-1486 | Medium | 6.1 | 2019-12-10 | A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL specified by the s… |
CVE-2019-1485 | High | 7.5 | 2019-12-10 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. |
CVE-2019-1484 | High | 7.8 | 2019-12-10 | A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerabi… |
CVE-2019-1483 | High | 7.8 | 2019-12-10 | An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker… |
CVE-2019-1481 | Medium | 4.3 | 2019-12-10 | An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows Media Player Informatio… |
CVE-2019-1480 | Medium | 4.3 | 2019-12-10 | An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows Media Player Informatio… |
CVE-2019-1478 | High | 7.8 | 2019-12-10 | An elevation of privilege vulnerability exists when Windows improperly handles COM object creation, aka 'Windows COM Server Elevation of Privilege Vulnerabilit… |
CVE-2019-1477 | High | 7.8 | 2019-12-10 | An elevation of privilege vulnerability exists when the Windows Printer Service improperly validates file paths while loading printer drivers, aka 'Windows Pri… |
CVE-2019-1476 | High | 7.8 | 2019-12-10 | An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privileg… |
CVE-2019-1474 | Medium | 5.5 | 2019-12-10 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera… |
CVE-2019-1472 | Medium | 5.5 | 2019-12-10 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera… |
CVE-2019-1471 | High | 8.2 | 2019-12-10 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2019-1470 | Medium | 6.0 | 2019-12-10 | An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a… |
CVE-2019-1469 | Medium | 5.5 | 2019-12-10 | An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerabili… |
CVE-2019-1468 | High | 8.8 | 2019-12-10 | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k Graphics Remote Cod… |
CVE-2019-1467 | Medium | 6.5 | 2019-12-10 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1466 | Medium | 6.5 | 2019-12-10 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1465 | Medium | 6.5 | 2019-12-10 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis… |
CVE-2019-1464 | Medium | 5.5 | 2019-12-10 | An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosur… |
CVE-2019-1463 | Medium | 5.5 | 2019-12-10 | An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, aka 'Microsoft Access… |
CVE-2019-1462 | High | 7.8 | 2019-12-10 | A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka 'Microsoft Powe… |
CVE-2019-1461 | Medium | 6.5 | 2019-12-10 | A denial of service vulnerability exists in Microsoft Word software when the software fails to properly handle objects in memory, aka 'Microsoft Word Denial of… |
CVE-2019-1458 | High | 7.8 | 2019-12-10 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil… |
CVE-2019-1453 | High | 7.5 | 2019-12-10 | A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted… |
CVE-2019-1400 | Medium | 5.5 | 2019-12-10 | An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, aka 'Microsoft Access… |
CVE-2019-1332 | Medium | 6.1 | 2019-12-10 | A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially-crafted web reques… |
CVE-2019-13764 | High | 8.8 | 2019-12-10 | Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13763 | Medium | 4.3 | 2019-12-10 | Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the renderer process to leak c… |
CVE-2019-13762 | Low | 3.3 | 2019-12-10 | Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded files via local cod… |
CVE-2019-13761 | Medium | 4.3 | 2019-12-10 | Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted d… |
CVE-2019-13759 | Medium | 4.3 | 2019-12-10 | Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-13758 | Medium | 4.3 | 2019-12-10 | Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via… |
CVE-2019-13757 | Medium | 4.3 | 2019-12-10 | Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted d… |
CVE-2019-13756 | Medium | 4.3 | 2019-12-10 | Incorrect security UI in printing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-13755 | Medium | 4.3 | 2019-12-10 | Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a crafted HTML page. |
CVE-2019-13754 | Medium | 4.3 | 2019-12-10 | Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted… |
CVE-2019-13753 | Medium | 6.5 | 2019-12-10 | Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2019-13752 | Medium | 6.5 | 2019-12-10 | Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2019-13751 | Medium | 6.5 | 2019-12-10 | Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2019-13750 | Medium | 6.5 | 2019-12-10 | Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML… |
CVE-2019-13749 | Medium | 6.5 | 2019-12-10 | Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c… |
CVE-2019-13748 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information… |
CVE-2019-13747 | High | 8.8 | 2019-12-10 | Uninitialized data in rendering in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2019-13746 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via… |