2019 CVEs (page 52)
Page 52 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10764 | High | 7.4 | 2019-11-18 | In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the… |
CVE-2019-18373 | Medium | 5.6 | 2019-11-18 | Norton App Lock, prior to 1.4.0.503, may be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app… |
CVE-2019-17085 | Medium | 6.5 | 2019-11-18 | XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11. The vulnerability coul… |
CVE-2019-15054 | Medium | 6.1 | 2019-11-18 | Multiple cross-site scripting (XSS) vulnerabilities in Mailbird before 2.7.5.0 r allow remote attackers to execute arbitrary JavaScript in a privileged context… |
CVE-2019-12409 | Critical | 9.8 | 2019-11-18 | The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configura… |
CVE-2019-10070 | Medium | 6.1 | 2019-11-18 | Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality |
CVE-2019-18215 | High | 7.8 | 2019-11-18 | An issue was discovered in signmgr.dll 6.5.0.819 in Comodo Internet Security through 12.0. A DLL Preloading vulnerability allows an attacker to implant an unsi… |
CVE-2019-10763 | Medium | 6.5 | 2019-11-18 | pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead… |
CVE-2019-3424 | High | 8.2 | 2019-11-18 | authentication issues vulnerability, which exists in V2.1.14 and below versions of C520V21 smart camera devices. An attacker can automatically obtain access to… |
CVE-2019-3423 | Medium | 5.3 | 2019-11-18 | permission and access control vulnerability, which exists in V2.1.14 and below versions of C520V21 smart camera devices. An attacker can construct a URL for di… |
CVE-2019-12311 | Medium | 6.1 | 2019-11-18 | Sandline Centraleyezer (On Premises) allows Unrestricted File Upload leading to Stored XSS. An HTML page running a script could be uploaded to the server. When… |
CVE-2019-12299 | Medium | 6.1 | 2019-11-18 | Sandline Centraleyezer (On Premises) allows Stored XSS using HTML entities in the name field of the Category section. |
CVE-2019-12271 | Critical | 9.8 | 2019-11-18 | Sandline Centraleyezer (On Premises) allows unrestricted File Upload with a dangerous type, because the feature of adding ".jpg" to any uploaded filename is no… |
CVE-2019-5688 | Medium | 6.7 | 2019-11-18 | NVIDIA NVFlash, NVUFlash Tool prior to v5.588.0 and GPUModeSwitch Tool prior to 2019-11, NVIDIA kernel mode driver (nvflash.sys, nvflsh32.sys, and nvflsh64.sys… |
CVE-2019-5102 | Medium | 4.0 | 2019-11-18 | An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, t… |
CVE-2019-5101 | Medium | 4.0 | 2019-11-18 | An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, t… |
CVE-2019-19113 | Critical | 9.8 | 2019-11-18 | main/resources/mapper/NewBeeMallGoodsMapper.xml in newbee-mall (aka New Bee) before 2019-10-23 allows search?goodsCategoryId=&keyword= SQL Injection. |
CVE-2019-10172 | High | 7.5 | 2019-11-18 | A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus ja… |
CVE-2019-19085 | Medium | 5.4 | 2019-11-18 | A persistent cross-site scripting (XSS) vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authenticated attackers to inject arbitrary web s… |
CVE-2019-19084 | Medium | 4.3 | 2019-11-18 | In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted package, tri… |
CVE-2019-17058 | Critical | 9.1 | 2019-11-18 | Footy Tipping Software AFL Web Edition 2019 allows arbitrary file upload and resultant remote code execution because a whitelist can be bypassed by an Administ… |
CVE-2019-17057 | Medium | 6.1 | 2019-11-18 | Footy Tipping Software AFL Web Edition 2019 allows XSS. |
CVE-2019-14467 | High | 7.8 | 2019-11-18 | The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album… |
CVE-2019-19083 | Medium | 4.7 | 2019-11-18 | Memory leaks in *clock_source_create() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to cause a denial of ser… |
CVE-2019-19082 | Medium | 4.7 | 2019-11-18 | Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.11 allow attackers to cause a denial of… |
CVE-2019-19081 | Medium | 5.9 | 2019-11-18 | A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attacke… |
CVE-2019-19080 | Medium | 5.9 | 2019-11-18 | Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allow attac… |
CVE-2019-19079 | High | 7.5 | 2019-11-18 | A memory leak in the qrtr_tun_write_iter() function in net/qrtr/tun.c in the Linux kernel before 5.3 allows attackers to cause a denial of service (memory cons… |
CVE-2019-19078 | High | 7.5 | 2019-11-18 | A memory leak in the ath10k_usb_hif_tx_sg() function in drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.3.11 allows attackers to cause a de… |
CVE-2019-19077 | Medium | 5.5 | 2019-11-18 | A memory leak in the bnxt_re_create_srq() function in drivers/infiniband/hw/bnxt_re/ib_verbs.c in the Linux kernel through 5.3.11 allows attackers to cause a d… |
CVE-2019-19076 | Medium | 5.9 | 2019-11-18 | A memory leak in the nfp_abm_u32_knode_replace() function in drivers/net/ethernet/netronome/nfp/abm/cls.c in the Linux kernel before 5.3.6 allows attackers to… |
CVE-2019-19075 | High | 7.5 | 2019-11-18 | A memory leak in the ca8210_probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service… |
CVE-2019-19074 | High | 7.5 | 2019-11-18 | A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of… |
CVE-2019-19073 | Medium | 4.0 | 2019-11-18 | Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) b… |
CVE-2019-19072 | Medium | 4.4 | 2019-11-18 | A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of… |
CVE-2019-19071 | High | 7.5 | 2019-11-18 | A memory leak in the rsi_send_beacon() function in drivers/net/wireless/rsi/rsi_91x_mgmt.c in the Linux kernel through 5.3.11 allows attackers to cause a denia… |
CVE-2019-19070 | High | 7.5 | 2019-11-18 | A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memo… |
CVE-2019-19069 | High | 7.5 | 2019-11-18 | A memory leak in the fastrpc_dma_buf_attach() function in drivers/misc/fastrpc.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service… |
CVE-2019-19068 | Medium | 4.6 | 2019-11-18 | A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the Linux kernel through 5.3.11 allows atta… |
CVE-2019-19067 | Medium | 4.4 | 2019-11-18 | Four memory leaks in the acp_hw_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c in the Linux kernel before 5.3.8 allow attackers to cause a denial o… |
CVE-2019-19066 | Medium | 4.7 | 2019-11-18 | A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of serv… |
CVE-2019-19065 | Medium | 4.7 | 2019-11-18 | A memory leak in the sdma_init() function in drivers/infiniband/hw/hfi1/sdma.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (… |
CVE-2019-19064 | High | 7.5 | 2019-11-18 | A memory leak in the fsl_lpspi_probe() function in drivers/spi/spi-fsl-lpspi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service… |
CVE-2019-19063 | Medium | 4.6 | 2019-11-18 | Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the Linux kernel through 5.3.11 allow attackers to cause a de… |
CVE-2019-19062 | Medium | 4.7 | 2019-11-18 | A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (me… |
CVE-2019-19061 | High | 7.5 | 2019-11-18 | A memory leak in the adis_update_scan_mode_burst() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denia… |
CVE-2019-19060 | High | 7.5 | 2019-11-18 | A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of s… |
CVE-2019-19059 | Medium | 4.7 | 2019-11-18 | Multiple memory leaks in the iwl_pcie_ctxt_info_gen3_init() function in drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c in the Linux kernel through 5… |
CVE-2019-19058 | Medium | 4.7 | 2019-11-18 | A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c in the Linux kernel through 5.3.11 allows attackers to cause a den… |
CVE-2019-19057 | Low | 3.3 | 2019-11-18 | Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allow attackers… |
CVE-2019-19056 | Medium | 4.7 | 2019-11-18 | A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allows attacker… |
CVE-2019-19055 | Medium | 5.5 | 2019-11-18 | A memory leak in the nl80211_get_ftm_responder_stats() function in net/wireless/nl80211.c in the Linux kernel through 5.3.11 allows attackers to cause a denial… |
CVE-2019-19054 | Medium | 4.7 | 2019-11-18 | A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through 5.3.11 allows attackers to cause a denia… |
CVE-2019-19053 | High | 7.5 | 2019-11-18 | A memory leak in the rpmsg_eptdev_write_iter() function in drivers/rpmsg/rpmsg_char.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of… |
CVE-2019-19052 | High | 7.5 | 2019-11-18 | A memory leak in the gs_can_open() function in drivers/net/can/usb/gs_usb.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (me… |
CVE-2019-19051 | Medium | 5.5 | 2019-11-18 | A memory leak in the i2400m_op_rfkill_sw_toggle() function in drivers/net/wimax/i2400m/op-rfkill.c in the Linux kernel before 5.3.11 allows attackers to cause… |
CVE-2019-19050 | High | 7.5 | 2019-11-18 | A memory leak in the crypto_reportstat() function in crypto/crypto_user_stat.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service… |
CVE-2019-19049 | High | 7.5 | 2019-11-18 | A memory leak in the unittest_data_add() function in drivers/of/unittest.c in the Linux kernel before 5.3.10 allows attackers to cause a denial of service (mem… |
CVE-2019-19048 | High | 7.5 | 2019-11-18 | A memory leak in the crypto_reportstat() function in drivers/virt/vboxguest/vboxguest_utils.c in the Linux kernel before 5.3.9 allows attackers to cause a deni… |
CVE-2019-19047 | Medium | 5.5 | 2019-11-18 | A memory leak in the mlx5_fw_fatal_reporter_dump() function in drivers/net/ethernet/mellanox/mlx5/core/health.c in the Linux kernel before 5.3.11 allows attack… |
CVE-2019-19046 | Medium | 6.5 | 2019-11-18 | A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c in the Linux kernel through 5.3.11 allows attackers to cause a denia… |
CVE-2019-19045 | Medium | 4.4 | 2019-11-18 | A memory leak in the mlx5_fpga_conn_create_cq() function in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c in the Linux kernel before 5.3.11 allows attack… |
CVE-2019-19044 | High | 7.5 | 2019-11-18 | Two memory leaks in the v3d_submit_cl_ioctl() function in drivers/gpu/drm/v3d/v3d_gem.c in the Linux kernel before 5.3.11 allow attackers to cause a denial of… |
CVE-2019-19043 | Medium | 5.5 | 2019-11-18 | A memory leak in the i40e_setup_macvlans() function in drivers/net/ethernet/intel/i40e/i40e_main.c in the Linux kernel through 5.3.11 allows attackers to cause… |
CVE-2019-19041 | High | 7.2 | 2019-11-17 | An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity of an upgrade packag… |
CVE-2019-19040 | Medium | 6.1 | 2019-11-17 | KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{"value":"<script>'… |
CVE-2019-19035 | Medium | 5.5 | 2019-11-17 | jhead 3.03 is affected by: heap-based buffer over-read. The impact is: Denial of service. The component is: ReadJpegSections and process_SOFn in jpgfile.c. The… |
CVE-2019-19022 | High | 7.5 | 2019-11-17 | iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote a… |
CVE-2019-19012 | Critical | 9.8 | 2019-11-17 | An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this… |
CVE-2019-19011 | High | 7.5 | 2019-11-17 | MiniUPnP ngiflib 0.4 has a NULL pointer dereference in GifIndexToTrueColor in ngiflib.c via a file that lacks a palette. |
CVE-2019-19010 | Critical | 9.8 | 2019-11-16 | Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information… |
CVE-2019-16762 | Medium | 5.7 | 2019-11-15 | A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An att… |
CVE-2019-16761 | Medium | 5.7 | 2019-11-15 | A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slp-validate@1.0.0 npm pa… |
CVE-2019-6664 | High | 7.5 | 2019-11-15 | On BIG-IP 15.0.0 and 14.1.0-14.1.0.6, under certain conditions, network protections on the management port do not follow current best practices. |
CVE-2019-6663 | Medium | 5.5 | 2019-11-15 | The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, iWorkflow 2.3.0, an… |
CVE-2019-6662 | Medium | 6.5 | 2019-11-15 | On BIG-IP 13.1.0-13.1.1.4, sensitive information is logged into the local log files and/or remote logging targets when restjavad processes an invalid request… |
CVE-2019-6661 | High | 7.5 | 2019-11-15 | When the BIG-IP APM 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.4.1, or 11.5.1-11.6.5 system processes certain requests, the APD/APMD daemon may… |
CVE-2019-6660 | High | 7.5 | 2019-11-15 | On BIG-IP 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1, undisclosed HTTP requests may consume excessive amounts of systems resources which may lead to a den… |
CVE-2019-6659 | High | 7.5 | 2019-11-15 | On version 14.0.0-14.1.0.1, BIG-IP virtual servers with TLSv1.3 enabled may experience a denial of service due to undisclosed incoming messages. |
CVE-2019-13582 | Critical | 9.8 | 2019-11-15 | An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parro… |
CVE-2019-13581 | Critical | 9.8 | 2019-11-15 | An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parro… |
CVE-2019-18372 | High | 7.8 | 2019-11-15 | Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may a… |
CVE-2019-12759 | High | 7.8 | 2019-11-15 | Symantec Endpoint Protection Manager (SEPM) and Symantec Mail Security for MS Exchange (SMSMSE), prior to versions 14.2 RU2 and 7.5.x respectively, may be susc… |
CVE-2019-12758 | Medium | 6.7 | 2019-11-15 | Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to an unsigned code execution vulnerability, which may allow an individual to execute code… |
CVE-2019-12757 | High | 7.8 | 2019-11-15 | Symantec Endpoint Protection (SEP), prior to 14.2 RU2 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition (SEP SBE) prior to 12.1 RU6 MP10d… |
CVE-2019-12756 | Low | 2.3 | 2019-11-15 | Symantec Endpoint Protection (SEP), prior to 14.2 RU2 may be susceptible to a password protection bypass vulnerability whereby the secondary layer of password… |
CVE-2019-14345 | Critical | 9.8 | 2019-11-15 | TemaTres 3.0 allows remote unprivileged users to create an administrator account |
CVE-2019-14343 | Medium | 5.4 | 2019-11-15 | TemaTres 3.0 has stored XSS via the value parameter to the vocab/admin.php?vocabulario_id=list URI. |
CVE-2019-14869 | High | 8.8 | 2019-11-15 | A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabli… |
CVE-2019-18987 | Medium | 5.3 | 2019-11-15 | An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Once a specific abuse filter has (accidentally or otherwise) been made public… |
CVE-2019-18986 | High | 7.5 | 2019-11-15 | Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for in… |
CVE-2019-18985 | Critical | 9.8 | 2019-11-15 | Pimcore before 6.2.2 lacks brute force protection for the 2FA token. |
CVE-2019-18982 | Medium | 6.1 | 2019-11-15 | bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of… |
CVE-2019-18981 | Critical | 9.8 | 2019-11-15 | Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification. |
CVE-2019-18928 | Critical | 9.8 | 2019-11-15 | Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an… |
CVE-2019-11931 | High | 7.8 | 2019-11-14 | A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the e… |
CVE-2019-18980 | High | 7.5 | 2019-11-14 | On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone ca… |
CVE-2019-18978 | Medium | 5.3 | 2019-11-14 | An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources be… |
CVE-2019-18651 | Medium | 6.5 | 2019-11-14 | A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauth… |
CVE-2019-17391 | Medium | 4.6 | 2019-11-14 | An issue was discovered in the Espressif ESP32 mask ROM code 2016-06-08 0 through 2. Lack of anti-glitch mitigations in the first stage bootloader of the ESP32… |