2019 CVEs (page 45)
Page 45 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-13745 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in audio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-13744 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in cookies in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-13743 | Medium | 6.5 | 2019-12-10 | Incorrect security UI in external protocol handling in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof security UI via a crafted HTML pa… |
CVE-2019-13742 | Medium | 6.5 | 2019-12-10 | Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c… |
CVE-2019-13741 | High | 8.8 | 2019-12-10 | Insufficient validation of untrusted input in Blink in Google Chrome prior to 79.0.3945.79 allowed a local attacker to bypass same origin policy via crafted cl… |
CVE-2019-13740 | Medium | 6.5 | 2019-12-10 | Incorrect security UI in sharing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2019-13739 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a… |
CVE-2019-13738 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in navigation in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
CVE-2019-13737 | Medium | 6.5 | 2019-12-10 | Insufficient policy enforcement in autocomplete in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information fr… |
CVE-2019-13736 | High | 8.8 | 2019-12-10 | Integer overflow in PDFium in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2019-13735 | High | 8.8 | 2019-12-10 | Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTM… |
CVE-2019-13734 | High | 8.8 | 2019-12-10 | Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13732 | High | 8.8 | 2019-12-10 | Use-after-free in WebAudio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13730 | High | 8.8 | 2019-12-10 | Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13729 | High | 8.8 | 2019-12-10 | Use-after-free in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13728 | High | 8.8 | 2019-12-10 | Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2019-13727 | High | 8.8 | 2019-12-10 | Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy via a crafted HTML… |
CVE-2019-13726 | High | 8.8 | 2019-12-10 | Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
CVE-2019-13725 | High | 8.8 | 2019-12-10 | Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
CVE-2019-5843 | High | 8.8 | 2019-12-10 | Out of bounds memory access in JavaScript in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2019-5841 | High | 8.8 | 2019-12-10 | Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2019-17270 | Critical | 9.8 | 2019-12-10 | Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command={C… |
CVE-2019-13672 | Medium | 6.5 | 2019-12-10 | Incorrect security UI in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) vi… |
CVE-2019-19703 | Medium | 6.1 | 2019-12-10 | In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location. |
CVE-2019-19702 | High | 7.5 | 2019-12-10 | The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exp… |
CVE-2019-6192 | Medium | 4.4 | 2019-12-10 | A potential vulnerability has been reported in Lenovo Power Management Driver versions prior to 1.67.17.48 leading to a buffer overflow which could cause a den… |
CVE-2019-6183 | High | 7.5 | 2019-12-10 | A denial of service vulnerability has been reported in Lenovo Energy Management Driver for Windows 10 versions prior to 15.11.29.7 that could cause systems to… |
CVE-2019-4663 | Medium | 5.4 | 2019-12-10 | IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2019-4521 | Critical | 9.8 | 2019-12-10 | Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the syste… |
CVE-2019-4244 | Critical | 9.1 | 2019-12-10 | IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to gain unauthorized information and unrestricted control over Zookeeper installatio… |
CVE-2019-4095 | Medium | 4.3 | 2019-12-10 | IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted fr… |
CVE-2019-19251 | Medium | 5.3 | 2019-12-10 | The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. Although there is a… |
CVE-2019-19698 | Medium | 6.5 | 2019-12-10 | marc-q libwav through 2017-04-20 has a NULL pointer dereference in wav_content_read() at libwav.c. |
CVE-2019-4621 | Critical | 9.8 | 2019-12-09 | IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is… |
CVE-2019-4612 | High | 8.8 | 2019-12-09 | IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Attackers can make use of this weakness and upload malicious execut… |
CVE-2019-4611 | Medium | 5.4 | 2019-12-09 | IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2019-4428 | Medium | 5.4 | 2019-12-09 | IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J… |
CVE-2019-19230 | Critical | 9.8 | 2019-12-09 | An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component that can allow a remote attacker to execu… |
CVE-2019-19646 | Critical | 9.8 | 2019-12-09 | pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns. |
CVE-2019-19603 | High | 7.5 | 2019-12-09 | SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash. |
CVE-2019-18190 | Critical | 9.8 | 2019-12-09 | Trend Micro Security (Consumer) 2020 (v16.x) is affected by a vulnerability in where null pointer dereference errors result in the crash of application, which… |
CVE-2019-19687 | High | 8.8 | 2019-12-09 | OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials… |
CVE-2019-18380 | Medium | 6.5 | 2019-12-09 | Symantec Industrial Control System Protection (ICSP), versions 6.x.x, may be susceptible to an unauthorized access issue that could potentially allow a threat… |
CVE-2019-19685 | High | 8.8 | 2019-12-09 | RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can be used for renames and deletions. |
CVE-2019-19684 | High | 8.8 | 2019-12-09 | nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin/FacebookAuthentica… |
CVE-2019-19683 | Critical | 9.1 | 2019-12-09 | RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/ProcessRequest because of Libraries/Nop.Se… |
CVE-2019-19682 | Medium | 4.8 | 2019-12-09 | nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentatio… |
CVE-2019-14251 | High | 7.5 | 2019-12-09 | An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a document on the server once successfully au… |
CVE-2019-19679 | Medium | 5.4 | 2019-12-09 | In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the Pre-Condition Summary entry point via the summar… |
CVE-2019-19678 | Medium | 5.4 | 2019-12-09 | In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the generic field entry point via the Generic Test D… |
CVE-2019-19645 | Medium | 5.5 | 2019-12-09 | alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE sta… |
CVE-2019-19648 | High | 7.8 | 2019-12-09 | In the macho_parse_file functionality in macho/macho.c of YARA 3.11.0, command_size may be inconsistent with the real size. A specially crafted MachO file can… |
CVE-2019-19647 | High | 7.8 | 2019-12-09 | radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write… |
CVE-2019-19642 | High | 8.8 | 2019-12-08 | On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who… |
CVE-2019-19638 | Critical | 9.8 | 2019-12-08 | An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function load_pnm at frompnm.c, due to an integer overflow. |
CVE-2019-19637 | Critical | 9.8 | 2019-12-08 | An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_decode_raw_impl at fromsixel.c. |
CVE-2019-19636 | Critical | 9.8 | 2019-12-08 | An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_encode_body at tosixel.c. |
CVE-2019-19635 | Critical | 9.8 | 2019-12-08 | An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function sixel_decode_raw_impl at fromsixel.c. |
CVE-2019-19630 | High | 7.8 | 2019-12-08 | HTMLDOC 1.9.7 allows a stack-based buffer overflow in the hd_strlcpy() function in string.c (when called from render_contents in ps-pdf.cxx) via a crafted HTML… |
CVE-2019-19449 | High | 7.8 | 2019-12-08 | In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segmen… |
CVE-2019-19448 | High | 7.8 | 2019-12-08 | In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to… |
CVE-2019-19447 | High | 7.8 | 2019-12-08 | In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super… |
CVE-2019-16772 | Low | 3.1 | 2019-12-07 | The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in se… |
CVE-2019-9464 | Medium | 5.5 | 2019-12-06 | In various functions of RecentLocationApps.java, DevicePolicyManagerService.java, and RecognitionService.java, there is an incorrect warning indicating an app… |
CVE-2019-2232 | High | 7.5 | 2019-12-06 | In handleRun of TextLine.java, there is a possible application crash due to improper input validation. This could lead to remote denial of service when process… |
CVE-2019-2231 | Medium | 4.4 | 2019-12-06 | In Blob::Blob of blob.cpp, there is a possible unencrypted master key due to improper input validation. This could lead to local information disclosure with Sy… |
CVE-2019-2230 | High | 7.5 | 2019-12-06 | In nfcManager_routeAid and nfcManager_unrouteAid of NativeNfcManager.cpp, there is possible memory reuse due to a use after free. This could lead to remote inf… |
CVE-2019-2229 | Medium | 5.5 | 2019-12-06 | In updateWidget of BaseWidgetProvider.java, there is a possible leak of user data due to a missing permission check. This could lead to local information discl… |
CVE-2019-2228 | Medium | 5.5 | 2019-12-06 | In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure in the print… |
CVE-2019-2227 | Medium | 6.5 | 2019-12-06 | In DeepCopy of btif_av.cc, there is a possible out of bounds read due to improper casting. This could lead to remote information disclosure over Bluetooth with… |
CVE-2019-2226 | Medium | 5.5 | 2019-12-06 | In device_class_to_int of device_class.cc, there is a possible out of bounds read due to improper casting. This could lead to local information disclosure in t… |
CVE-2019-2225 | High | 8.8 | 2019-12-06 | When pairing with a Bluetooth device, it may be possible to pair a malicious device without any confirmation from the user, and that device may be able to inte… |
CVE-2019-2223 | High | 7.8 | 2019-12-06 | In ihevcd_ref_list of ihevcd_ref_list.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with n… |
CVE-2019-2222 | High | 7.8 | 2019-12-06 | n ihevcd_parse_slice_data of ihevcd_parse_slice.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execut… |
CVE-2019-2221 | High | 7.8 | 2019-12-06 | In hasActivityInVisibleTask of WindowProcessController.java there’s a possible bypass of user interaction requirements due to incorrect handling of top activit… |
CVE-2019-2220 | Medium | 5.5 | 2019-12-06 | In checkOperation of AppOpsService.java, there is a possible bypass of user interaction requirements due to mishandling application suspend. This could lead to… |
CVE-2019-2219 | Medium | 4.7 | 2019-12-06 | In several functions of NotificationManagerService.java and related files, there is a possible way to record audio from the background without notification to… |
CVE-2019-2218 | High | 7.8 | 2019-12-06 | In createSessionInternal of PackageInstallerService.java, there is a possible improper permission grant due to a missing permission check. This could lead to l… |
CVE-2019-2217 | High | 7.8 | 2019-12-06 | In setCpuVulkanInUse of GpuStats.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no add… |
CVE-2019-10769 | Critical | 9.8 | 2019-12-06 | safer-eval is a npm package to sandbox the he evaluation of code used within the eval function. Affected versions of this package are vulnerable to Arbitrary C… |
CVE-2019-18575 | High | 7.1 | 2019-12-06 | Dell Command Configure versions prior to 4.2.1 contain an uncontrolled search path vulnerability. A locally authenticated malicious user could exploit this vul… |
CVE-2019-11293 | Medium | 6.5 | 2019-12-06 | Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote… |
CVE-2019-16771 | Medium | 4.8 | 2019-12-06 | Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP heade… |
CVE-2019-1551 | Medium | 5.3 | 2019-12-06 | There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis sugges… |
CVE-2019-18672 | High | 7.5 | 2019-12-06 | Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cryptographic secrets… |
CVE-2019-18671 | Critical | 9.8 | 2019-12-06 | Insufficient checks in the USB packet handling of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow out-of-bounds writes in the .bss segment v… |
CVE-2019-16674 | Critical | 9.8 | 2019-12-06 | An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Auth… |
CVE-2019-16673 | Medium | 6.5 | 2019-12-06 | An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Pass… |
CVE-2019-16672 | Critical | 9.8 | 2019-12-06 | An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Sens… |
CVE-2019-16671 | Medium | 6.5 | 2019-12-06 | An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Remo… |
CVE-2019-16670 | Critical | 9.8 | 2019-12-06 | An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. The… |
CVE-2019-12734 | High | 8.8 | 2019-12-06 | SiteVision 4 has Incorrect Access Control. |
CVE-2019-12733 | High | 8.8 | 2019-12-06 | SiteVision 4 allows Remote Code Execution. |
CVE-2019-5544 | Critical | 9.8 | 2019-12-06 | OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical sever… |
CVE-2019-19627 | Medium | 5.3 | 2019-12-06 | SROS 2 0.8.1 (after CVE-2019-19625 is mitigated) leaks ROS 2 node-related information regardless of the rtps_protection_kind configuration. (SROS2 provides the… |
CVE-2019-19625 | Medium | 5.3 | 2019-12-06 | SROS 2 0.8.1 (which provides the tools that generate and distribute keys for Robot Operating System 2 and uses the underlying security plugins of DDS from ROS… |
CVE-2019-19620 | Low | 3.3 | 2019-12-06 | In SecureWorks Red Cloak Windows Agent before 2.0.7.9, a local user can bypass the generation of telemetry alerts by removing NT AUTHORITY\SYSTEM permissions f… |
CVE-2019-19552 | Medium | 4.8 | 2019-12-06 | In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/admin/config.php?di… |
CVE-2019-19551 | Medium | 4.8 | 2019-12-06 | In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. An attacker with access to th… |
CVE-2019-19334 | Critical | 9.8 | 2019-12-06 | In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref"… |