2019 CVEs (page 57)
Page 57 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-0712 | Medium | 6.8 | 2019-11-12 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2019-17360 | High | 7.5 | 2019-11-12 | A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.7.0-00 allows an unauthenticated remote user to trigger a denial of service (DoS) condition becau… |
CVE-2019-15815 | Medium | 6.5 | 2019-11-12 | ZyXEL P-1302-T10D v3 devices with firmware version 2.00(ABBX.3) and earlier do not properly enforce access control and could allow an unauthorized user to acce… |
CVE-2019-18926 | Medium | 6.1 | 2019-11-12 | Systematic IRIS Standards Management (ISM) v2.1 SP1 89 is vulnerable to unauthenticated reflected Cross Site Scripting (XSS). A user input (related to dialog i… |
CVE-2019-18925 | Critical | 9.8 | 2019-11-12 | Systematic IRIS WebForms 5.4 and its functionalities can be accessed and used without any form of authentication. |
CVE-2019-18924 | Medium | 5.3 | 2019-11-12 | Systematic IRIS WebForms 5.4 is vulnerable to directory traversal. By manipulating variables that reference files with ../ (and variations), it is possible to… |
CVE-2019-18655 | Critical | 9.8 | 2019-11-12 | File Sharing Wizard version 1.5.0 build 2008 is affected by a Structured Exception Handler based buffer overflow vulnerability. An unauthenticated attacker is… |
CVE-2019-17237 | High | 8.8 | 2019-11-12 | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF. |
CVE-2019-17236 | Medium | 6.1 | 2019-11-12 | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS. |
CVE-2019-17235 | Medium | 5.3 | 2019-11-12 | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure. |
CVE-2019-17234 | High | 7.5 | 2019-11-12 | includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion. |
CVE-2019-4652 | High | 7.1 | 2019-11-12 | IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allow a local user to o… |
CVE-2019-18848 | High | 7.5 | 2019-11-12 | The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string. |
CVE-2019-18817 | High | 7.5 | 2019-11-12 | Istio 1.3.x before 1.3.5 allows Denial of Service because continue_on_listener_filters_timeout is set to True, a related issue to CVE-2019-18836. |
CVE-2019-18658 | Critical | 9.8 | 2019-11-12 | In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart… |
CVE-2019-18882 | Medium | 6.1 | 2019-11-12 | WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled. |
CVE-2019-18881 | Medium | 6.1 | 2019-11-12 | WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile. |
CVE-2019-18874 | High | 7.5 | 2019-11-12 | psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system da… |
CVE-2019-18873 | Critical | 9.0 | 2019-11-12 | FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to full… |
CVE-2019-18862 | High | 7.8 | 2019-11-11 | maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode. |
CVE-2019-18857 | High | 7.5 | 2019-11-11 | darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript	… |
CVE-2019-18856 | High | 7.5 | 2019-11-11 | A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to external resources with an SVG use ele… |
CVE-2019-18855 | High | 7.5 | 2019-11-11 | A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attribu… |
CVE-2019-18854 | High | 7.5 | 2019-11-11 | A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ... xlin… |
CVE-2019-18853 | Medium | 6.5 | 2019-11-11 | ImageMagick before 7.0.9-0 allows remote attackers to cause a denial of service because XML_PARSE_HUGE is not properly restricted in coders/svg.c, related to S… |
CVE-2019-18852 | Critical | 9.8 | 2019-11-11 | Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/image_sign or /etc/alpha_config/image_sign. This a… |
CVE-2019-18849 | Medium | 5.5 | 2019-11-11 | In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winmail.dat application/… |
CVE-2019-18841 | High | 7.3 | 2019-11-11 | Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution. |
CVE-2019-18836 | High | 7.5 | 2019-11-11 | Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in… |
CVE-2019-18845 | High | 7.1 | 2019-11-09 | The MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB before 1.1 allow local users (including low integrity processes) to read and write to arbitrary memo… |
CVE-2019-18840 | High | 7.5 | 2019-11-09 | In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there is… |
CVE-2019-5701 | High | 7.8 | 2019-11-09 | NVIDIA GeForce Experience, all versions prior to 3.20.0.118, contains a vulnerability when GameStream is enabled in which an attacker with local system access… |
CVE-2019-5698 | Medium | 4.4 | 2019-11-09 | NVIDIA Virtual GPU Manager, all versions, contains a vulnerability in the vGPU plugin, in which an input index value is incorrectly validated, which may lead t… |
CVE-2019-5697 | High | 7.1 | 2019-11-09 | NVIDIA Virtual GPU Manager, all versions, contains a vulnerability in which it may grant a guest access to memory that it does not own, which may lead to infor… |
CVE-2019-5696 | Medium | 5.5 | 2019-11-09 | NVIDIA Virtual GPU Manager, all versions, contains a vulnerability in which the provision of an incorrectly sized buffer by a guest VM leads to GPU out-of-boun… |
CVE-2019-5694 | Medium | 6.5 | 2019-11-09 | NVIDIA Windows GPU Display Driver, R390 driver version, contains a vulnerability in NVIDIA Control Panel in which it incorrectly loads Windows system DLLs with… |
CVE-2019-5693 | Medium | 5.5 | 2019-11-09 | NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) in which the program accesses or uses a point… |
CVE-2019-5692 | High | 7.8 | 2019-11-09 | NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the produc… |
CVE-2019-5691 | High | 7.8 | 2019-11-09 | NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which a NULL poi… |
CVE-2019-5690 | High | 7.8 | 2019-11-09 | NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the size o… |
CVE-2019-5689 | High | 7.8 | 2019-11-09 | NVIDIA GeForce Experience, all versions prior to 3.20.1, contains a vulnerability in the Downloader component in which a user with local system access can craf… |
CVE-2019-4645 | Medium | 6.1 | 2019-11-09 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2019-4581 | Medium | 6.1 | 2019-11-09 | IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2019-4556 | Medium | 6.5 | 2019-11-09 | IBM QRadar Advisor 1.0.0 through 2.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in dir… |
CVE-2019-4509 | Medium | 4.3 | 2019-11-09 | IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to incorrect authorization in some components which could allow an authenticated user to obtain sensitive infor… |
CVE-2019-4470 | Medium | 5.4 | 2019-11-09 | IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2019-4454 | Medium | 5.4 | 2019-11-09 | IBM QRadar 7.3.0 to 7.3.2 Patch 4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2019-4450 | Medium | 6.1 | 2019-11-09 | IBM i 7.2, 7.3, and 7.4 for i is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2019-4412 | Medium | 5.3 | 2019-11-09 | IBM Cognos Controller stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs v… |
CVE-2019-4411 | Medium | 4.3 | 2019-11-09 | IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive information due to easy to guess session identif… |
CVE-2019-4334 | Medium | 4.3 | 2019-11-09 | IBM Cognos Analytics 11.0 and 11.1 could reveal sensitive information to an authenticated user that could be used in future attacks against the system. IBM X-F… |
CVE-2019-13543 | Medium | 5.8 | 2019-11-08 | Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energ… |
CVE-2019-13539 | High | 7.0 | 2019-11-08 | Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energ… |
CVE-2019-13535 | Medium | 4.6 | 2019-11-08 | In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not… |
CVE-2019-13531 | Medium | 4.8 | 2019-11-08 | In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleylab LS10 Energy Platform (VLLS10GEN—not… |
CVE-2019-3426 | High | 8.8 | 2019-11-08 | The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by the input validation vulnerability. An attacker could exploit t… |
CVE-2019-3425 | High | 8.8 | 2019-11-08 | The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by vulnerability of permission and access control. An attacker cou… |
CVE-2019-12410 | High | 7.5 | 2019-11-08 | While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data… |
CVE-2019-12408 | High | 7.5 | 2019-11-08 | It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized mem… |
CVE-2019-18623 | Critical | 9.8 | 2019-11-08 | Escalation of privileges in EnergyCAP 7 through 7.5.6 allows an attacker to access data. If an unauthenticated user clicks on a link on the public dashboard, t… |
CVE-2019-17661 | High | 8.8 | 2019-11-08 | A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers… |
CVE-2019-17327 | High | 7.2 | 2019-11-08 | JEUS 7 Fix#0~5 and JEUS 8Fix#0~1 versions contains a directory traversal vulnerability caused by improper input parameter check when uploading installation fil… |
CVE-2019-16210 | Medium | 5.5 | 2019-11-08 | Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save. |
CVE-2019-16209 | High | 7.4 | 2019-11-08 | A vulnerability, in The ReportsTrustManager class of Brocade SANnav versions before v2.0, could allow an attacker to perform a man-in-the-middle attack against… |
CVE-2019-16208 | High | 7.5 | 2019-11-08 | Password-based encryption (PBE) algorithm, of Brocade SANnav versions before v2.0, has a weakness in generating cryptographic keys that may allow an attacker t… |
CVE-2019-16207 | High | 7.8 | 2019-11-08 | Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end database and gain privilege… |
CVE-2019-16206 | Medium | 5.5 | 2019-11-08 | The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’ and the 'debug' logging level; which co… |
CVE-2019-16205 | High | 8.8 | 2019-11-08 | A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID. The vulnerability is due to an insuffi… |
CVE-2019-13557 | Medium | 5.3 | 2019-11-08 | In Tasy EMR, Tasy WebPortal Versions 3.02.1757 and prior, there is an information exposure vulnerability which may allow a remote attacker to access system and… |
CVE-2019-3866 | Medium | 5.5 | 2019-11-08 | An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable… |
CVE-2019-14860 | Medium | 6.5 | 2019-11-08 | It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack of protection to c… |
CVE-2019-14824 | Medium | 6.5 | 2019-11-08 | A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this coul… |
CVE-2019-10222 | High | 7.5 | 2019-11-08 | A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW serve… |
CVE-2019-10219 | Medium | 6.1 | 2019-11-08 | A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious cod… |
CVE-2019-15005 | Medium | 4.3 | 2019-11-08 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results… |
CVE-2019-18835 | Critical | 9.8 | 2019-11-08 | Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly s… |
CVE-2019-18818 | Critical | 9.8 | 2019-11-07 | strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controll… |
CVE-2019-18821 | Medium | 5.5 | 2019-11-07 | Eximious Logo Designer 3.82 has a User Mode Write AV starting at ExiCustomPathLib!ExiCustomPathLib::CGradientColorsProfile::BuildGradientColorsTable+0x00000000… |
CVE-2019-18820 | Medium | 5.5 | 2019-11-07 | Eximious Logo Designer 3.82 has Heap Corruption starting at ntdll!RtlpNtMakeTemporaryKey+0x0000000000001a78. |
CVE-2019-18819 | Medium | 5.5 | 2019-11-07 | Eximious Logo Designer 3.82 has a User Mode Write AV starting at ExiVectorRender!StrokeText_Blend+0x00000000000003a7. |
CVE-2019-3465 | High | 8.8 | 2019-11-07 | Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML… |
CVE-2019-3422 | Medium | 6.2 | 2019-11-07 | The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. Through the analysis of related p… |
CVE-2019-11996 | Critical | 9.8 | 2019-11-07 | Potential security vulnerabilities have been identified with HPE Nimble Storage systems in multi array group configurations. The vulnerabilities could be explo… |
CVE-2019-3764 | Medium | 4.3 | 2019-11-07 | Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an improper authorization vul… |
CVE-2019-18816 | Medium | 6.1 | 2019-11-07 | po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post[1][content]= stored XSS. |
CVE-2019-18815 | Medium | 6.1 | 2019-11-07 | PopojiCMS 2.0.1 allows refer= Open Redirection. |
CVE-2019-18814 | Critical | 9.8 | 2019-11-07 | An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_audit_rule_init() in security/apparmor/a… |
CVE-2019-18813 | High | 7.5 | 2019-11-07 | A memory leak in the dwc3_pci_probe() function in drivers/usb/dwc3/dwc3-pci.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (… |
CVE-2019-18812 | High | 7.5 | 2019-11-07 | A memory leak in the sof_dfsentry_write() function in sound/soc/sof/debug.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (me… |
CVE-2019-18811 | Medium | 5.5 | 2019-11-07 | A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of serv… |
CVE-2019-18810 | High | 7.5 | 2019-11-07 | A memory leak in the komeda_wb_connector_add() function in drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c in the Linux kernel before 5.3.8 allows att… |
CVE-2019-18809 | Medium | 4.6 | 2019-11-07 | A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attackers to cause a denia… |
CVE-2019-18808 | Medium | 5.5 | 2019-11-07 | A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service… |
CVE-2019-18807 | High | 7.5 | 2019-11-07 | Two memory leaks in the sja1105_static_config_upload() function in drivers/net/dsa/sja1105/sja1105_spi.c in the Linux kernel before 5.3.5 allow attackers to ca… |
CVE-2019-18806 | Medium | 5.5 | 2019-11-07 | A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c in the Linux kernel before 5.3.5 allows local users to cause a… |
CVE-2019-17605 | High | 8.8 | 2019-11-07 | A mass assignment vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to take over another candidate's account (by also exploiting CVE-201… |
CVE-2019-17604 | Medium | 4.3 | 2019-11-07 | An Insecure Direct Object Reference (IDOR) vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to change other candidates' personal inform… |
CVE-2019-17222 | Medium | 6.1 | 2019-11-07 | An issue was discovered on Intelbras WRN 150 1.0.17 devices. There is stored XSS in the Service Name tab of the WAN configuration screen, leading to a denial o… |
CVE-2019-16878 | Medium | 5.4 | 2019-11-07 | Portainer before 1.22.1 has XSS (issue 2 of 2). |
CVE-2019-16877 | High | 8.8 | 2019-11-07 | Portainer before 1.22.1 has Incorrect Access Control (issue 4 of 4). |