2019 CVEs (page 58)
Page 58 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-16876 | High | 7.5 | 2019-11-07 | Portainer before 1.22.1 allows Directory Traversal. |
CVE-2019-16872 | Critical | 9.9 | 2019-11-07 | Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4). |
CVE-2019-6337 | Medium | 5.2 | 2019-11-07 | For the printers listed a maliciously crafted print file might cause certain HP Inkjet printers to assert. Under certain circumstances, the printer produces a… |
CVE-2019-16874 | Medium | 6.5 | 2019-11-07 | Portainer before 1.22.1 has Incorrect Access Control (issue 2 of 4). |
CVE-2019-16873 | Medium | 5.4 | 2019-11-07 | Portainer before 1.22.1 has XSS (issue 1 of 2). |
CVE-2019-12331 | High | 8.8 | 2019-11-07 | PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared i… |
CVE-2019-18805 | Critical | 9.8 | 2019-11-07 | An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_upd… |
CVE-2019-18804 | High | 7.5 | 2019-11-07 | DjVuLibre 3.5.27 has a NULL pointer dereference in the function DJVU::filter_fv at IW44EncodeCodec.cpp. |
CVE-2019-15004 | High | 7.5 | 2019-11-07 | The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 befor… |
CVE-2019-15003 | Medium | 5.3 | 2019-11-07 | The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 befor… |
CVE-2019-16401 | Medium | 6.5 | 2019-11-06 | Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung… |
CVE-2019-16400 | Medium | 6.5 | 2019-11-06 | Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung… |
CVE-2019-18411 | High | 8.8 | 2019-11-06 | Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be f… |
CVE-2019-12419 | Critical | 9.8 | 2019-11-06 | Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability i… |
CVE-2019-12406 | Medium | 6.5 | 2019-11-06 | Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial… |
CVE-2019-5125 | High | 7.8 | 2019-11-06 | An exploitable heap overflow vulnerability exists in the JPEG2000 parsing functionality of LEADTOOLS 20. A specially crafted J2K image file can cause an out of… |
CVE-2019-5100 | High | 7.8 | 2019-11-06 | An exploitable integer overflow vulnerability exists in the BMP header parsing functionality of LEADTOOLS 20. A specially crafted BMP image file can cause an i… |
CVE-2019-5099 | High | 7.8 | 2019-11-06 | An exploitable integer underflow vulnerability exists in the CMP-parsing functionality of LEADTOOLS 20. A specially crafted CMP image file can cause an integer… |
CVE-2019-5084 | High | 7.8 | 2019-11-06 | An exploitable heap out-of-bounds write vulnerability exists in the TIF-parsing functionality of LEADTOOLS 20. A specially crafted TIF image can cause an offse… |
CVE-2019-5644 | Critical | 10.0 | 2019-11-06 | Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access… |
CVE-2019-5643 | Medium | 5.3 | 2019-11-06 | Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access… |
CVE-2019-5642 | Low | 3.3 | 2019-11-06 | Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system duri… |
CVE-2019-5617 | Critical | 10.0 | 2019-11-06 | Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.4 and earlier suffers from an instance of CWE-284, "Improper Access… |
CVE-2019-6122 | Low | 3.1 | 2019-11-06 | A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error message occurs whenever… |
CVE-2019-6121 | Low | 3.7 | 2019-11-06 | An issue was discovered in NiceHash Miner before 2.0.3.0. Missing Authorization allows an adversary to can gain access to a miner's information about such as h… |
CVE-2019-6120 | High | 7.5 | 2019-11-06 | An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address allows remote attackers to submit a larg… |
CVE-2019-2332 | Critical | 9.8 | 2019-11-06 | Memory corruption while accessing the memory as payload size is not validated before access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Sn… |
CVE-2019-2331 | Critical | 9.8 | 2019-11-06 | Possible Integer overflow because of subtracting two integers without checking if the result would overflow or not in Snapdragon Auto, Snapdragon Compute, Snap… |
CVE-2019-2325 | Critical | 9.8 | 2019-11-06 | Out of boundary access due to token received from ADSP and is used without validation as an index into the array in Snapdragon Auto, Snapdragon Compute, Snapdr… |
CVE-2019-2324 | Critical | 9.8 | 2019-11-06 | When ADSP is compromised, the audio port index that`s returned from ADSP might be out of the valid range and leads to out of boundary access in Snapdragon Auto… |
CVE-2019-2323 | Critical | 9.8 | 2019-11-06 | Lack of check to ensure crypto engine data passed by user is initialized can result in bus error in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IO… |
CVE-2019-2302 | Critical | 9.8 | 2019-11-06 | While processing vendor command which contains corrupted channel count, an integer overflow occurs and finally will lead to heap overflow. in Snapdragon Auto… |
CVE-2019-2285 | Critical | 9.8 | 2019-11-06 | Out of bound write issue is observed while giving information about properties that have been set so far for playing video in Snapdragon Auto, Snapdragon Compu… |
CVE-2019-2283 | Critical | 9.8 | 2019-11-06 | Improper validation of read and write index of tx and rx fifo`s before calculating pointer can lead to out-of-bound access in Snapdragon Auto, Snapdragon Compu… |
CVE-2019-2275 | Medium | 5.5 | 2019-11-06 | While deserializing any key blob during key operations, buffer overflow could occur exposing partial key information if any key operations are invoked(Depends… |
CVE-2019-2258 | Critical | 9.8 | 2019-11-06 | Improper validation of array index causes OOB write and then leads to memory corruption in MMCP in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… |
CVE-2019-2249 | Critical | 9.8 | 2019-11-06 | Kernel can do a memory read from arbitrary address passed by user during execution of a syscall in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… |
CVE-2019-2246 | High | 7.8 | 2019-11-06 | Thread start can cause invalid memory writes to arbitrary memory location since the argument is passed by user to kernel in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-10565 | Critical | 9.8 | 2019-11-06 | Double free issue can happen when sensor power settings is freed by some thread while another thread try to access. in Snapdragon Auto, Snapdragon Compute, Sna… |
CVE-2019-10542 | Critical | 9.8 | 2019-11-06 | Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t match the contents in Snapdragon Auto, Snap… |
CVE-2019-10541 | Critical | 9.8 | 2019-11-06 | Dereference on uninitialized buffer can happen when parsing FLV clip with corrupted codec specific data in Snapdragon Auto, Snapdragon Compute, Snapdragon Cons… |
CVE-2019-10534 | Critical | 9.8 | 2019-11-06 | Null-pointer dereference can occur while accessing the super index entry when it is not been allocated in Snapdragon Auto, Snapdragon Compute, Snapdragon Consu… |
CVE-2019-10533 | Critical | 9.8 | 2019-11-06 | Out of bound access due to improper validation of array index cause the index table entry to get corrupt in Snapdragon Auto, Snapdragon Compute, Snapdragon Con… |
CVE-2019-10531 | Critical | 9.8 | 2019-11-06 | Incorrect reading of system image resulting in buffer overflow when size of system image is increased in Snapdragon Auto, Snapdragon Mobile, Snapdragon Wearabl… |
CVE-2019-10529 | High | 8.1 | 2019-11-06 | Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function set_page_dirty() in Snapdragon Auto, Snapd… |
CVE-2019-10528 | Critical | 9.8 | 2019-11-06 | Use after free issue in kernel while accessing freed mdlog session info and its attributes after closing the session in Snapdragon Auto, Snapdragon Connectivit… |
CVE-2019-10524 | High | 7.8 | 2019-11-06 | Lack of check for a negative value returned for get_clk is wrongly interpreted as valid pointer and lead to use after free in clk driver in Snapdragon Auto, Sn… |
CVE-2019-10522 | Critical | 9.8 | 2019-11-06 | While playing the clip which is nonstandard buffer overflow can occur while parsing in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon… |
CVE-2019-10515 | Medium | 5.5 | 2019-11-06 | DCI client which might be preemptively freed up might be accessed for transferring packets leading to kernel error in Snapdragon Auto, Snapdragon Consumer IOT… |
CVE-2019-10512 | High | 7.8 | 2019-11-06 | Payload size is not checked before using it as array index in audio in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT… |
CVE-2019-10505 | Critical | 9.8 | 2019-11-06 | Out of bound access while processing a non-standard IE measurement request with length crossing past the size of frame in Snapdragon Auto, Snapdragon Consumer… |
CVE-2019-10504 | Medium | 6.5 | 2019-11-06 | Firmware not able to send EXT scan response to host within 1 sec due to resource consumption issue in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Indu… |
CVE-2019-10502 | High | 7.8 | 2019-11-06 | Possible stack overflow when an index equal to io buffer size is accessed in camera module in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industria… |
CVE-2019-10496 | High | 7.8 | 2019-11-06 | Lack of checking a variable received from driver and populating in Firmware data structure leads to buffer overflow in Snapdragon Auto, Snapdragon Compute, Sna… |
CVE-2019-10495 | High | 7.3 | 2019-11-06 | Arbitrary buffer write issue while processing sequence header during HEVC or AVC encoding. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sna… |
CVE-2019-10491 | High | 7.8 | 2019-11-06 | ADSP can be compromised since it`s a general-purpose CPU processing untrusted data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon… |
CVE-2019-10488 | High | 7.5 | 2019-11-06 | Null pointer dereference can occur while parsing invalid chunks while playing the nonstandard clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer… |
CVE-2019-18800 | High | 8.8 | 2019-11-06 | Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffi… |
CVE-2019-18799 | Medium | 6.5 | 2019-11-06 | LibSass before 3.6.3 allows a NULL pointer dereference in Sass::Parser::parseCompoundSelector in parser_selectors.cpp. |
CVE-2019-18798 | Medium | 6.5 | 2019-11-06 | LibSass before 3.6.3 allows a heap-based buffer over-read in Sass::weaveParents in ast_sel_weave.cpp. |
CVE-2019-18797 | Medium | 6.5 | 2019-11-06 | LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operator()(Sass::Binary_Expression*) in eval.cpp. |
CVE-2019-13081 | Medium | 5.4 | 2019-11-06 | Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the title field in the /common/ticket_associated_tickets.php servic… |
CVE-2019-13080 | Medium | 5.4 | 2019-11-06 | Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via an SVG image and HTML file) that allows an authenticated user to ex… |
CVE-2019-13079 | High | 8.8 | 2019-11-06 | Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary comman… |
CVE-2019-13078 | High | 8.8 | 2019-11-06 | Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary comman… |
CVE-2019-13077 | Medium | 6.1 | 2019-11-06 | Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the sam_detail_titled.php SAM_TYPE parameter) that allows an attack… |
CVE-2019-13076 | High | 8.8 | 2019-11-06 | Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary comman… |
CVE-2019-12918 | Critical | 9.8 | 2019-11-06 | Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is software_library.php and affected pa… |
CVE-2019-12917 | Medium | 6.1 | 2019-11-06 | A reflected XSS vulnerability exists in Quest KACE Systems Management Appliance Server Center 9.1.317 affecting the userui/software_library.php component via t… |
CVE-2019-14847 | Medium | 4.9 | 2019-11-06 | A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in denial of… |
CVE-2019-14833 | Medium | 5.4 | 2019-11-06 | A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or… |
CVE-2019-10218 | Medium | 6.5 | 2019-11-06 | A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client… |
CVE-2019-18786 | Medium | 5.5 | 2019-11-06 | In the Linux kernel through 5.3.8, f->fmt.sdr.reserved is uninitialized in rcar_drif_g_fmt_sdr_cap in drivers/media/platform/rcar_drif.c, which could cause a m… |
CVE-2019-18784 | Critical | 9.8 | 2019-11-06 | SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection. |
CVE-2019-18674 | Medium | 5.3 | 2019-11-06 | An issue was discovered in Joomla! before 3.9.13. A missing access check in the phputf8 mapping files could lead to a path disclosure. |
CVE-2019-18650 | High | 8.8 | 2019-11-06 | An issue was discovered in Joomla! before 3.9.13. A missing token check in com_template causes a CSRF vulnerability. |
CVE-2019-8158 | Critical | 9.8 | 2019-11-06 | An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to p… |
CVE-2019-8157 | Medium | 5.4 | 2019-11-06 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can mani… |
CVE-2019-8156 | High | 7.2 | 2019-11-06 | A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with ad… |
CVE-2019-8145 | Medium | 5.4 | 2019-11-06 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inje… |
CVE-2019-8132 | Medium | 5.4 | 2019-11-06 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can craf… |
CVE-2019-8233 | Medium | 6.1 | 2019-11-06 | In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitiz… |
CVE-2019-8232 | Medium | 6.6 | 2019-11-06 | In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with adm… |
CVE-2019-8231 | High | 7.2 | 2019-11-06 | In Magento to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code… |
CVE-2019-8230 | High | 7.2 | 2019-11-06 | In Magentoprior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settings can execute arbi… |
CVE-2019-8229 | High | 7.2 | 2019-11-06 | In Magento prior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit product attributes can execute arbitra… |
CVE-2019-8228 | Medium | 4.8 | 2019-11-06 | in Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code in… |
CVE-2019-8227 | Medium | 4.8 | 2019-11-06 | In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code vi… |
CVE-2019-8159 | High | 8.8 | 2019-11-06 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data man… |
CVE-2019-8155 | High | 7.5 | 2019-11-06 | Magento prior to 1.9.4.3 and prior to 1.14.4.3 included a user's CSRF token in the URL of a GET request. This could be exploited by an attacker with access to… |
CVE-2019-8154 | High | 8.8 | 2019-11-06 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to m… |
CVE-2019-8153 | Medium | 6.1 | 2019-11-06 | A mitigation bypass to prevent cross-site scripting (XSS) exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Successful exploitatio… |
CVE-2019-8152 | Medium | 5.4 | 2019-11-06 | A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3… |
CVE-2019-8151 | High | 7.2 | 2019-11-06 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privilege… |
CVE-2019-8150 | High | 8.8 | 2019-11-06 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to m… |
CVE-2019-8149 | Critical | 9.8 | 2019-11-06 | Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated… |
CVE-2019-8148 | Medium | 4.8 | 2019-11-06 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript… |
CVE-2019-8147 | Medium | 5.4 | 2019-11-06 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inje… |
CVE-2019-8146 | Medium | 5.4 | 2019-11-06 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inje… |
CVE-2019-8144 | Critical | 9.8 | 2019-11-06 | A remote code execution vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can insert a malicious payload through PageBuil… |