2019 CVEs (page 66)
Page 66 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-2942 | High | 8.2 | 2019-10-16 | Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected ar… |
CVE-2019-2941 | Medium | 4.0 | 2019-10-16 | Vulnerability in the Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Modeling). The supported version that is affected is 11… |
CVE-2019-2940 | Low | 2.3 | 2019-10-16 | Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 18c. Easily exploitable vu… |
CVE-2019-2939 | Medium | 5.0 | 2019-10-16 | Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnera… |
CVE-2019-2938 | Medium | 4.4 | 2019-10-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior… |
CVE-2019-2937 | High | 8.1 | 2019-10-16 | Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. The supported version that is affected is 9… |
CVE-2019-2936 | Medium | 6.8 | 2019-10-16 | Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. The supported version that is affected is 9… |
CVE-2019-2935 | Medium | 5.3 | 2019-10-16 | Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 19.8 and prior. Easily exploit… |
CVE-2019-2934 | High | 8.1 | 2019-10-16 | Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. The supported version that is affected is 9… |
CVE-2019-2933 | Low | 3.1 | 2019-10-16 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u231, 8u221… |
CVE-2019-2932 | High | 7.7 | 2019-10-16 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Tree Manager). Supported versions that are affected are 8.56 an… |
CVE-2019-2931 | Medium | 6.1 | 2019-10-16 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.56 and 8.57… |
CVE-2019-2930 | Medium | 4.7 | 2019-10-16 | Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Wireless). Supported versions that are affected are 12.1.1-12.1.3 and… |
CVE-2019-2929 | Medium | 6.1 | 2019-10-16 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.56 and 8.57… |
CVE-2019-2927 | Medium | 6.4 | 2019-10-16 | Vulnerability in the Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and Security). The supported version that is affected… |
CVE-2019-2926 | Low | 2.3 | 2019-10-16 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 5.2.34 and prio… |
CVE-2019-2925 | Medium | 4.3 | 2019-10-16 | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist). Supported versions that are affected are 12.1.3 and 12.2.3-12.2… |
CVE-2019-2924 | Medium | 5.3 | 2019-10-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 5.6.45 and prior… |
CVE-2019-2923 | Medium | 5.3 | 2019-10-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 5.6.45 and prior… |
CVE-2019-2922 | Medium | 5.3 | 2019-10-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 5.6.45 and prior… |
CVE-2019-2920 | Medium | 5.3 | 2019-10-16 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). Supported versions that are affected are 5.3.13 and prior and 8.0.17… |
CVE-2019-2915 | Medium | 6.1 | 2019-10-16 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core). Supported versions that are affected are 8.56 and… |
CVE-2019-2914 | Medium | 6.5 | 2019-10-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 5.7.27 and prior… |
CVE-2019-2913 | Medium | 5.0 | 2019-10-16 | Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnera… |
CVE-2019-2911 | Low | 2.7 | 2019-10-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Information Schema). Supported versions that are affected are 5.6.45 and prior, 5.7.27 an… |
CVE-2019-2910 | Low | 3.7 | 2019-10-16 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 5.6.45 and prior… |
CVE-2019-2909 | Medium | 6.8 | 2019-10-16 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult… |
CVE-2019-2907 | High | 7.2 | 2019-10-16 | Vulnerability in the Oracle Web Services product of Oracle Fusion Middleware (component: SOAP with Attachments API for Java). The supported version that is aff… |
CVE-2019-2906 | High | 8.2 | 2019-10-16 | Vulnerability in the BI Publisher (formerly XML Publisher) product of Oracle Fusion Middleware (component: Mobile Service). Supported versions that are affecte… |
CVE-2019-2905 | High | 8.6 | 2019-10-16 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are… |
CVE-2019-2904 | Critical | 9.8 | 2019-10-16 | Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0… |
CVE-2019-2903 | High | 7.3 | 2019-10-16 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected i… |
CVE-2019-2902 | High | 7.3 | 2019-10-16 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected i… |
CVE-2019-2901 | High | 7.3 | 2019-10-16 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected i… |
CVE-2019-2900 | High | 7.5 | 2019-10-16 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Actions). Supported versions tha… |
CVE-2019-2899 | Low | 2.4 | 2019-10-16 | Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: OAM). Supported versions that are affected are 11.1.1.9.0, 11.1… |
CVE-2019-2898 | Medium | 4.3 | 2019-10-16 | Vulnerability in the BI Publisher (formerly XML Publisher) product of Oracle Fusion Middleware (component: BI Publisher Security). Supported versions that are… |
CVE-2019-2897 | Medium | 6.4 | 2019-10-16 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Actions). Supported versions tha… |
CVE-2019-2896 | Medium | 5.9 | 2019-10-16 | Vulnerability in the MICROS Relate CRM Software product of Oracle Retail Applications (component: Internal Operations). Supported versions that are affected ar… |
CVE-2019-2895 | High | 7.5 | 2019-10-16 | Vulnerability in the Enterprise Manager for Exadata product of Oracle Enterprise Manager (component: Exadata Plug-In Deploy and Ins). Supported versions that a… |
CVE-2019-2894 | Low | 3.7 | 2019-10-16 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u231, 8u221… |
CVE-2019-2891 | High | 8.1 | 2019-10-16 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1… |
CVE-2019-2890 | High | 7.2 | 2019-10-16 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0… |
CVE-2019-2889 | Medium | 6.1 | 2019-10-16 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps). The supported version that is affected is 12.2.1.3.0… |
CVE-2019-2888 | Medium | 5.3 | 2019-10-16 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: EJB Container). Supported versions that are affected are 10.3.6.0.0… |
CVE-2019-2887 | Medium | 4.3 | 2019-10-16 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 10.3.6.0.0… |
CVE-2019-2886 | Medium | 6.1 | 2019-10-16 | Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Services). The supported version that is affected is 12.2.1.3.0. Easily explo… |
CVE-2019-2884 | Medium | 5.9 | 2019-10-16 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Segment). The supported ve… |
CVE-2019-2883 | Medium | 4.6 | 2019-10-16 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation product of Oracle Retail Applications (component: Segment). The supported ve… |
CVE-2019-2872 | Low | 2.7 | 2019-10-16 | Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Point of Sale). Supported versions that are affect… |
CVE-2019-2765 | Medium | 5.3 | 2019-10-16 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). Supported versions that are affected are 10 and 11. Difficult to exploit… |
CVE-2019-2734 | Medium | 4.3 | 2019-10-16 | Vulnerability in the Core RDBMS component of Oracle Database Server. Supported versions that are affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnera… |
CVE-2019-17663 | Medium | 6.1 | 2019-10-16 | D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to common injection. |
CVE-2019-17662 | Critical | 9.8 | 2019-10-16 | ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned… |
CVE-2019-17578 | Medium | 5.4 | 2019-10-16 | An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via the "Sender email for… |
CVE-2019-17577 | Medium | 5.4 | 2019-10-16 | An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via the "Email used for er… |
CVE-2019-17576 | Medium | 5.4 | 2019-10-16 | An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the /admin/mails.php?action=edit URI via the "Send all emails… |
CVE-2019-17660 | Medium | 6.1 | 2019-10-16 | A cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in LimeSurvey 3.19.1 and earlier allows remote attackers to inject arbit… |
CVE-2019-11281 | Medium | 4.8 | 2019-10-16 | Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior… |
CVE-2019-6334 | Critical | 9.8 | 2019-10-16 | HP LaserJet, PageWide, OfficeJet Enterprise, and LaserJet Managed Printers have a solution to check application signature that may allow potential execution of… |
CVE-2019-16523 | Medium | 5.4 | 2019-10-16 | The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided… |
CVE-2019-16522 | Medium | 4.8 | 2019-10-16 | The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration… |
CVE-2019-16521 | Medium | 6.1 | 2019-10-16 | The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of… |
CVE-2019-17630 | Medium | 4.8 | 2019-10-16 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen. |
CVE-2019-17629 | Medium | 4.8 | 2019-10-16 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen. |
CVE-2019-16520 | Medium | 5.4 | 2019-10-16 | The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is susceptible to Stored XSS due to improper encoding of the SEO-specific d… |
CVE-2019-15893 | High | 7.2 | 2019-10-16 | Sonatype Nexus Repository Manager 2.x before 2.14.15 allows Remote Code Execution. |
CVE-2019-10458 | Critical | 9.9 | 2019-10-16 | Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script… |
CVE-2019-10457 | Medium | 4.3 | 2019-10-16 | A missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers with Overall/Read permission to connect to an attacke… |
CVE-2019-10456 | Medium | 4.3 | 2019-10-16 | A cross-site request forgery vulnerability in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers to connect to an attacker-specified U… |
CVE-2019-10455 | Medium | 4.3 | 2019-10-16 | A missing permission check in Jenkins Rundeck Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-speci… |
CVE-2019-10454 | Medium | 4.3 | 2019-10-16 | A cross-site request forgery vulnerability in Jenkins Rundeck Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credenti… |
CVE-2019-10453 | High | 7.8 | 2019-10-16 | Jenkins Delphix Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to t… |
CVE-2019-10452 | Medium | 4.3 | 2019-10-16 | Jenkins View26 Test-Reporting Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extend… |
CVE-2019-10451 | Medium | 4.3 | 2019-10-16 | Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with ac… |
CVE-2019-10450 | Low | 3.3 | 2019-10-16 | Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users… |
CVE-2019-10449 | High | 8.8 | 2019-10-16 | Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended R… |
CVE-2019-10448 | High | 8.8 | 2019-10-16 | Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended R… |
CVE-2019-10447 | Medium | 4.3 | 2019-10-16 | Jenkins Sofy.AI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permis… |
CVE-2019-10446 | High | 8.2 | 2019-10-16 | Jenkins Cadence vManager Plugin 2.7.0 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM. |
CVE-2019-10445 | Medium | 4.3 | 2019-10-16 | A missing permission check in Jenkins Google Kubernetes Engine Plugin 0.7.0 and earlier allowed attackers with Overall/Read permission to obtain limited inform… |
CVE-2019-10444 | Medium | 6.5 | 2019-10-16 | Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM. |
CVE-2019-10443 | High | 8.8 | 2019-10-16 | Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with… |
CVE-2019-10442 | Medium | 4.3 | 2019-10-16 | A missing permission check in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers with Overall/Read permission to connect to an attacker-specified URL… |
CVE-2019-10441 | Medium | 4.3 | 2019-10-16 | A cross-site request forgery vulnerability in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers to connect to an attacker-specified URL using attacke… |
CVE-2019-10440 | High | 8.8 | 2019-10-16 | Jenkins NeoLoad Plugin 2.2.5 and earlier stored credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master wher… |
CVE-2019-10439 | Medium | 4.3 | 2019-10-16 | A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods allowed users with Ov… |
CVE-2019-10438 | Medium | 6.5 | 2019-10-16 | A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers with Overall/Read permission to connect to an att… |
CVE-2019-10437 | High | 8.8 | 2019-10-16 | A cross-site request forgery vulnerability in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers to connect to an attacker-specifi… |
CVE-2019-10436 | Medium | 6.5 | 2019-10-16 | An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jen… |
CVE-2019-4031 | High | 7.8 | 2019-10-16 | IBM Workload Scheduler Distributed 9.2, 9.3, 9.4, and 9.5 contains a vulnerability that could allow a local user to write files as root in the file system, whi… |
CVE-2019-17627 | Medium | 6.5 | 2019-10-16 | The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy (BLE) traffic during one authorized u… |
CVE-2019-17626 | Critical | 9.8 | 2019-10-16 | ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="… |
CVE-2019-17625 | Critical | 9.0 | 2019-10-16 | There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to i… |
CVE-2019-17624 | High | 7.8 | 2019-10-16 | "" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. For example, by sending ct.c_char 1000 times, an attacker can… |
CVE-2019-13392 | Medium | 6.1 | 2019-10-16 | A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a… |
CVE-2019-17613 | Critical | 9.8 | 2019-10-15 | qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code t… |
CVE-2019-17612 | High | 7.2 | 2019-10-15 | An issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the _list method in the Common/Controller/BackendController.class.php file via t… |
CVE-2019-17395 | Critical | 9.8 | 2019-10-15 | In the Rapid Gator application 0.7.1 for Android, the username and password are stored in the log during authentication, and may be available to attackers via… |
CVE-2019-17602 | Critical | 9.8 | 2019-10-15 | An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on th… |