2019 CVEs (page 59)
Page 59 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-8143 | Medium | 6.5 | 2019-11-06 | A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to email templat… |
CVE-2019-8142 | Medium | 5.4 | 2019-11-06 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inje… |
CVE-2019-8141 | High | 7.2 | 2019-11-06 | A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user wit… |
CVE-2019-8140 | Medium | 4.9 | 2019-11-06 | An unrestricted file upload vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can manipu… |
CVE-2019-8139 | Medium | 5.4 | 2019-11-06 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary Javascript code… |
CVE-2019-8138 | Medium | 5.4 | 2019-11-06 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can exec… |
CVE-2019-8137 | High | 8.8 | 2019-11-06 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to m… |
CVE-2019-8136 | Critical | 9.8 | 2019-11-06 | An insecure component vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Magento 2 codebase leveraged outdated versio… |
CVE-2019-8135 | Critical | 9.8 | 2019-11-06 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony fram… |
CVE-2019-8134 | High | 8.8 | 2019-11-06 | A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with marketing privileges can execute arbit… |
CVE-2019-8133 | Medium | 6.5 | 2019-11-06 | A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with privileges to generate sitemaps can… |
CVE-2019-8131 | Medium | 5.4 | 2019-11-06 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inje… |
CVE-2019-8130 | High | 8.8 | 2019-11-06 | A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with store manipulation privileges can exec… |
CVE-2019-8129 | Medium | 5.4 | 2019-11-06 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can expl… |
CVE-2019-8128 | Medium | 5.4 | 2019-11-06 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can expl… |
CVE-2019-8127 | High | 8.8 | 2019-11-05 | A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to an accoun… |
CVE-2019-8126 | Medium | 4.9 | 2019-11-05 | An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft docu… |
CVE-2019-8125 | High | 7.2 | 2019-11-05 | A remote code execution vulnerability exists in Magento 1 prior to 1.9.x and 1.14.x. An authenticated admin user can modify configuration parameters via crafte… |
CVE-2019-8124 | Medium | 4.9 | 2019-11-05 | An insufficient logging and monitoring vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Failure to… |
CVE-2019-8123 | Medium | 5.3 | 2019-11-05 | An insufficient logging and monitoring vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.1… |
CVE-2019-8122 | High | 8.8 | 2019-11-05 | A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user wit… |
CVE-2019-8121 | Critical | 9.8 | 2019-11-05 | An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leverage… |
CVE-2019-8120 | Medium | 5.4 | 2019-11-05 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authentica… |
CVE-2019-8119 | High | 7.2 | 2019-11-05 | A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated admin us… |
CVE-2019-8118 | Medium | 5.3 | 2019-11-05 | Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for cu… |
CVE-2019-8117 | Medium | 5.4 | 2019-11-05 | A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticates user can inje… |
CVE-2019-8116 | High | 7.5 | 2019-11-05 | Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated… |
CVE-2019-8115 | Medium | 4.8 | 2019-11-05 | A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user… |
CVE-2019-8114 | High | 7.2 | 2019-11-05 | A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A… |
CVE-2019-8113 | Medium | 5.3 | 2019-11-05 | Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 uses cryptographically weak random number generator to brute-force the confirmation code fo… |
CVE-2019-8112 | High | 7.5 | 2019-11-05 | A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can bypass the email con… |
CVE-2019-8111 | High | 8.8 | 2019-11-05 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage plugin… |
CVE-2019-8110 | High | 8.8 | 2019-11-05 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage email t… |
CVE-2019-8109 | High | 8.0 | 2019-11-05 | A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can craft a maliciou… |
CVE-2019-8108 | Medium | 6.5 | 2019-11-05 | Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated us… |
CVE-2019-8107 | Medium | 6.5 | 2019-11-05 | An arbitrary file deletion vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with export data… |
CVE-2019-8093 | High | 8.8 | 2019-11-05 | An arbitrary file access vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage file u… |
CVE-2019-8092 | Medium | 5.4 | 2019-11-05 | A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can i… |
CVE-2019-8091 | High | 7.2 | 2019-11-05 | A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3. An authenticated admin user with privileges to access product attribut… |
CVE-2019-8090 | Medium | 6.5 | 2019-11-05 | An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated users… |
CVE-2019-5068 | Medium | 4.4 | 2019-11-05 | An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. An attacker can access the shared me… |
CVE-2019-6142 | Medium | 6.1 | 2019-11-05 | It has been reported that XSS is possible in Forcepoint Email Security, versions 8.5 and 8.5.3. It is strongly recommended that you apply the relevant hotfix i… |
CVE-2019-5089 | High | 7.8 | 2019-11-05 | An exploitable memory corruption vulnerability exists in Investintech Able2Extract Professional 4.0.7 x64. A specially crafted JPEG file can cause an out-of-bo… |
CVE-2019-5088 | High | 7.8 | 2019-11-05 | An exploitable memory corruption vulnerability exists in Investintech Able2Extract Professional 14.0.7 x64. A specially crafted BMP file can cause an out-of-bo… |
CVE-2019-16284 | High | 7.2 | 2019-11-05 | A potential security vulnerability has been identified in multiple HP products and versions which involves possible execution of arbitrary code during boot ser… |
CVE-2019-1982 | Medium | 5.3 | 2019-11-05 | A vulnerability in the HTTP traffic filtering component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepo… |
CVE-2019-1981 | Medium | 5.8 | 2019-11-05 | A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower M… |
CVE-2019-1980 | Medium | 5.3 | 2019-11-05 | A vulnerability in the protocol detection component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower… |
CVE-2019-1978 | Medium | 5.8 | 2019-11-05 | A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower M… |
CVE-2019-1877 | Medium | 6.5 | 2019-11-05 | A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to download files attached through chat sess… |
CVE-2019-1734 | Medium | 5.5 | 2019-11-05 | A vulnerability in the implementation of a CLI diagnostic command in Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker… |
CVE-2019-18780 | Critical | 9.8 | 2019-11-05 | An arbitrary command injection vulnerability in the Cluster Server component of Veritas InfoScale allows an unauthenticated remote attacker to execute arbitrar… |
CVE-2019-10084 | High | 7.5 | 2019-11-05 | In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries… |
CVE-2019-1789 | High | 7.5 | 2019-11-05 | ClamAV versions prior to 0.101.2 are susceptible to a denial of service (DoS) vulnerability. An out-of-bounds heap read condition may occur when scanning PE fi… |
CVE-2019-15966 | High | 7.7 | 2019-11-05 | A vulnerability in the web application of Cisco TelePresence Advanced Media Gateway could allow an authenticated, remote attacker to cause a denial of service… |
CVE-2019-12625 | High | 7.5 | 2019-11-05 | ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sendi… |
CVE-2019-18631 | High | 7.8 | 2019-11-05 | The Windows component of Centrify Authentication and Privilege Elevation Services 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.5.0, 3.5.1 (18.8), 3.5.2 (18.11), and 3.6.0 (19… |
CVE-2019-17211 | Critical | 9.8 | 2019-11-05 | An integer overflow was discovered in the CoAP library in Arm Mbed OS 5.14.0. The function sn_coap_builder_calc_needed_packet_data_size_2() is used to calculat… |
CVE-2019-17062 | High | 8.8 | 2019-11-05 | An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Editi… |
CVE-2019-17598 | High | 7.5 | 2019-11-05 | An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may somet… |
CVE-2019-17212 | Critical | 9.8 | 2019-11-05 | Buffer overflows were discovered in the CoAP library in Arm Mbed OS 5.14.0. The CoAP parser is responsible for parsing received CoAP packets. The function sn_c… |
CVE-2019-17221 | High | 7.5 | 2019-11-05 | PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page… |
CVE-2019-10223 | Medium | 6.5 | 2019-11-05 | A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled anno… |
CVE-2019-3685 | High | 7.4 | 2019-11-05 | Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary |
CVE-2019-18663 | Critical | 9.8 | 2019-11-04 | A SQL injection vulnerability in a /login/forgot1 POST request in ARP-GUARD 4.0.0-5 allows unauthenticated remote attackers to execute arbitrary SQL commands v… |
CVE-2019-18178 | High | 7.5 | 2019-11-04 | Real Time Engineers FreeRTOS+FAT 160919a has a use after free. The function FF_Close() is defined in ff_file.c. The file handler pxFile is freed by ffconfigFRE… |
CVE-2019-17210 | High | 7.5 | 2019-11-04 | A denial-of-service issue was discovered in the MQTT library in Arm Mbed OS 2017-11-02. The function readMQTTLenString() is called by the function MQTTDeserial… |
CVE-2019-13497 | Medium | 6.5 | 2019-11-04 | One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows CSRF for logout requests. |
CVE-2019-13496 | High | 8.1 | 2019-11-04 | One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows OTP bypass via vectors involving a man in the middle, the One Identity Defender product, and rep… |
CVE-2019-18684 | High | 7.0 | 2019-11-04 | Sudo through 1.8.29 allows local users to escalate to root if they have write access to file descriptor 3 of the sudo process. This occurs because of a race co… |
CVE-2019-18683 | High | 7.0 | 2019-11-04 | An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributio… |
CVE-2019-18680 | High | 7.5 | 2019-11-04 | An issue was discovered in the Linux kernel 4.4.x before 4.4.195. There is a NULL pointer dereference in rds_tcp_kill_sock() in net/rds/tcp.c that will cause d… |
CVE-2019-0350 | High | 7.5 | 2019-11-04 | SAP HANA Database, versions 1.0, 2.0, allows an unauthorized attacker to send a malformed connection request, which crashes the indexserver of an SAP HANA inst… |
CVE-2019-18673 | Medium | 4.6 | 2019-11-02 | On SHIFT BitBox02 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number… |
CVE-2019-14360 | Medium | 4.6 | 2019-11-02 | On Hyundai Pay Kasse HK-1000 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on… |
CVE-2019-14358 | Medium | 4.6 | 2019-11-02 | On Archos Safe-T devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number… |
CVE-2019-18668 | Medium | 6.5 | 2019-11-02 | An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator. In… |
CVE-2019-18667 | Medium | 6.1 | 2019-11-02 | /usr/local/www/freeradius_view_config.php in the freeradius3 package before 0.15.7_3 for pfSense on FreeBSD allows a user with an XSS payload as password or us… |
CVE-2019-18665 | High | 7.5 | 2019-11-02 | The Log module in SECUDOS DOMOS before 5.6 allows local file inclusion. |
CVE-2019-18664 | Medium | 5.4 | 2019-11-02 | The Log module in SECUDOS DOMOS before 5.6 allows XSS. |
CVE-2019-18662 | Critical | 9.8 | 2019-11-02 | An issue was discovered in YouPHPTube through 7.7. User input passed through the live_stream_code POST parameter to /plugin/LiveChat/getChat.json.php is not pr… |
CVE-2019-18661 | High | 7.5 | 2019-11-02 | Fastweb FASTGate 1.0.1b devices allow partial authentication bypass by changing a certain check_pwd return value from 0 to 1. An attack does not achieve admini… |
CVE-2019-18659 | Medium | 5.3 | 2019-11-02 | The Wireless Emergency Alerts (WEA) protocol allows remote attackers to spoof a Presidential Alert because cryptographic authentication is not used, as demonst… |
CVE-2019-6470 | Medium | 6.5 | 2019-11-01 | There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd rela… |
CVE-2019-18654 | Medium | 6.1 | 2019-11-01 | A Cross Site Scripting (XSS) issue exists in AVG AntiVirus (Internet Security Edition) 19.3.3084 build 19.3.4241.440 in the Network Notification Popup, allowin… |
CVE-2019-18653 | Medium | 6.1 | 2019-11-01 | A Cross Site Scripting (XSS) issue exists in Avast AntiVirus (Free, Internet Security, and Premiere Edition) 19.3.2369 build 19.3.4241.440 in the Network Notif… |
CVE-2019-12752 | Medium | 6.1 | 2019-11-01 | The Symantec SONAR component, prior to 12.0.2, may be susceptible to a tamper protection bypass vulnerability which could potentially allow an attacker to circ… |
CVE-2019-6658 | Medium | 4.3 | 2019-11-01 | On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, a vulnerability in the AFM configuration utility may allow any authenticated BI… |
CVE-2019-6657 | Medium | 6.1 | 2019-11-01 | On BIG-IP 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP… |
CVE-2019-15588 | High | 7.2 | 2019-11-01 | There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All… |
CVE-2019-18636 | Medium | 5.4 | 2019-11-01 | A cross-site scripting (XSS) vulnerability in Jitbit .NET Forum (aka ASP.NET forum) 8.3.8 allows remote attackers to inject arbitrary web script or HTML via th… |
CVE-2019-16909 | Medium | 4.3 | 2019-11-01 | An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14_J8 for Jira. It is possible to obtain a list of all Jira projects (… |
CVE-2019-16908 | Medium | 5.3 | 2019-11-01 | An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14_J8 for Jira. It is possible to obtain a list of all Jira projects w… |
CVE-2019-18230 | High | 7.5 | 2019-10-31 | Honeywell equIP and Performance series IP cameras, multiple versions, A vulnerability exists where the affected product allows unauthenticated access to audio… |
CVE-2019-18229 | Medium | 6.5 | 2019-10-31 | Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Lack of sanitization of user-supplied input cause SQL injection vulnerabilities. An attacker can leverage t… |
CVE-2019-18228 | High | 7.5 | 2019-10-31 | Honeywell equIP series IP cameras Multiple equIP Series Cameras, A vulnerability exists in the affected products where a specially crafted HTTP packet request… |
CVE-2019-18227 | High | 7.5 | 2019-10-31 | Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. XXE vulnerabilities exist that may allow disclosure of sensitive data. |
CVE-2019-18226 | Critical | 9.8 | 2019-10-31 | Honeywell equIP series and Performance series IP cameras and recorders, A vulnerability exists in the affected products where IP cameras and recorders have a p… |
CVE-2019-16907 | Medium | 5.3 | 2019-10-31 | An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. It is possible to obtain a list of all valid Jira usernames w… |
CVE-2019-16906 | High | 7.5 | 2019-10-31 | An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. By using plugins/servlet/nfj/PushNotification?username= with… |