2019 CVEs (page 6)
Page 6 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-25270 | Medium | 6.1 | 2026-01-08 | SOCA Access Control System 180612 contains a cross-site scripting vulnerability in the 'senddata' POST parameter of logged_page.php that allows attackers to in… |
CVE-2019-25268 | Critical | 9.8 | 2026-01-08 | NREL BEopt 2.8.0.0 contains a DLL hijacking vulnerability that allows attackers to load arbitrary libraries by tricking users into opening application files fr… |
CVE-2019-25259 | Medium | 5.3 | 2026-01-08 | Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions… |
CVE-2019-25231 | High | 8.4 | 2026-01-08 | devolo dLAN Cockpit 4.3.1 contains an unquoted service path vulnerability in the 'DevoloNetworkService' that allows local non-privileged users to potentially e… |
CVE-2019-25262 | Low | 3.5 | 2025-12-31 | A security vulnerability has been detected in elinicksic Razgover up to db37dfc5c82f023a40f2f7834ded6633fb2b5262. This affects an unknown part of the file Chat… |
CVE-2019-25258 | High | 7.5 | 2025-12-24 | LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverifi… |
CVE-2019-25257 | Medium | 6.5 | 2025-12-24 | LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary paths when changing… |
CVE-2019-25256 | Medium | 6.5 | 2025-12-24 | VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers to access arbitrary system files… |
CVE-2019-25255 | Medium | 4.3 | 2025-12-24 | VideoFlow Digital Video Protection DVP 2.10 contains an authenticated remote code execution vulnerability that allows attackers to execute system commands with… |
CVE-2019-25254 | High | 8.8 | 2025-12-24 | KYOCERA Net Admin 3.4.0906 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request vali… |
CVE-2019-25253 | High | 7.5 | 2025-12-24 | KYOCERA Net Admin 3.4.0906 contains an XML External Entity (XXE) injection vulnerability in the Multi-Set Template Editor that allows unauthenticated attackers… |
CVE-2019-25252 | Medium | 4.3 | 2025-12-24 | Teradek VidiU Pro 3.0.3 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request val… |
CVE-2019-25251 | Medium | 6.5 | 2025-12-24 | Teradek VidiU Pro 3.0.3 contains a server-side request forgery vulnerability in the management interface that allows attackers to manipulate GET parameters 'ur… |
CVE-2019-25250 | Medium | 5.3 | 2025-12-24 | Devolo dLAN 500 AV Wireless+ 3.1.0-1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper… |
CVE-2019-25249 | Critical | 9.8 | 2025-12-24 | devolo dLAN 500 AV Wireless+ 3.1.0-1 contains an authentication bypass vulnerability that allows attackers to enable hidden services through the htmlmgr CGI sc… |
CVE-2019-25248 | High | 7.5 | 2025-12-24 | Beward N100 M2.1.6.04C014 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers ca… |
CVE-2019-25247 | Medium | 5.3 | 2025-12-24 | Beward N100 H.264 VGA IP Camera M2.1.6 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without prop… |
CVE-2019-25246 | High | 8.8 | 2025-12-24 | Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability that allows attackers to read arbitrary system files via the 'RE… |
CVE-2019-25245 | High | 8.8 | 2025-12-24 | Ross Video DashBoard 8.5.1 contains an elevation of privileges vulnerability that allows authenticated users to modify executable files due to improper permiss… |
CVE-2019-25244 | Medium | 5.3 | 2025-12-24 | Legrand BTicino Driver Manager F454 1.0.51 contains multiple web vulnerabilities that allow attackers to perform administrative actions without proper request… |
CVE-2019-25243 | High | 8.8 | 2025-12-24 | FaceSentry 6.4.8 contains an authenticated remote command injection vulnerability in pingTest.php and tcpPortTest.php scripts. Attackers can exploit unsanitize… |
CVE-2019-25242 | Medium | 4.3 | 2025-12-24 | FaceSentry Access Control System 6.4.8 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user… |
CVE-2019-25241 | Critical | 9.8 | 2025-12-24 | FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can… |
CVE-2019-25240 | Critical | 9.8 | 2025-12-24 | Rifatron 5brid DVR contains an unauthenticated vulnerability in the animate.cgi script that allows unauthorized access to live video streams. Attackers can exp… |
CVE-2019-25239 | High | 7.5 | 2025-12-24 | V-SOL GPON/EPON OLT Platform 2.03 contains an unauthenticated information disclosure vulnerability that allows attackers to download configuration files via di… |
CVE-2019-25238 | Medium | 4.3 | 2025-12-24 | V-SOL GPON/EPON OLT Platform 2.03 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user cons… |
CVE-2019-25237 | Critical | 9.8 | 2025-12-24 | V-SOL GPON/EPON OLT Platform v2.03 contains a privilege escalation vulnerability that allows normal users to gain administrative access by manipulating the use… |
CVE-2019-25236 | Critical | 9.8 | 2025-12-24 | iSeeQ Hybrid DVR WH-H4 1.03R contains an unauthenticated vulnerability in the get_jpeg script that allows unauthorized access to live video streams. Attackers… |
CVE-2019-25235 | Critical | 9.8 | 2025-12-24 | Smartwares HOME easy 1.0.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to access administrative web pages by disablin… |
CVE-2019-25234 | Medium | 5.3 | 2025-12-24 | SmartHouse Webapp 6.5.33 contains multiple cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform unauthorized act… |
CVE-2019-25233 | Medium | 5.3 | 2025-12-24 | AVE DOMINAplus 1.10.x contains cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform administrative actions witho… |
CVE-2019-25230 | Medium | 4.3 | 2025-12-18 | An information disclosure vulnerability in Kentico Xperience allows authenticated users to view sensitive system objects through the live site widget propertie… |
CVE-2019-25229 | High | 8.8 | 2025-12-18 | An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC f… |
CVE-2019-25228 | Medium | 5.3 | 2025-12-18 | An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when users interact with… |
CVE-2019-25227 | | 2025-11-26 | Tellion HN-2204AP routers contain an unauthenticated configuration disclosure vulnerability in the /cgi-bin/system_config_file management endpoint. The endpoin… | |
CVE-2019-25226 | | 2025-11-26 | Dongyoung Media DM-AP240T/W wireless access points contain an unauthenticated configuration disclosure vulnerability in the /cgi-bin/sys_system_config manageme… | |
CVE-2019-25225 | Medium | 6.1 | 2025-09-08 | `sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content… |
CVE-2019-19144 | Critical | 9.8 | 2025-08-01 | XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 (11449-53631 Build304) devices via rest/Users?action=authenticate. |
CVE-2019-19145 | Medium | 5.8 | 2025-08-01 | Quantum SuperLoader 3 V94.0 005E.0h devices allow attackers to access the hardcoded fa account because there are only 65536 possible passwords. |
CVE-2019-25224 | Critical | 9.8 | 2025-07-25 | The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows… |
CVE-2019-16536 | High | 8.8 | 2025-05-21 | Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3. |
CVE-2019-25223 | Medium | 4.9 | 2025-04-08 | The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0… |
CVE-2019-16149 | Medium | 5.5 | 2025-03-28 | An Improper Neutralization of Input During Web Page Generation in FortiClientEMS version 6.2.0 may allow a remote attacker to execute unauthorized code by inje… |
CVE-2019-16151 | Medium | 4.7 | 2025-03-21 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenti… |
CVE-2019-6697 | Medium | 5.3 | 2025-03-17 | An Improper Neutralization of Input vulnerability affecting FortiGate version 6.2.0 through 6.2.1, 6.0.0 through 6.0.6 in the hostname parameter of a DHCP pack… |
CVE-2019-17659 | Low | 3.7 | 2025-03-17 | A use of hard-coded cryptographic key vulnerability in FortiSIEM version 5.2.6 may allow a remote unauthenticated attacker to obtain SSH access to the supervis… |
CVE-2019-15706 | Medium | 4.1 | 2025-03-17 | An improper neutralization of input during web page generation in the SSL VPN portal of FortiProxy version 2.0.0, version 1.2.9 and below and FortiOS version 6… |
CVE-2019-25222 | Medium | 4.9 | 2025-03-15 | The Thumbnail carousel slider plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.4 due to ins… |
CVE-2019-1815 | Medium | 5.3 | 2025-03-04 | A security vulnerability was discovered in the local status page functionality of Cisco Meraki’s MX67 and MX68 security appliance models that may allow unauthe… |
CVE-2019-8900 | Medium | 6.8 | 2025-02-21 | A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute arbitrary code upon booting those devic… |
CVE-2019-15002 | Medium | 4.3 | 2025-02-11 | An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. The login form doesn’t require a CSRF token. As a result, an attacker… |
CVE-2019-15690 | High | 8.8 | 2025-01-24 | LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attack… |
CVE-2019-2483 | High | 8.2 | 2024-12-24 | Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 12.1.1, 12.1.2, 12… |
CVE-2019-25221 | Medium | 6.5 | 2024-12-13 | The Responsive Filterable Portfolio plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.8 due… |
CVE-2019-17082 | | 2024-11-26 | Insufficiently Protected Credentials vulnerability in OpenText™ AccuRev allows Authentication Bypass. When installed on a Linux or Solaris system the vulnerab… | |
CVE-2019-25220 | High | 7.5 | 2024-11-18 | Bitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon crash) via a flood of low-difficulty header chains (aka a "Chain Width… |
CVE-2019-20472 | Medium | 6.2 | 2024-11-07 | An issue was discovered on One2Track 2019-12-08 devices. Any SIM card used with the device cannot have a PIN configured. If a PIN is configured, the device sim… |
CVE-2019-20469 | Medium | 4.6 | 2024-11-07 | An issue was discovered on One2Track 2019-12-08 devices. Confidential information is needlessly stored on the smartwatch. Audio files are stored in .amr format… |
CVE-2019-20462 | Medium | 5.3 | 2024-11-07 | An issue was discovered on Alecto IVM-100 2019-11-12 devices. The device comes with a serial interface at the board level. By attaching to this serial interfac… |
CVE-2019-20461 | Critical | 9.8 | 2024-11-07 | An issue was discovered on Alecto IVM-100 2019-11-12 devices. The device uses a custom UDP protocol to start and control video and audio services. The protocol… |
CVE-2019-20460 | High | 8.8 | 2024-11-07 | An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. POST requests don't require (anti-)CSRF tokens or other mechanisms for validating… |
CVE-2019-20459 | High | 8.4 | 2024-11-07 | An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. With the SNMPv1 public community, all values can be read, and with the epson commu… |
CVE-2019-20458 | High | 8.8 | 2024-11-07 | An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. By default, the device comes (and functions) without a password. The user is at no… |
CVE-2019-20457 | Critical | 9.1 | 2024-11-07 | An issue was discovered on Brother MFC-J491DW C1806180757 devices. The printer's web-interface password hash can be retrieved without authentication, because t… |
CVE-2019-25219 | High | 7.5 | 2024-10-29 | Asio C++ Library before 1.13.0 lacks a fallback error code in the case of SSL_ERROR_SYSCALL with no associated error information from the SSL library being use… |
CVE-2019-25218 | Medium | 4.9 | 2024-10-19 | The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and inclu… |
CVE-2019-25217 | Critical | 9.8 | 2024-10-16 | The SiteGround Optimizer plugin for WordPress is vulnerable to authorization bypass leading to Remote Code Execution and Local File Inclusion in versions up to… |
CVE-2019-25216 | High | 7.2 | 2024-10-16 | The Rich Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the POST body 'update' parameter in versions up to, and including, 1.7.4… |
CVE-2019-25215 | High | 7.3 | 2024-10-16 | The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass due to a lack of file access controls in nearly every file of the plugin in versions… |
CVE-2019-25214 | High | 7.2 | 2024-10-16 | The ShopWP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST API routes in versions up to, and inclu… |
CVE-2019-25213 | Critical | 9.8 | 2024-10-16 | The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insuffic… |
CVE-2019-25212 | Medium | 4.9 | 2024-09-11 | The video carousel slider with lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.6… |
CVE-2019-6198 | High | 7.8 | 2024-07-31 | A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges. |
CVE-2019-6197 | High | 7.8 | 2024-07-31 | A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges. |
CVE-2019-25154 | Critical | 9.6 | 2024-07-16 | Inappropriate implementation in iframe in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted H… |
CVE-2019-16641 | High | 8.4 | 2024-07-16 | An issue was found on the Ruijie EG-2000 series gateway. There is a buffer overflow in client.so. Consequently, an attacker can use login.php to login to any a… |
CVE-2019-16640 | High | 7.5 | 2024-07-16 | An issue was found in upload.php on the Ruijie EG-2000 series gateway. A parameter passed to the class UploadFile is mishandled (%00 and /var/./html are not ch… |
CVE-2019-16639 | Critical | 9.8 | 2024-07-16 | An issue was found on the Ruijie EG-2000 series gateway. There is a newcli.php API interface without access control, which can allow an attacker (who only has… |
CVE-2019-16638 | High | 7.5 | 2024-07-16 | An issue was found on the Ruijie EG-2000 series gateway. An attacker can easily dump cleartext stored passwords in /data/config.text with simple XORs. This aff… |
CVE-2019-25211 | Critical | 9.1 | 2024-06-29 | parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed… |
CVE-2019-19755 | Critical | 9.1 | 2024-04-30 | ethOS through 1.3.3 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public I… |
CVE-2019-19754 | Medium | 5.7 | 2024-04-30 | HiveOS through 0.6-102@191212 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of al… |
CVE-2019-19753 | Critical | 9.1 | 2024-04-30 | SimpleMiningOS through v1259 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all… |
CVE-2019-19752 | Critical | 9.8 | 2024-04-30 | nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4… |
CVE-2019-19751 | Medium | 5.6 | 2024-04-30 | easyMINE before 2019-12-05 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all p… |
CVE-2019-6268 | High | 7.5 | 2024-03-08 | RAD SecFlow-2 devices with Hardware 0202, Firmware 4.1.01.63, and U-Boot 2010.12 allow URIs beginning with /.. for Directory Traversal, as demonstrated by read… |
CVE-2019-25210 | Medium | 6.5 | 2024-03-03 | An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is… |
CVE-2019-25162 | High | 7.8 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free Free the adap structure only after we are done using… |
CVE-2019-25160 | Critical | 9.1 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: netlabel: fix out-of-bounds memory accesses There are two array out-of-bounds memory acce… |
CVE-2019-25159 | Medium | 5.5 | 2024-02-04 | A vulnerability was found in mpedraza2020 Intranet del Monterroso up to 4.50.0. It has been classified as critical. This affects an unknown part of the file co… |
CVE-2019-25158 | Medium | 5.5 | 2023-12-19 | A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical. This vulnerability affects the function onSpeechDone of the file app… |
CVE-2019-25157 | Medium | 4.3 | 2023-12-19 | A vulnerability was found in Ethex Contracts. It has been classified as critical. This affects an unknown part of the file EthexJackpot.sol of the component Mo… |
CVE-2019-25156 | Low | 3.5 | 2023-11-07 | A vulnerability classified as problematic was found in dstar2018 Agency up to 61. Affected by this vulnerability is an unknown functionality of the file search… |
CVE-2019-25155 | Medium | 6.1 | 2023-11-07 | DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute. |
CVE-2019-19450 | Critical | 9.8 | 2023-09-20 | paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element i… |
CVE-2019-7819 | Medium | 5.5 | 2023-09-11 | Adobe Acrobat Reader versions 2019.010.20098 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory… |
CVE-2019-16471 | High | 7.8 | 2023-09-11 | Adobe Acrobat Reader versions 2019.021.20056 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the co… |
CVE-2019-16470 | High | 7.8 | 2023-09-11 | Adobe Acrobat Reader versions 2019.021.20056 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execut… |
CVE-2019-13690 | Critical | 9.6 | 2023-08-25 | Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform OS-level privilege escalation via a… |
CVE-2019-13689 | High | 7.8 | 2023-08-25 | Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform arbitrary read/write via a malicious… |