2019 CVEs (page 48)
Page 48 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-19388 | Medium | 6.1 | 2019-11-29 | A cross-site scripting (XSS) vulnerability in app/dialplans/dialplan_detail_edit.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script… |
CVE-2019-19387 | Medium | 6.1 | 2019-11-29 | A cross-site scripting (XSS) vulnerability in app/fifo_list/fifo_interactive.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or H… |
CVE-2019-19386 | Medium | 6.1 | 2019-11-29 | A cross-site scripting (XSS) vulnerability in app/voicemail_greetings/voicemail_greeting_edit.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrar… |
CVE-2019-19385 | Medium | 6.1 | 2019-11-29 | A cross-site scripting (XSS) vulnerability in app/dialplans/dialplans.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2019-19384 | Medium | 6.1 | 2019-11-29 | A cross-site scripting (XSS) vulnerability in app/fax/fax_log_view.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via th… |
CVE-2019-19379 | Medium | 5.3 | 2019-11-28 | In app/Controller/TagsController.php in MISP 2.4.118, users can bypass intended restrictions on tagging data. |
CVE-2019-19376 | Medium | 6.5 | 2019-11-28 | In Octopus Deploy before 2019.10.6, an authenticated user with TeamEdit permission could send a malformed Team API request that bypasses input validation and c… |
CVE-2019-19375 | Medium | 5.3 | 2019-11-28 | In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute. (The f… |
CVE-2019-19372 | High | 7.5 | 2019-11-28 | A downloadFile.php download_file path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders and potentially down… |
CVE-2019-18276 | High | 7.8 | 2019-11-28 | An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its re… |
CVE-2019-19318 | Medium | 4.4 | 2019-11-28 | In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in k… |
CVE-2019-19319 | Medium | 6.5 | 2019-11-27 | In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access because of an ext4_xat… |
CVE-2019-18660 | Medium | 4.7 | 2019-11-27 | The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72b… |
CVE-2019-18253 | Critical | 10.0 | 2019-11-27 | An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series (versions 1p1r26, 1.2.3.17, 2.0.0.10, RES670… |
CVE-2019-18247 | High | 7.5 | 2019-11-27 | An attacker may use a specially crafted message to force Relion 650 series (versions 1.3.0.5 and prior) or Relion 670 series (versions 1.2.3.18, 2.0.0.11, 2.1… |
CVE-2019-6673 | High | 7.5 | 2019-11-27 | On versions 15.0.0-15.0.1 and 14.0.0-14.1.2, when the BIG-IP is configured in HTTP/2 Full Proxy mode, specifically crafted requests may cause a disruption of s… |
CVE-2019-6672 | High | 7.5 | 2019-11-27 | On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, and 13.1.0-13.1.3.1, when bad-actor detection is configured on a wildcard virtual server on platforms with hardware… |
CVE-2019-6671 | High | 7.5 | 2019-11-27 | On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, under certain conditions tmm may leak memory when processing packet fragments, lead… |
CVE-2019-6670 | Medium | 4.4 | 2019-11-27 | On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5, vCMP hypervisors are incorrectly exposing the plainte… |
CVE-2019-6669 | High | 7.5 | 2019-11-27 | On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, undisclosed traffic flow may cause TMM to restart u… |
CVE-2019-6668 | Medium | 5.5 | 2019-11-27 | The BIG-IP APM Edge Client for macOS bundled with BIG-IP APM 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.5, and 11.5.1-11.6.5… |
CVE-2019-6667 | High | 7.5 | 2019-11-27 | On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.5.1-11.6.5, under certain conditions, TMM may consume exces… |
CVE-2019-6666 | High | 7.5 | 2019-11-27 | On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, and 13.1.0-13.1.1.4, the TMM process may produce a core file when an upstream server or cache sends… |
CVE-2019-6665 | Critical | 9.4 | 2019-11-27 | On BIG-IP ASM 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, BIG-IQ 6.0.0 and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, an… |
CVE-2019-6674 | High | 7.5 | 2019-11-27 | On F5 SSL Orchestrator 15.0.0-15.0.1 and 14.0.0-14.1.2, TMM may crash when processing SSLO data in a service-chaining configuration. |
CVE-2019-15705 | High | 7.5 | 2019-11-27 | An Improper Input Validation vulnerability in the SSL VPN portal of FortiOS versions 6.2.1 and below, and 6.0.6 and below may allow an unauthenticated remote a… |
CVE-2019-19367 | Medium | 6.1 | 2019-11-27 | A cross-site scripting (XSS) vulnerability in app/fax/fax_files.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the i… |
CVE-2019-19366 | Medium | 6.1 | 2019-11-27 | A cross-site scripting (XSS) vulnerability in app/xml_cdr/xml_cdr_search.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2019-19242 | Medium | 5.9 | 2019-11-27 | SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c. |
CVE-2019-19330 | Critical | 9.8 | 2019-11-27 | The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the z… |
CVE-2019-19329 | Medium | 6.1 | 2019-11-27 | In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript… |
CVE-2019-19328 | Medium | 6.1 | 2019-11-27 | ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI… |
CVE-2019-19327 | Medium | 6.1 | 2019-11-27 | ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number… |
CVE-2019-18184 | Critical | 9.8 | 2019-11-27 | Crestron DMC-STRO 1.0 devices allow remote command execution as root via shell metacharacters to the ping function. |
CVE-2019-10220 | High | 8.8 | 2019-11-27 | Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists. |
CVE-2019-19308 | Medium | 5.5 | 2019-11-27 | In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing a TTF font file that lacks a name secti… |
CVE-2019-15300 | High | 8.8 | 2019-11-27 | A problem was found in Centreon Web through 19.04.3. An authenticated SQL injection is present in the page include/Administration/parameters/ldap/xml/ldap_host… |
CVE-2019-15298 | High | 8.8 | 2019-11-27 | A problem was found in Centreon Web through 19.04.3. An authenticated command injection is present in the page include/configuration/configObject/traps-mibs/fo… |
CVE-2019-14812 | High | 7.8 | 2019-11-27 | A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling… |
CVE-2019-13936 | Low | 3.5 | 2019-11-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siemens AG Polarion could allow an attacker… |
CVE-2019-13935 | Low | 3.5 | 2019-11-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siemens AG Polarion could allow an attacker… |
CVE-2019-13934 | Low | 3.5 | 2019-11-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siemens AG Polarion could allow an attacker… |
CVE-2019-10216 | High | 7.8 | 2019-11-27 | In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions… |
CVE-2019-14896 | Critical | 9.8 | 2019-11-27 | A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. A remote attacker could cause a d… |
CVE-2019-14867 | High | 8.8 | 2019-11-27 | A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function… |
CVE-2019-10195 | Medium | 6.5 | 2019-11-27 | A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch… |
CVE-2019-17590 | High | 8.8 | 2019-11-26 | The csrf_callback function in the CSRF Magic library through 2016-03-27 is vulnerable to CSRF protection bypass as it allows one to tamper with the csrf token… |
CVE-2019-17392 | Critical | 9.8 | 2019-11-26 | Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled. |
CVE-2019-16388 | Medium | 4.3 | 2019-11-26 | PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyStream=MyAlerts request to get Audit Log informatio… |
CVE-2019-16387 | High | 8.1 | 2019-11-26 | PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/random_token/!STANDARD?pyActivity=Data-Admin-DB-Name.DBSchema_ListDatabases request while using a low-p… |
CVE-2019-16386 | Medium | 4.3 | 2019-11-26 | PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyActivity=GetWebInfo&target=popup&pzHarnessID=… |
CVE-2019-16255 | High | 8.1 | 2019-11-26 | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#… |
CVE-2019-16254 | Medium | 5.3 | 2019-11-26 | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the re… |
CVE-2019-16201 | High | 7.5 | 2019-11-26 | WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/b… |
CVE-2019-16195 | Medium | 6.1 | 2019-11-26 | Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields. |
CVE-2019-18679 | High | 7.5 | 2019-11-26 | An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HT… |
CVE-2019-18678 | Medium | 5.3 | 2019-11-26 | An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that split… |
CVE-2019-18677 | Medium | 6.1 | 2019-11-26 | An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with… |
CVE-2019-18676 | High | 7.5 | 2019-11-26 | An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in Denial of… |
CVE-2019-18580 | Critical | 10.0 | 2019-11-26 | Dell EMC Storage Monitoring and Reporting version 4.3.1 contains a Java RMI Deserialization of Untrusted Data vulnerability. A remote unauthenticated attacker… |
CVE-2019-18456 | Medium | 5.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integration.. It has Insec… |
CVE-2019-18455 | High | 7.5 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11 through 12.4 when building Nested GraphQL queries. It has a large or infinite loop. |
CVE-2019-18454 | Medium | 6.1 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 10.5 through 12.4 in link validation for RDoc wiki pages feature. It has XSS. |
CVE-2019-18453 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.6 through 12.4 in the add comments via email feature. It has Insecure Permissions. |
CVE-2019-18452 | Medium | 5.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4 when moving an issue to a public project from a private one. It has Insecu… |
CVE-2019-18451 | Medium | 6.1 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 10.7.4 through 12.4 in the InternalRedirect filtering feature. It has an Open Redirect. |
CVE-2019-18450 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the Project labels feature. It has Insecure Permissions. |
CVE-2019-18449 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the autocomplete feature. It has Insecure Permissions (issue 2 of 2). |
CVE-2019-18448 | Medium | 6.5 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Incorrect Access Control. |
CVE-2019-18447 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Insecure Permissions. |
CVE-2019-18446 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4. It has Insecure Permissions (issue 1 of 2). |
CVE-2019-15845 | Medium | 6.5 | 2019-11-26 | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions. |
CVE-2019-14449 | Medium | 5.4 | 2019-11-26 | An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1. Malicious impala queries can result in Cross Site Sc… |
CVE-2019-12526 | Critical | 9.8 | 2019-11-26 | An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server… |
CVE-2019-12523 | Critical | 9.1 | 2019-11-26 | An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access… |
CVE-2019-7319 | High | 8.3 | 2019-11-26 | An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0. When using one of following authentication backends: LdapBackend, PamBackend, SpnegoDjangoBackend… |
CVE-2019-6477 | High | 7.5 | 2019-11-26 | With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelinin… |
CVE-2019-4387 | High | 8.8 | 2019-11-26 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL stateme… |
CVE-2019-19307 | Critical | 9.8 | 2019-11-26 | An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-… |
CVE-2019-19129 | Medium | 6.1 | 2019-11-26 | Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name. |
CVE-2019-18459 | Medium | 5.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.3 to 12.3 in the protected environments feature. It has Insecure Permissions (issue 3 of… |
CVE-2019-18458 | Low | 2.7 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 2 of 4). |
CVE-2019-18457 | High | 8.8 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.8 through 12.4 when handling Security tokens.. It has Insecure Permissions. |
CVE-2019-16243 | Medium | 6.1 | 2019-11-26 | On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an undocumented web API that allows unprivileged JavaScript, including JavaScript running within the K… |
CVE-2019-16242 | Medium | 6.8 | 2019-11-26 | On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an engineering application named omamock that is vulnerable to OS command injection. An attacker with… |
CVE-2019-16241 | Medium | 6.8 | 2019-11-26 | On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, PIN authentication can be bypassed by creating a special file within the /data/local/tmp/ directory. The System… |
CVE-2019-15688 | Medium | 6.1 | 2019-11-26 | Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Clo… |
CVE-2019-15687 | Medium | 6.5 | 2019-11-26 | Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Clo… |
CVE-2019-15686 | Medium | 4.3 | 2019-11-26 | Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Clo… |
CVE-2019-15685 | Medium | 4.3 | 2019-11-26 | Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Clo… |
CVE-2019-14842 | Critical | 9.8 | 2019-11-26 | Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks. A bounds check which was supposed to test for chunk o… |
CVE-2019-6675 | Critical | 9.8 | 2019-11-26 | BIG-IP configurations using Active Directory, LDAP, or Client Certificate LDAP for management authentication with multiple servers are exposed to a vulnerabili… |
CVE-2019-19306 | Medium | 5.4 | 2019-11-26 | The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName. |
CVE-2019-19275 | High | 7.5 | 2019-11-26 | typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but n… |
CVE-2019-19274 | High | 7.5 | 2019-11-26 | typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (… |
CVE-2019-19206 | Medium | 5.4 | 2019-11-26 | Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture. |
CVE-2019-18463 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 4 of 4). |
CVE-2019-18462 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4. It has Insecure Permissions. |
CVE-2019-18461 | Medium | 4.3 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.3 when a sub group epic is added to a public group. It has Incorrect Access… |
CVE-2019-18460 | High | 7.5 | 2019-11-26 | An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration… |