2019 CVEs (page 64)
Page 64 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-8172 | Medium | 4.3 | 2019-10-17 | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.00… |
CVE-2019-8171 | High | 8.8 | 2019-10-17 | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.00… |
CVE-2019-8170 | High | 8.8 | 2019-10-17 | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.00… |
CVE-2019-8169 | Critical | 9.8 | 2019-10-17 | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.00… |
CVE-2019-8168 | High | 7.5 | 2019-10-17 | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.00… |
CVE-2019-8167 | Critical | 9.8 | 2019-10-17 | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.00… |
CVE-2019-8166 | High | 8.8 | 2019-10-17 | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.00… |
CVE-2019-8165 | High | 8.8 | 2019-10-17 | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.00… |
CVE-2019-8164 | High | 7.5 | 2019-10-17 | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.00… |
CVE-2019-8163 | Medium | 4.3 | 2019-10-17 | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.00… |
CVE-2019-8162 | High | 8.1 | 2019-10-17 | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.00… |
CVE-2019-8161 | Critical | 9.8 | 2019-10-17 | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.00… |
CVE-2019-8160 | Medium | 6.1 | 2019-10-17 | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.00… |
CVE-2019-8064 | Medium | 4.3 | 2019-10-17 | Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.00… |
CVE-2019-6476 | Medium | 5.9 | 2019-10-17 | A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving… |
CVE-2019-6475 | Medium | 5.9 | 2019-10-17 | Mirror zones are a BIND feature allowing recursive servers to pre-cache zone data provided by other servers. A mirror zone is similar to a zone of type seconda… |
CVE-2019-18192 | High | 7.8 | 2019-10-17 | GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable… |
CVE-2019-15066 | Critical | 10.0 | 2019-10-17 | An “invalid command” handler issue was discovered in HiNet GPON firmware < I040GWR190731. It allows an attacker to execute arbitrary command through port 6998… |
CVE-2019-15065 | Critical | 9.3 | 2019-10-17 | A service which is hosted on port 6998 in HiNet GPON firmware < I040GWR190731 allows an attacker to execute a specific command to read arbitrary files. CVSS 3… |
CVE-2019-15064 | Critical | 9.8 | 2019-10-17 | HiNet GPON firmware version < I040GWR190731 allows an attacker login to device without any authentication. |
CVE-2019-13412 | Critical | 9.3 | 2019-10-17 | A service which is hosted on port 3097 in HiNet GPON firmware < I040GWR190731 allows an attacker to execute a specific command to read arbitrary files. CVSS 3… |
CVE-2019-13410 | High | 7.5 | 2019-10-17 | TOPMeeting before version 8.8 (2019/08/19) shows attendees account and password in front end page that allows an attacker to obtain sensitive information by br… |
CVE-2019-13409 | Critical | 9.8 | 2019-10-17 | A SQL injection vulnerability was discovered in TOPMeeting before version 8.8 (2019/08/19). An attacker can use a union based injection query string though a s… |
CVE-2019-8071 | Critical | 9.8 | 2019-10-17 | Adobe Download Manager versions 2.0.0.363 have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation. |
CVE-2019-17120 | Medium | 6.1 | 2019-10-17 | A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary w… |
CVE-2019-17119 | High | 8.8 | 2019-10-17 | Multiple SQL injection vulnerabilities in Logs.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allow authenticated users to execute arbitrary SQL comman… |
CVE-2019-15627 | High | 7.1 | 2019-10-17 | Versions 10.0, 11.0 and 12.0 of the Trend Micro Deep Security Agent are vulnerable to an arbitrary file delete attack, which may lead to availability impact. L… |
CVE-2019-15626 | High | 7.5 | 2019-10-17 | The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communication in clear text… |
CVE-2019-13657 | Critical | 9.8 | 2019-10-17 | CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute… |
CVE-2019-12611 | Medium | 4.4 | 2019-10-17 | An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that affects the general reliability of the product. Specially crafted packets… |
CVE-2019-10752 | Critical | 9.8 | 2019-10-17 | Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly… |
CVE-2019-17631 | Critical | 9.1 | 2019-10-17 | From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks. |
CVE-2019-17118 | High | 8.8 | 2019-10-17 | A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker to trick an authenticated user into performing unintended actions such… |
CVE-2019-17117 | High | 8.8 | 2019-10-17 | A SQL injection vulnerability in processPref.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows an authenticated user to execute arbitrary SQL comma… |
CVE-2019-17116 | Medium | 6.1 | 2019-10-17 | A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary w… |
CVE-2019-17115 | Medium | 6.1 | 2019-10-17 | Multiple cross-site scripting (XSS) vulnerabilities in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or… |
CVE-2019-17114 | Medium | 6.1 | 2019-10-17 | A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary… |
CVE-2019-16917 | High | 8.8 | 2019-10-17 | WiKID Enterprise 2FA (two factor authentication) Enterprise Server through 4.2.0-b2047 is vulnerable to SQL injection through the searchDevices.jsp endpoint. T… |
CVE-2019-14287 | High | 8.8 | 2019-10-17 | In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorr… |
CVE-2019-13411 | Critical | 10.0 | 2019-10-17 | An “invalid command” handler issue was discovered in HiNet GPON firmware < I040GWR190731. It allows an attacker to execute arbitrary command through port 3097… |
CVE-2019-11284 | High | 8.6 | 2019-10-17 | Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may ga… |
CVE-2019-16330 | Medium | 5.4 | 2019-10-17 | In NCH Express Accounts Accounting v7.02, persistent cross site scripting (XSS) exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenti… |
CVE-2019-11253 | High | 7.5 | 2019-10-17 | Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized us… |
CVE-2019-15850 | High | 8.8 | 2019-10-17 | eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method. An authenticated attacker can easily execute code and c… |
CVE-2019-15849 | High | 7.3 | 2019-10-17 | eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation. An attacker can create session IDs and send them to the victim. After the victim logs in to the s… |
CVE-2019-14424 | Medium | 6.5 | 2019-10-17 | A Local File Inclusion (LFI) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers… |
CVE-2019-14423 | High | 8.8 | 2019-10-17 | A Remote Code Execution (RCE) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers… |
CVE-2019-17676 | High | 8.8 | 2019-10-17 | app/system/admin/admin/index.class.php in MetInfo 7.0.0beta allows a CSRF attack to add a user account via a doSaveSetup action to admin/index.php, as demonstr… |
CVE-2019-17675 | High | 8.8 | 2019-10-17 | WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF. |
CVE-2019-17674 | Medium | 5.4 | 2019-10-17 | WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer. |
CVE-2019-17673 | High | 7.5 | 2019-10-17 | WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header. |
CVE-2019-17672 | Medium | 6.1 | 2019-10-17 | WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements. |
CVE-2019-17671 | Medium | 5.3 | 2019-10-17 | In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled. |
CVE-2019-17670 | Critical | 9.8 | 2019-10-17 | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs. |
CVE-2019-17669 | Critical | 9.8 | 2019-10-17 | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series… |
CVE-2019-17668 | Medium | 6.8 | 2019-10-17 | Samsung Galaxy S10 and Note10 devices allow unlock operations via unregistered fingerprints in certain situations involving a third-party screen protector. |
CVE-2019-17667 | Medium | 5.4 | 2019-10-17 | Comtech H8 Heights Remote Gateway 2.5.1 devices allow XSS and HTML injection via the Site Name (aka SiteName) field. |
CVE-2019-17666 | High | 8.8 | 2019-10-17 | rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check, leading to a buffer overflow. |
CVE-2019-17611 | Medium | 6.1 | 2019-10-16 | HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter. |
CVE-2019-17610 | Medium | 6.1 | 2019-10-16 | HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter. |
CVE-2019-17609 | Medium | 6.1 | 2019-10-16 | HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter. |
CVE-2019-17608 | Medium | 6.1 | 2019-10-16 | HongCMS 3.0.0 has XSS via the install/index.php dbname parameter. |
CVE-2019-17607 | Medium | 6.1 | 2019-10-16 | HongCMS 3.0.0 has XSS via the install/index.php servername parameter. |
CVE-2019-17665 | High | 7.8 | 2019-10-16 | NSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the current working directory. |
CVE-2019-17664 | High | 7.8 | 2019-10-16 | NSA Ghidra through 9.0.4 uses a potentially untrusted search path. When executing Ghidra from a given path, the Java process working directory is set to this p… |
CVE-2019-13116 | Critical | 9.8 | 2019-10-16 | The MuleSoft Mule Community Edition runtime engine before 3.8 allows remote attackers to execute arbitrary code because of Java Deserialization, related to Apa… |
CVE-2019-17512 | Critical | 9.1 | 2019-10-16 | There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clea… |
CVE-2019-17436 | High | 7.1 | 2019-10-16 | A Local Privilege Escalation vulnerability exists in GlobalProtect Agent for Linux and Mac OS X version 5.0.4 and earlier and version 4.1.12 and earlier, that… |
CVE-2019-17435 | Medium | 5.5 | 2019-10-16 | A Local Privilege Escalation vulnerability exists in the GlobalProtect Agent for Windows 5.0.3 and earlier, and GlobalProtect Agent for Windows 4.1.12 and earl… |
CVE-2019-16700 | Critical | 9.8 | 2019-10-16 | The slub_events (aka SLUB: Event Registration) extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. For versions 1.2.2 and b… |
CVE-2019-16699 | Critical | 9.8 | 2019-10-16 | The sr_freecap (aka freeCap CAPTCHA) extension 2.4.5 and below and 2.5.2 and below for TYPO3 fails to sanitize user input, which allows execution of arbitrary… |
CVE-2019-16698 | Medium | 4.3 | 2019-10-16 | The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissi… |
CVE-2019-16682 | High | 7.3 | 2019-10-16 | The url_redirect (aka URL redirect) extension through 1.2.1 for TYPO3 fails to properly sanitize user input and is susceptible to SQL Injection. |
CVE-2019-15962 | Medium | 4.4 | 2019-10-16 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to write files to the /root… |
CVE-2019-15282 | Medium | 5.3 | 2019-10-16 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker read tcp… |
CVE-2019-15281 | Medium | 4.8 | 2019-10-16 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to conduct… |
CVE-2019-15280 | Medium | 4.8 | 2019-10-16 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to cond… |
CVE-2019-15277 | Medium | 6.7 | 2019-10-16 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to execute code with root pr… |
CVE-2019-15275 | Medium | 6.7 | 2019-10-16 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to execute arbitrary command… |
CVE-2019-15274 | Medium | 6.7 | 2019-10-16 | A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to perform command injection… |
CVE-2019-15273 | Medium | 4.4 | 2019-10-16 | Multiple vulnerabilities in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to overwrite arbitr… |
CVE-2019-15270 | Medium | 5.4 | 2019-10-16 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to conduct a c… |
CVE-2019-15269 | Medium | 4.8 | 2019-10-16 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to cond… |
CVE-2019-15268 | Medium | 4.8 | 2019-10-16 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to cond… |
CVE-2019-15266 | Medium | 4.4 | 2019-10-16 | A vulnerability in the CLI of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, local attacker to view system files that should be res… |
CVE-2019-15265 | Medium | 6.5 | 2019-10-16 | A vulnerability in the bridge protocol data unit (BPDU) forwarding functionality of Cisco Aironet Access Points (APs) could allow an unauthenticated, adjacent… |
CVE-2019-15264 | Medium | 6.5 | 2019-10-16 | A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol implementation of Cisco Aironet and Catalyst 9100 Access Points (AP… |
CVE-2019-15262 | High | 7.5 | 2019-10-16 | A vulnerability in the Secure Shell (SSH) session management for Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker t… |
CVE-2019-15261 | High | 8.6 | 2019-10-16 | A vulnerability in the Point-to-Point Tunneling Protocol (PPTP) VPN packet processing functionality in Cisco Aironet Access Points (APs) could allow an unauthe… |
CVE-2019-15260 | Critical | 9.8 | 2019-10-16 | A vulnerability in Cisco Aironet Access Points (APs) Software could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted device… |
CVE-2019-15258 | Medium | 6.5 | 2019-10-16 | A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to… |
CVE-2019-15257 | Medium | 6.5 | 2019-10-16 | A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to… |
CVE-2019-15252 | High | 8.0 | 2019-10-16 | Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with… |
CVE-2019-15251 | High | 8.0 | 2019-10-16 | Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with… |
CVE-2019-15250 | High | 8.0 | 2019-10-16 | Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with… |
CVE-2019-15249 | High | 8.0 | 2019-10-16 | Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with… |
CVE-2019-15248 | High | 8.0 | 2019-10-16 | Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with… |
CVE-2019-15247 | High | 8.0 | 2019-10-16 | Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with… |
CVE-2019-15246 | High | 8.0 | 2019-10-16 | Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with… |
CVE-2019-15245 | High | 8.0 | 2019-10-16 | Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with… |