2019 CVEs (page 61)
Page 61 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10211 | Critical | 9.8 | 2019-10-29 | Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unprotected directory. |
CVE-2019-10210 | High | 7.0 | 2019-10-29 | Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected temporary file. |
CVE-2019-10209 | Low | 2.2 | 2019-10-29 | Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan. |
CVE-2019-10208 | High | 8.8 | 2019-10-29 | A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitr… |
CVE-2019-0210 | High | 7.5 | 2019-10-29 | In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data. |
CVE-2019-0205 | High | 7.5 | 2019-10-29 | In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue… |
CVE-2019-4600 | Medium | 5.3 | 2019-10-29 | IBM API Connect version V5.0.0.0 through 5.0.8.7 could reveal sensitive information to an attacker using a specially crafted HTTP request. IBM X-Force ID: 1678… |
CVE-2019-4546 | High | 8.8 | 2019-10-29 | After installing the IBM Maximo Health- Safety and Environment Manager 7.6.1, a user is granted additional privileges that they are not normally allowed to acc… |
CVE-2019-4339 | High | 7.5 | 2019-10-29 | IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sens… |
CVE-2019-4330 | Medium | 4.3 | 2019-10-29 | IBM Security Guardium Big Data Intelligence (SonarG) 4.0 does not set the secure attribute for cookies in HTTPS sessions, which could cause the user agent to s… |
CVE-2019-4329 | Medium | 4.3 | 2019-10-29 | IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application control… |
CVE-2019-4314 | High | 7.5 | 2019-10-29 | IBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores sensitive information in cleartext within a resource that might be accessible to another contro… |
CVE-2019-4311 | Medium | 5.3 | 2019-10-29 | IBM Security Guardium Big Data Intelligence (SonarG) 4.0 discloses sensitive information to unauthorized users. The information can be used to mount further at… |
CVE-2019-4309 | Medium | 5.5 | 2019-10-29 | IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses hard coded credentials which could allow a local user to obtain highly sensitive information. IBM… |
CVE-2019-4307 | Medium | 5.5 | 2019-10-29 | IBM Security Guardium Big Data Intelligence (SonarG) 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 1609… |
CVE-2019-4306 | Medium | 6.5 | 2019-10-29 | IBM Security Guardium Big Data Intelligence (SonarG) 4.0 specifies permissions for a security-critical resource which could lead to the exposure of sensitive i… |
CVE-2019-18189 | Critical | 9.8 | 2019-10-28 | A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (11.0, XG) and Worry-Free Business Security (9.5, 10.0) may allow an attacker to bypass… |
CVE-2019-18188 | High | 7.5 | 2019-10-28 | Trend Micro Apex One could be exploited by an attacker utilizing a command injection vulnerability to extract files from an arbitrary zip file to a specific fo… |
CVE-2019-18187 | High | 7.5 | 2019-10-28 | Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arb… |
CVE-2019-17181 | Critical | 9.8 | 2019-10-28 | A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03). An attacker may send a crafted HTTP GET or HEAD request that can result in a com… |
CVE-2019-14450 | Critical | 9.8 | 2019-10-28 | A directory traversal vulnerability was discovered in RepetierServer.exe in Repetier-Server 0.8 through 0.91 that allows for the creation of a user controlled… |
CVE-2019-5538 | Medium | 5.9 | 2019-10-28 | Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vC… |
CVE-2019-5537 | Medium | 5.9 | 2019-10-28 | Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vC… |
CVE-2019-5536 | Medium | 6.5 | 2019-10-28 | VMware ESXi (6.7 before ESXi670-201908101-SG and 6.5 before ESXi650-201910401-SG), Workstation (15.x before 15.5.0) and Fusion (11.x before 11.5.0) contain a d… |
CVE-2019-3636 | High | 7.5 | 2019-10-28 | A File Masquerade vulnerability in McAfee Total Protection (MTP) version 16.0.R21 and earlier in Windows client allowed an attacker to read the plaintext list… |
CVE-2019-17224 | Medium | 5.3 | 2019-10-28 | The web interface of the Compal Broadband CH7465LG modem (version CH7465LG-NCIP-6.12.18.25-2p6-NOSH) is vulnerable to a /%2f/ path traversal attack, which can… |
CVE-2019-16897 | Critical | 9.8 | 2019-10-28 | In K7 Antivirus Premium 16.0.xxx through 16.0.0120; K7 Total Security 16.0.xxx through 16.0.0120; and K7 Ultimate Security 16.0.xxx through 16.0.0120, the modu… |
CVE-2019-11043 | High | 8.7 | 2019-10-28 | In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to writ… |
CVE-2019-18195 | High | 8.8 | 2019-10-28 | An issue was discovered on TerraMaster FS-210 4.0.19 devices. Normal users can use 1.user.php for privilege elevation. |
CVE-2019-18466 | Medium | 5.5 | 2019-10-28 | An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, bec… |
CVE-2019-14931 | Critical | 9.8 | 2019-10-28 | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Comman… |
CVE-2019-14930 | Critical | 9.8 | 2019-10-28 | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Undocumented hard-coded user passwo… |
CVE-2019-14929 | Critical | 9.8 | 2019-10-28 | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could al… |
CVE-2019-14928 | Medium | 5.4 | 2019-10-28 | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A number of stored cross-site scrip… |
CVE-2019-14927 | High | 7.5 | 2019-10-28 | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote configura… |
CVE-2019-14926 | Critical | 9.8 | 2019-10-28 | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Hard-coded SSH keys allow an attack… |
CVE-2019-14925 | Medium | 6.5 | 2019-10-28 | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A world-readable /usr/smartrtu/init… |
CVE-2019-16663 | High | 8.8 | 2019-10-28 | An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand p… |
CVE-2019-16662 | Critical | 9.8 | 2019-10-28 | An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the ro… |
CVE-2019-18221 | Medium | 6.1 | 2019-10-25 | CoreHR Core Portal before 27.0.7 allows stored XSS. |
CVE-2019-5508 | High | 7.5 | 2019-10-25 | Clustered Data ONTAP versions 9.2 through 9.4 are susceptible to a vulnerability which allows an attacker to use l2ping to cause a Denial of Service (DoS). |
CVE-2019-17145 | High | 8.8 | 2019-10-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to… |
CVE-2019-17144 | High | 8.8 | 2019-10-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to… |
CVE-2019-17143 | Medium | 4.3 | 2019-10-25 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is req… |
CVE-2019-17142 | High | 8.8 | 2019-10-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to… |
CVE-2019-17141 | High | 8.8 | 2019-10-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to… |
CVE-2019-17140 | High | 8.8 | 2019-10-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to… |
CVE-2019-17139 | High | 8.8 | 2019-10-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to… |
CVE-2019-17138 | Medium | 4.3 | 2019-10-25 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.909. User interaction is req… |
CVE-2019-5129 | Critical | 9.8 | 2019-10-25 | A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated co… |
CVE-2019-5128 | Critical | 9.8 | 2019-10-25 | A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated co… |
CVE-2019-5127 | Critical | 9.8 | 2019-10-25 | A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated co… |
CVE-2019-5123 | High | 8.8 | 2019-10-25 | Specially crafted web requests can cause SQL injections in YouPHPTube 7.6. An attacker can send a web request with Parameter dir in /objects/pluginSwitch.json… |
CVE-2019-5122 | High | 8.8 | 2019-10-25 | SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send… |
CVE-2019-5121 | High | 8.8 | 2019-10-25 | SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send… |
CVE-2019-5120 | High | 8.8 | 2019-10-25 | An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An atta… |
CVE-2019-5119 | High | 8.8 | 2019-10-25 | An exploitable SQL injection vulnerability exist in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attac… |
CVE-2019-5117 | High | 8.8 | 2019-10-25 | Exploitable SQL injection vulnerabilities exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An at… |
CVE-2019-5116 | High | 8.8 | 2019-10-25 | An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause a SQL injection. An att… |
CVE-2019-5114 | Critical | 9.9 | 2019-10-25 | An exploitable SQL injection vulnerability exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An a… |
CVE-2019-13553 | Critical | 9.8 | 2019-10-25 | Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems is configured… |
CVE-2019-13549 | High | 7.5 | 2019-10-25 | Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems does not prov… |
CVE-2019-13546 | Medium | 6.8 | 2019-10-25 | In IntelliSpace Perinatal, Versions K and prior, a vulnerability within the IntelliSpace Perinatal application environment could enable an unauthorized attacke… |
CVE-2019-13525 | Medium | 5.3 | 2019-10-25 | In IP-AK2 Access Control Panel Version 1.04.07 and prior, the integrated web server of the affected devices could allow remote attackers to obtain web configur… |
CVE-2019-4461 | Medium | 5.4 | 2019-10-25 | IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP Response Splitting caused by improper caching of content. This would a… |
CVE-2019-4400 | Medium | 4.3 | 2019-10-25 | IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a remote attacker to traverse directories on the system. An attacker could send… |
CVE-2019-4399 | High | 7.5 | 2019-10-25 | IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h… |
CVE-2019-4396 | Medium | 5.4 | 2019-10-25 | IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supp… |
CVE-2019-4395 | Low | 3.3 | 2019-10-25 | IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 could allow a local user to obtain sensitive information from temporary script files. IBM X-… |
CVE-2019-4394 | Low | 2.3 | 2019-10-25 | IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 contain APIs that could be used by a local user to send email. IBM X-Force ID: 162232. |
CVE-2019-4036 | High | 7.5 | 2019-10-25 | IBM Security Access Manager Appliance could allow unauthenticated attacker to cause a denial of service in the reverse proxy component. IBM X-Force ID: 156159. |
CVE-2019-16265 | Critical | 9.8 | 2019-10-25 | CODESYS V2.3 ENI server up to V3.2.2.24 has a Buffer Overflow. |
CVE-2019-14451 | Critical | 9.8 | 2019-10-25 | RepetierServer.exe in Repetier-Server 0.8 through 0.91 does not properly validate the XML data structure provided when uploading a new printer configuration. W… |
CVE-2019-8234 | Medium | 6.5 | 2019-10-25 | Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a cross-site request forgery vulnerability. Successful exploitation could lead to sensitive information… |
CVE-2019-8088 | Critical | 9.8 | 2019-10-25 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2019-8087 | High | 7.5 | 2019-10-25 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive inf… |
CVE-2019-8086 | High | 7.5 | 2019-10-25 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive inf… |
CVE-2019-8085 | Medium | 6.1 | 2019-10-25 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive in… |
CVE-2019-8084 | Medium | 6.1 | 2019-10-25 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive in… |
CVE-2019-8083 | Medium | 6.1 | 2019-10-25 | Adobe Experience Manager versions 6.5, 6.4 and 6.3 have a cross site scripting vulnerability. Successful exploitation could lead to sensitive information discl… |
CVE-2019-8082 | High | 7.5 | 2019-10-25 | Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive informat… |
CVE-2019-8081 | High | 7.5 | 2019-10-25 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have an authentication bypass vulnerability. Successful exploitation could lead to sensitive informatio… |
CVE-2019-17596 | High | 7.5 | 2019-10-24 | Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack s… |
CVE-2019-18418 | Critical | 9.8 | 2019-10-24 | clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management. |
CVE-2019-18419 | Medium | 6.1 | 2019-10-24 | A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via th… |
CVE-2019-8080 | Medium | 6.1 | 2019-10-24 | Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability. Successful exploitation could lead to privilege escalation. |
CVE-2019-8079 | Medium | 6.1 | 2019-10-24 | Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross site scripting vulnerability. Successful exploitation could lead to sensitive… |
CVE-2019-8078 | Medium | 6.1 | 2019-10-24 | Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability. Successful exploitation could lead to sensitive informa… |
CVE-2019-18417 | High | 8.8 | 2019-10-24 | Sourcecodester Restaurant Management System 1.0 allows an authenticated attacker to upload arbitrary files that can result in code execution. The issue occurs… |
CVE-2019-18416 | Medium | 6.1 | 2019-10-24 | Sourcecodester Restaurant Management System 1.0 allows XSS via the Last Name field of a member. |
CVE-2019-18415 | Medium | 6.1 | 2019-10-24 | Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen. |
CVE-2019-18414 | High | 8.8 | 2019-10-24 | Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lack of CSRF protectio… |
CVE-2019-18413 | Low | 3.7 | 2019-10-24 | In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name… |
CVE-2019-12095 | High | 8.8 | 2019-10-24 | Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 and other products, allows CSRF, as demonstrated by the treanBookmarkTags parameter to t… |
CVE-2019-12094 | Medium | 6.1 | 2019-10-24 | Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update_f&user_name= or admin/user.php?form=remove_f&user_name= or admin/co… |
CVE-2019-9699 | Medium | 4.5 | 2019-10-24 | Symantec Messaging Gateway (prior to 10.7.0), may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially al… |
CVE-2019-5013 | High | 7.8 | 2019-10-24 | An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the start/stopLaunchDProcess command… |
CVE-2019-5012 | High | 7.8 | 2019-10-24 | An exploitable privilege escalation vulnerability exists in the Wacom, driver version 6.3.32-3, update helper service in the startProcess command. The command… |
CVE-2019-18196 | Medium | 6.7 | 2019-10-24 | A DLL side loading vulnerability in the Windows Service in TeamViewer versions up to 11.0.133222 (fixed in 11.0.214397), 12.0.181268 (fixed in 12.0.214399), 13… |
CVE-2019-15929 | Critical | 9.8 | 2019-10-24 | In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute forc… |