2019 CVEs (page 49)
Page 49 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-12489 | Critical | 9.8 | 2019-11-26 | An issue was discovered on Fastweb Askey RTV1907VW 0.00.81_FW_200_Askey 2018-10-02 18:08:18 devices. By using the usb_remove service through an HTTP request, i… |
CVE-2019-14856 | Medium | 6.5 | 2019-11-26 | ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None |
CVE-2019-14853 | High | 7.5 | 2019-11-26 | An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (… |
CVE-2019-14857 | Medium | 6.1 | 2019-11-26 | A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_m… |
CVE-2019-14890 | High | 8.4 | 2019-11-26 | A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RH… |
CVE-2019-19272 | High | 7.5 | 2019-11-26 | An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. Direct dereference of a NULL pointer (a variable initialized to NULL) leads to a crash when… |
CVE-2019-19271 | High | 7.5 | 2019-11-26 | An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL entries (ins… |
CVE-2019-19270 | High | 7.5 | 2019-11-26 | An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry (checking twice for subject, rat… |
CVE-2019-16002 | Medium | 6.5 | 2019-11-26 | A vulnerability in the vManage web-based UI (web UI) of the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to conduct a cross-site reque… |
CVE-2019-16001 | Medium | 5.3 | 2019-11-26 | A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Webex Teams for Windows could allow an authenticated, local attacker to pe… |
CVE-2019-15998 | Medium | 5.3 | 2019-11-26 | A vulnerability in the access-control logic of the NETCONF over Secure Shell (SSH) of Cisco IOS XR Software may allow connections despite an access control lis… |
CVE-2019-15997 | Medium | 6.7 | 2019-11-26 | A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to perform a command injection attack and execute arbitrary command… |
CVE-2019-15996 | Medium | 6.7 | 2019-11-26 | A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underly… |
CVE-2019-15995 | Medium | 6.5 | 2019-11-26 | A vulnerability in the web UI of Cisco DNA Spaces: Connector could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability… |
CVE-2019-15994 | Medium | 6.1 | 2019-11-26 | A vulnerability in the web-based management interface of Cisco Stealthwatch Enterprise could allow an unauthenticated, remote attacker to conduct a cross-site… |
CVE-2019-15990 | Medium | 5.3 | 2019-11-26 | A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an unauthenticated, remote attacker to view… |
CVE-2019-15988 | Medium | 5.3 | 2019-11-26 | A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote… |
CVE-2019-15987 | Medium | 5.3 | 2019-11-26 | A vulnerability in web interface of the Cisco Webex Event Center, Cisco Webex Meeting Center, Cisco Webex Support Center, and Cisco Webex Training Center could… |
CVE-2019-15986 | Medium | 6.7 | 2019-11-26 | A vulnerability in the CLI of Cisco Unity Express could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privile… |
CVE-2019-15972 | High | 8.8 | 2019-11-26 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct SQL inje… |
CVE-2019-15971 | Medium | 4.3 | 2019-11-26 | A vulnerability in the MP3 detection engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker… |
CVE-2019-15968 | Medium | 5.4 | 2019-11-26 | A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager (Unified CDM) could allow an authenticated, remote attacke… |
CVE-2019-15973 | Medium | 6.1 | 2019-11-26 | A vulnerability in the web-based management interface of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to conduct a c… |
CVE-2019-15967 | Medium | 4.4 | 2019-11-26 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an authenticated, local attacker to enable a… |
CVE-2019-15960 | Medium | 5.4 | 2019-11-26 | A vulnerability in the Webex Network Recording Admin page of Cisco Webex Meetings could allow an authenticated, remote attacker to elevate privileges in the co… |
CVE-2019-15958 | Critical | 9.8 | 2019-11-26 | A vulnerability in the REST API of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM) could allow an unauthenticated remote… |
CVE-2019-15956 | High | 8.8 | 2019-11-26 | A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker… |
CVE-2019-15288 | High | 8.8 | 2019-11-26 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE), Cisco TelePresence Codec (TC), and Cisco RoomOS Software could allow an authentic… |
CVE-2019-15286 | High | 7.8 | 2019-11-26 | Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to… |
CVE-2019-15284 | High | 7.8 | 2019-11-26 | Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to… |
CVE-2019-15276 | Medium | 6.5 | 2019-11-26 | A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial o… |
CVE-2019-15271 | High | 8.8 | 2019-11-26 | A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execut… |
CVE-2019-18251 | High | 8.8 | 2019-11-26 | In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. This version of Teamviewer is vulnerable to… |
CVE-2019-18250 | Critical | 9.8 | 2019-11-26 | In all versions of ABB Power Generation Information Manager (PGIM) and Plant Connect, the affected product is vulnerable to authentication bypass, which may al… |
CVE-2019-18241 | Medium | 6.5 | 2019-11-26 | In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server running on the affected pr… |
CVE-2019-15595 | High | 8.8 | 2019-11-26 | A privilege escalation exists in UniFi Video Controller =<3.10.6 that would allow an attacker on the local machine to run arbitrary commands. |
CVE-2019-11290 | High | 7.5 | 2019-11-26 | Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentica… |
CVE-2019-10771 | Medium | 6.1 | 2019-11-25 | Characters in the GET url path are not properly escaped and can be reflected in the server response. |
CVE-2019-17632 | Medium | 6.1 | 2019-11-25 | In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html an… |
CVE-2019-15629 | High | 7.5 | 2019-11-25 | Trend Micro Password Manager versions 3.x, 5.0, and 5.1 for Android is affected by a FLAG_MISUSE vulnerability that could be exploited to allow the application… |
CVE-2019-5826 | Medium | 6.5 | 2019-11-25 | Use after free in IndexedDB in Google Chrome prior to 73.0.3683.86 allowed a remote attacker who had compromised the renderer process to potentially exploit he… |
CVE-2019-5825 | Medium | 6.5 | 2019-11-25 | Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2019-19244 | High | 7.5 | 2019-11-25 | sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage. |
CVE-2019-19252 | High | 7.8 | 2019-11-25 | vcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does not prevent write access to vcsu devices, aka CID-0c9acb1af77a. |
CVE-2019-16765 | High | 7.4 | 2019-11-25 | If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code… |
CVE-2019-4406 | Medium | 4.4 | 2019-11-25 | IBM Spectrum Protect Backup-Archive Client 7.1 and 8.1 may be vulnerable to a denial of service attack due to a timing issue between client and server TCP/IP c… |
CVE-2019-19250 | Critical | 9.8 | 2019-11-25 | OpenTrade before 2019-11-23 allows SQL injection, related to server/modules/api/v1.js and server/utils.js. |
CVE-2019-19249 | Critical | 9.8 | 2019-11-25 | Controllers/InvitationsController.cs in QueryTree before 3.0.99-beta mishandles invitations. |
CVE-2019-19246 | High | 7.5 | 2019-11-25 | Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c. |
CVE-2019-18374 | Critical | 9.8 | 2019-11-25 | Symantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypass vulnerability, which is a type of is… |
CVE-2019-16764 | Medium | 6.5 | 2019-11-25 | The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks. In `PowAssent.Phoenix.AuthorizationController` a value is fetched from… |
CVE-2019-17406 | Medium | 5.3 | 2019-11-25 | Nokia IMPACT < 18A has path traversal that may lead to RCE if chained with CVE-2019-1743 |
CVE-2019-15684 | Medium | 4.3 | 2019-11-25 | Kaspersky Protection extension for web browser Google Chrome prior to 30.112.62.0 was vulnerable to unauthorized access to its features remotely that could lea… |
CVE-2019-14825 | Low | 2.7 | 2019-11-25 | A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discov… |
CVE-2019-10224 | Medium | 4.6 | 2019-11-25 | A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive inf… |
CVE-2019-10217 | Medium | 6.5 | 2019-11-25 | A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are… |
CVE-2019-5881 | High | 8.1 | 2019-11-25 | Out of bounds read in SwiftShader in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to obtain potentially sensitive information from process mem… |
CVE-2019-5880 | High | 7.4 | 2019-11-25 | Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2019-5879 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in extensions in Google Chrome prior to 77.0.3865.75 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2019-5878 | High | 8.8 | 2019-11-25 | Use after free in V8 in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-5877 | High | 8.8 | 2019-11-25 | Out of bounds memory access in JavaScript in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2019-5876 | High | 8.8 | 2019-11-25 | Use after free in media in Google Chrome on Android prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2019-5875 | Medium | 4.3 | 2019-11-25 | Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a… |
CVE-2019-5874 | High | 8.8 | 2019-11-25 | Insufficient filtering in URI schemes in Google Chrome on Windows prior to 77.0.3865.75 allowed a remote attacker to bypass navigation restrictions via a craft… |
CVE-2019-5873 | Medium | 4.3 | 2019-11-25 | Insufficient policy validation in navigation in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL… |
CVE-2019-5872 | Medium | 6.5 | 2019-11-25 | Use after free in Mojo in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-5871 | High | 8.8 | 2019-11-25 | Heap buffer overflow in Skia in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-5870 | Critical | 9.6 | 2019-11-25 | Use after free in media in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. |
CVE-2019-5869 | Medium | 6.5 | 2019-11-25 | Use after free in Blink in Google Chrome prior to 76.0.3809.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-5868 | Medium | 5.5 | 2019-11-25 | Use after free in PDFium in Google Chrome prior to 76.0.3809.100 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2019-5867 | Medium | 6.5 | 2019-11-25 | Out of bounds read in JavaScript in Google Chrome prior to 76.0.3809.100 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2019-5866 | Critical | 9.8 | 2019-11-25 | Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2019-5865 | Medium | 6.5 | 2019-11-25 | Insufficient policy enforcement in navigations in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to byp… |
CVE-2019-5864 | Medium | 4.3 | 2019-11-25 | Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious extension to bypass… |
CVE-2019-5862 | Medium | 6.5 | 2019-11-25 | Insufficient data validation in AppCache in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass si… |
CVE-2019-5861 | Medium | 4.3 | 2019-11-25 | Insufficient data validation in Blink in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to bypass anti-clickjacking policy via a crafted HTML pa… |
CVE-2019-5860 | Medium | 5.5 | 2019-11-25 | Use after free in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2019-5859 | High | 8.8 | 2019-11-25 | Insufficient filtering in URI schemes in Google Chrome on Windows prior to 76.0.3809.87 allowed a remote attacker to bypass navigation restrictions via a craft… |
CVE-2019-5858 | High | 8.8 | 2019-11-25 | Incorrect security UI in MacOS services integration in Google Chrome on OS X prior to 76.0.3809.87 allowed a local attacker to execute arbitrary code via a cra… |
CVE-2019-5857 | Medium | 6.5 | 2019-11-25 | Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit object corruption via a craf… |
CVE-2019-5856 | High | 8.8 | 2019-11-25 | Insufficient policy enforcement in storage in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2019-5855 | Medium | 6.5 | 2019-11-25 | Integer overflow in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2019-5854 | High | 8.8 | 2019-11-25 | Integer overflow in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2019-5853 | High | 8.8 | 2019-11-25 | Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2019-5852 | Medium | 6.5 | 2019-11-25 | Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to obtain potentially sensitive information from pr… |
CVE-2019-5851 | High | 8.8 | 2019-11-25 | Use after free in WebAudio in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-5850 | Critical | 9.6 | 2019-11-25 | Use after free in offline mode in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2019-5849 | High | 8.1 | 2019-11-25 | Out of bounds read in Skia in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to obtain potentially sensitive information from process memory via… |
CVE-2019-5848 | Medium | 6.5 | 2019-11-25 | Incorrect font handling in autofill in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to obtain potentially sensitive information from process… |
CVE-2019-5847 | Medium | 6.5 | 2019-11-25 | Inappropriate implementation in JavaScript in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to potentially exploit heap corruption via a craft… |
CVE-2019-5842 | Medium | 6.5 | 2019-11-25 | Use after free in Blink in Google Chrome prior to 75.0.3770.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-17405 | Medium | 6.1 | 2019-11-25 | Nokia IMPACT < 18A: has Reflected self XSS |
CVE-2019-17404 | Medium | 4.3 | 2019-11-25 | Nokia IMPACT < 18A: allows full path disclosure |
CVE-2019-17403 | High | 8.8 | 2019-11-25 | Nokia IMPACT < 18A: An unrestricted File Upload vulnerability was found that may lead to Remote Code Execution. |
CVE-2019-13724 | High | 8.8 | 2019-11-25 | Out of bounds memory access in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to poten… |
CVE-2019-13723 | High | 8.8 | 2019-11-25 | Use after free in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to potentially exploi… |
CVE-2019-13721 | High | 8.8 | 2019-11-25 | Use after free in PDFium in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13720 | High | 8.8 | 2019-11-25 | Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-13719 | Medium | 4.3 | 2019-11-25 | Incorrect security UI in full screen mode in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to hide security UI via a crafted HTML page. |
CVE-2019-13718 | Medium | 4.3 | 2019-11-25 | Insufficient data validation in Omnibox in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to perform domain spoofing via IDN homographs via a cr… |