2019 CVEs (page 47)
Page 47 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-13456 | Medium | 6.5 | 2019-12-03 | In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the… |
CVE-2019-10013 | High | 7.5 | 2019-12-03 | The asn1_signature function in asn1.c in Cameron Hamilton-Rich axTLS through 2.1.5 has a Buffer Overflow that allows remote attackers to cause a denial of serv… |
CVE-2019-19460 | Medium | 5.5 | 2019-12-03 | An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. The product's webserver runs as a Windows service with local SYSTEM permissions by default. This is a… |
CVE-2019-7366 | High | 7.8 | 2019-12-03 | Buffer overflow vulnerability in Autodesk FBX Software Development Kit version 2019.5. A user may be tricked into opening a malicious FBX file which may exploi… |
CVE-2019-7365 | High | 7.8 | 2019-12-03 | DLL preloading vulnerability in Autodesk Desktop Application versions 7.0.16.29 and earlier. An attacker may trick a user into downloading a malicious DLL file… |
CVE-2019-3990 | Medium | 4.3 | 2019-12-03 | A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed to be restricted to administrators. This… |
CVE-2019-19537 | Medium | 4.2 | 2019-12-03 | In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID… |
CVE-2019-19536 | Medium | 4.6 | 2019-12-03 | In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_pro.c dri… |
CVE-2019-19535 | Medium | 4.6 | 2019-12-03 | In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_fd.c driv… |
CVE-2019-19534 | Low | 2.4 | 2019-12-03 | In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c d… |
CVE-2019-19533 | Low | 2.4 | 2019-12-03 | In the Linux kernel before 5.3.4, there is an info-leak bug that can be caused by a malicious USB device in the drivers/media/usb/ttusb-dec/ttusb_dec.c driver… |
CVE-2019-19532 | Medium | 6.8 | 2019-12-03 | In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a malicious USB device in the Linux kernel HID drivers, aka… |
CVE-2019-19531 | Medium | 6.8 | 2019-12-03 | In the Linux kernel before 5.2.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/yurex.c driver, aka CID-fc… |
CVE-2019-19530 | Medium | 4.6 | 2019-12-03 | In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver, aka CI… |
CVE-2019-19529 | Medium | 6.3 | 2019-12-03 | In the Linux kernel before 5.3.11, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/can/usb/mcba_usb.c driver, aka… |
CVE-2019-19528 | Medium | 6.1 | 2019-12-03 | In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/iowarrior.c driver, aka CI… |
CVE-2019-19527 | Medium | 6.8 | 2019-12-03 | In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c driver, aka CI… |
CVE-2019-19526 | Medium | 4.6 | 2019-12-03 | In the Linux kernel before 5.3.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/nfc/pn533/usb.c driver, aka CID-6af… |
CVE-2019-19525 | Medium | 4.6 | 2019-12-03 | In the Linux kernel before 5.3.6, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/ieee802154/atusb.c driver, aka… |
CVE-2019-19524 | Medium | 4.6 | 2019-12-03 | In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memless.c driver, aka CID… |
CVE-2019-19523 | Medium | 4.6 | 2019-12-03 | In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/adutux.c driver, aka CID-4… |
CVE-2019-4468 | Medium | 5.4 | 2019-12-03 | IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th… |
CVE-2019-4467 | Medium | 5.4 | 2019-12-03 | IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th… |
CVE-2019-4465 | Low | 3.3 | 2019-12-03 | IBM Cloud Pak System 2.3 and 2.3.0.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 163774. |
CVE-2019-4226 | Medium | 5.4 | 2019-12-03 | IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th… |
CVE-2019-4130 | High | 8.8 | 2019-12-03 | IBM Cloud Pak System 2.3 and 2.3.0.1 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the v… |
CVE-2019-4098 | Medium | 5.4 | 2019-12-03 | IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th… |
CVE-2019-3666 | Medium | 6.5 | 2019-12-03 | API Abuse/Misuse vulnerability in the web interface in McAfee Web Advisor (WA) prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to… |
CVE-2019-3665 | Medium | 6.5 | 2019-12-03 | Code Injection vulnerability in the web interface in McAfee Web Advisor (WA) prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to r… |
CVE-2019-19516 | Medium | 6.5 | 2019-12-02 | Intelbras WRN 150 1.0.18 devices allow CSRF via GO=system_password.asp to the goform/SysToolChangePwd URI to change a password. |
CVE-2019-19316 | High | 7.5 | 2019-12-02 | When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartex… |
CVE-2019-15689 | Medium | 6.7 | 2019-12-02 | Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud prior to version 2020 patch E have bug that allows… |
CVE-2019-19507 | Medium | 5.3 | 2019-12-02 | In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name… |
CVE-2019-19021 | Critical | 9.8 | 2019-12-02 | An issue was discovered in TitanHQ WebTitan before 5.18. It has a hidden support account (with a hard-coded password) in the web administration interface, with… |
CVE-2019-19020 | High | 7.2 | 2019-12-02 | An issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it is possible to upload a crafted backup file that enables an att… |
CVE-2019-19019 | High | 7.5 | 2019-12-02 | An issue was discovered in TitanHQ WebTitan before 5.18. It contains a Remote Code Execution issue through which an attacker can execute arbitrary code as root… |
CVE-2019-19018 | Low | 2.7 | 2019-12-02 | An issue was discovered in TitanHQ WebTitan before 5.18. It exposes a database configuration file under /include/dbconfig.ini in the web administration interfa… |
CVE-2019-19017 | High | 8.1 | 2019-12-02 | An issue was discovered in TitanHQ WebTitan before 5.18. The appliance has a hard-coded root password set during installation. An attacker could utilize this t… |
CVE-2019-19016 | High | 7.5 | 2019-12-02 | An issue was discovered in TitanHQ WebTitan before 5.18. Some functions, such as /history-x.php, of the administration interface are vulnerable to SQL Injectio… |
CVE-2019-19015 | Critical | 9.8 | 2019-12-02 | An issue was discovered in TitanHQ WebTitan before 5.18. The proxy service (which is typically exposed to all users) allows connections to the internal Postgre… |
CVE-2019-19014 | High | 7.8 | 2019-12-02 | An issue was discovered in TitanHQ WebTitan before 5.18. It has a sudoers file that enables low-privilege users to execute a vast number of commands as root, i… |
CVE-2019-12518 | Critical | 9.8 | 2019-12-02 | Anviz CrossChex access control management software 4.3.8.0 and 4.3.12 is vulnerable to a buffer overflow vulnerability. |
CVE-2019-12503 | Critical | 9.8 | 2019-12-02 | Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to keystroke injection attacks. Thus, an attac… |
CVE-2019-12394 | Critical | 9.8 | 2019-12-02 | Anviz access control devices allow unverified password change which allows remote attackers to change the administrator password without prior authentication. |
CVE-2019-12393 | High | 7.5 | 2019-12-02 | Anviz access control devices are vulnerable to replay attacks which could allow attackers to intercept and replay open door requests. |
CVE-2019-12392 | Critical | 9.8 | 2019-12-02 | Anviz access control devices allow remote attackers to issue commands without a password. |
CVE-2019-12391 | High | 7.5 | 2019-12-02 | The Anviz Management System for access control has insufficient logging for device events such as door open requests. |
CVE-2019-12390 | Medium | 5.3 | 2019-12-02 | Anviz access control devices expose private Information (pin code and name) by allowing remote attackers to query this information without credentials via port… |
CVE-2019-12389 | High | 7.5 | 2019-12-02 | Anviz access control devices expose credentials (names and passwords) by allowing remote attackers to query this information without credentials via port tcp/5… |
CVE-2019-12388 | High | 7.5 | 2019-12-02 | Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on port tcp/5010. |
CVE-2019-19502 | Critical | 9.8 | 2019-12-02 | Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code. |
CVE-2019-15628 | High | 7.8 | 2019-12-02 | Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could allow an attacker to use a specific service… |
CVE-2019-19245 | Critical | 9.8 | 2019-12-02 | NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[username] field when double quotes are use… |
CVE-2019-19118 | Medium | 6.5 | 2019-12-02 | Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-o… |
CVE-2019-19496 | Medium | 5.4 | 2019-12-02 | Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document. |
CVE-2019-19493 | Medium | 5.4 | 2019-12-02 | Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS. |
CVE-2019-19362 | Medium | 6.5 | 2019-12-02 | An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. (The vendor states that it was later fixed.) Upon… |
CVE-2019-19492 | Critical | 9.8 | 2019-12-02 | FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml. |
CVE-2019-19491 | Medium | 6.1 | 2019-12-02 | TestLink 1.9.19 has XSS via the lib/testcases/archiveData.php edit parameter, the index.php reqURI parameter, or the URI in a lib/testcases/tcEdit.php?doAction… |
CVE-2019-19490 | High | 7.3 | 2019-12-02 | LiteManager 4.5.0 has weak permissions (Everyone: Full Control) in the "LiteManagerFree - Server" folder, as demonstrated by ROMFUSClient.exe. |
CVE-2019-19489 | Medium | 5.5 | 2019-12-02 | SMPlayer 19.5.0 has a buffer overflow via a long .m3u file. |
CVE-2019-15631 | Critical | 9.8 | 2019-12-02 | Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 allows remote attackers to execute arbitrar… |
CVE-2019-19481 | Medium | 4.6 | 2019-12-01 | An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-cac1.c mishandles buffer limits for CAC certificates. |
CVE-2019-19480 | Medium | 4.6 | 2019-12-01 | An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/pkcs15-prkey.c has an incorrect free operation in sc_pkcs15_decode_pr… |
CVE-2019-19479 | Medium | 5.5 | 2019-12-01 | An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect read operation during parsing of a SET… |
CVE-2019-18609 | Critical | 9.8 | 2019-12-01 | An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the… |
CVE-2019-19469 | High | 8.8 | 2019-12-01 | In Zmanda Management Console 3.3.9, ZMC_Admin_Advanced?form=adminTasks&action=Apply&command= allows CSRF, as demonstrated by command injection with shell metac… |
CVE-2019-19269 | Medium | 4.9 | 2019-11-30 | An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This pointer is returned by the OpenSSL sk_X509… |
CVE-2019-19468 | High | 7.8 | 2019-11-30 | Free Photo Viewer 1.3 allows remote attackers to execute arbitrary code via a crafted BMP and/or TIFF file that triggers a malformed SEH, as demonstrated by a… |
CVE-2019-19464 | Medium | 5.3 | 2019-11-30 | The CBC Gem application before 9.24.1 for Android and before 9.26.0 for iOS has Unencrypted Analytics. |
CVE-2019-19463 | Medium | 5.3 | 2019-11-30 | The Anhui Huami Mi Fit application before 4.0.11 for Android has an Unencrypted Update Check. |
CVE-2019-19462 | Medium | 5.5 | 2019-11-30 | relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL al… |
CVE-2019-19451 | Medium | 5.5 | 2019-11-29 | When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus en… |
CVE-2019-19396 | High | 7.5 | 2019-11-29 | illumos, as used in OmniOS Community Edition before r151030y, allows a kernel crash via an application with multiple threads calling sendmsg concurrently over… |
CVE-2019-5309 | Medium | 4.6 | 2019-11-29 | Honor play smartphones with versions earlier than 9.1.0.333(C00E333R1P1T8) have an information disclosure vulnerability in certain Huawei . An attacker could v… |
CVE-2019-5308 | Low | 2.4 | 2019-11-29 | Mate 20 RS smartphones with versions earlier than 9.1.0.135(C786E133R3P1) have an improper authorization vulnerability. The software does not properly restrict… |
CVE-2019-5271 | Medium | 5.4 | 2019-11-29 | There is an information leak vulnerability in Huawei smart speaker Myna. When the smart speaker is paired with the cloud through Wi-Fi, the speaker incorrectly… |
CVE-2019-5268 | High | 8.1 | 2019-11-29 | Some Huawei home routers have an input validation vulnerability. Due to input parameter is not correctly verified, an attacker can exploit this vulnerability b… |
CVE-2019-5247 | Medium | 5.5 | 2019-11-29 | Huawei Atlas 300, Atlas 500 have a buffer overflow vulnerability. A local, authenticated attacker may craft specific parameter and send to the process to explo… |
CVE-2019-5269 | High | 7.8 | 2019-11-29 | Some Huawei home routers have an improper authorization vulnerability. Due to improper authorization of certain programs, an attacker can exploit this vulnerab… |
CVE-2019-5263 | Medium | 5.5 | 2019-11-29 | HiSuite with 9.1.0.305 and earlier versions and 9.1.0.305(MAC) and earlier versions and HwBackup with earlier versions before 9.1.1.308 have a brute forcing en… |
CVE-2019-5232 | High | 7.5 | 2019-11-29 | There is a use of insufficiently random values vulnerability in Huawei ViewPoint products. An unauthenticated, remote attacker can guess information by a large… |
CVE-2019-5227 | Medium | 5.5 | 2019-11-29 | P30, P30 Pro, Mate 20 smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1), versions earlier than VOGUE-AL00A 9.1.0.193(C00E190… |
CVE-2019-5225 | High | 7.8 | 2019-11-29 | P30, Mate 20, P30 Pro smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), versions earlier than Hima-AL00B 9.1.0.135(C00E200… |
CVE-2019-5224 | Medium | 5.5 | 2019-11-29 | P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21) have an out of bounds read vulnerability. The system does not properly validate c… |
CVE-2019-5218 | High | 8.8 | 2019-11-29 | There is an insufficient authentication vulnerability in Huawei Band 2 and Honor Band 3. The band does not sufficiently authenticate the device try to connect… |
CVE-2019-5212 | Medium | 5.5 | 2019-11-29 | There is an improper access control vulnerability in Huawei Share. The software does not properly restrict access to certain file from certain application. An… |
CVE-2019-5211 | Medium | 5.7 | 2019-11-29 | The Huawei Share function of P20 phones with versions earlier than Emily-L29C 9.1.0.311 has an improper file management vulnerability. The attacker tricks the… |
CVE-2019-5210 | High | 7.8 | 2019-11-29 | Nova 5i pro and Nova 5 smartphones with versions earlier than 9.1.1.190(C00E190R6P2)and Versions earlier than 9.1.1.175(C00E170R3P2) have an improper validatio… |
CVE-2019-5226 | Medium | 5.5 | 2019-11-29 | P30, P30 Pro, Mate 20 smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1), versions earlier than VOGUE-AL00A 9.1.0.193(C00E190… |
CVE-2019-18922 | High | 7.5 | 2019-11-29 | A Directory Traversal in the Web interface of the Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 [1.00.047] allows unauthenticated attackers to read… |
CVE-2019-16767 | Medium | 6.6 | 2019-11-29 | The admin sys mode is now conditional and dedicated for the special case. By default, since ezmaster@5.2.11 no instance (container) is launched with advanced c… |
CVE-2019-19378 | High | 7.8 | 2019-11-29 | In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image can lead to slab-out-of-bounds write access in index_rbio_pages in fs/btrfs/raid56.c. |
CVE-2019-16766 | High | 8.7 | 2019-11-29 | When using wagtail-2fa before 1.3.0, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by chan… |
CVE-2019-19391 | Critical | 9.1 | 2019-11-29 | In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or r… |
CVE-2019-19377 | High | 7.8 | 2019-11-29 | In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-free in btrfs_queue_w… |
CVE-2019-14901 | Critical | 9.8 | 2019-11-29 | A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote… |
CVE-2019-14897 | Critical | 9.8 | 2019-11-29 | A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An attacker is able to cause a denial of servi… |
CVE-2019-14895 | Critical | 9.8 | 2019-11-29 | A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The flaw could occur… |
CVE-2019-14865 | Medium | 5.9 | 2019-11-29 | A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), c… |