2019 CVEs (page 68)
Page 68 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-17494 | Medium | 6.1 | 2019-10-10 | laravel-bjyblog 6.1.1 has XSS via a crafted URL. |
CVE-2019-17493 | Medium | 6.1 | 2019-10-10 | Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[sample_input] parameter to web/admin/problem/create or web/polygon/problem/update. |
CVE-2019-17491 | Medium | 6.1 | 2019-10-10 | Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[description] parameter to web/admin/problem/create or web/polygon/problem/update. |
CVE-2019-17490 | High | 8.8 | 2019-10-10 | app\modules\polygon\controllers\ProblemController in Jiangnan Online Judge (aka jnoj) 0.8.0 allows arbitrary file upload, as demonstrated by PHP code (with a… |
CVE-2019-17489 | Medium | 6.1 | 2019-10-10 | Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[title] parameter to web/polygon/problem/create or web/polygon/problem/update or web/admin/proble… |
CVE-2019-17488 | Medium | 6.1 | 2019-10-10 | b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header. |
CVE-2019-17386 | High | 8.8 | 2019-10-10 | The animate-it plugin before 2.3.6 for WordPress has CSRF in edsanimate.php. |
CVE-2019-9534 | High | 7.8 | 2019-10-10 | The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom f… |
CVE-2019-9533 | Critical | 9.8 | 2019-10-10 | The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08. This could allow an attacker to reverse-engine… |
CVE-2019-9532 | High | 7.8 | 2019-10-10 | The web application portal of the Cobham EXPLORER 710, firmware version 1.07, sends the login password in cleartext. This could allow an unauthenticated, local… |
CVE-2019-9531 | Critical | 9.8 | 2019-10-10 | The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454. This could allow an unauthenticated… |
CVE-2019-9530 | Medium | 5.5 | 2019-10-10 | The web root directory of the Cobham EXPLORER 710, firmware version 1.07, has no access restrictions on downloading and reading all files. This could allow an… |
CVE-2019-9529 | Medium | 5.5 | 2019-10-10 | The web application portal of the Cobham EXPLORER 710, firmware version 1.07, has no authentication by default. This could allow an unauthenticated, local atta… |
CVE-2019-15051 | High | 8.8 | 2019-10-10 | An issue was discovered in Softing uaGate (SI, MB, 840D) firmware through 1.71.00.1225. A CGI script is vulnerable to command injection via a maliciously craft… |
CVE-2019-11528 | High | 7.5 | 2019-10-10 | An issue was discovered in Softing uaGate SI 1.60.01. A system default path for executables is user writable. |
CVE-2019-11527 | High | 8.8 | 2019-10-10 | An issue was discovered in Softing uaGate SI 1.60.01. A CGI script is vulnerable to command injection with a maliciously crafted url parameter. |
CVE-2019-14810 | Medium | 5.9 | 2019-10-10 | A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LDP agent can establi… |
CVE-2019-11526 | Critical | 9.8 | 2019-10-10 | An issue was discovered in Softing uaGate SI 1.60.01. A maintenance script, that is executable via sudo, is vulnerable to file path injection. This enables the… |
CVE-2019-17455 | Critical | 9.8 | 2019-10-10 | Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demons… |
CVE-2019-5535 | Medium | 4.7 | 2019-10-10 | VMware Workstation and Fusion contain a network denial-of-service vulnerability due to improper handling of certain IPv6 packets. VMware has evaluated the seve… |
CVE-2019-5527 | High | 8.8 | 2019-10-10 | ESXi, Workstation, Fusion, VMRC and Horizon Client contain a use-after-free vulnerability in the virtual sound device. VMware has evaluated the severity of thi… |
CVE-2019-17454 | Medium | 6.5 | 2019-10-10 | Bento4 1.5.1.0 has a NULL pointer dereference in AP4_Descriptor::GetTag in Core/Ap4Descriptor.h, related to AP4_StsdAtom::GetSampleDescription in Core/Ap4StsdA… |
CVE-2019-17453 | Medium | 6.5 | 2019-10-10 | Bento4 1.5.1.0 has a NULL pointer dereference in AP4_DescriptorListWriter::Action in Core/Ap4Descriptor.h, related to AP4_IodsAtom::WriteFields in Core/Ap4Iods… |
CVE-2019-17452 | Medium | 6.5 | 2019-10-10 | Bento4 1.5.1.0 has a NULL pointer dereference in AP4_DescriptorListInspector::Action in Core/Ap4Descriptor.h, related to AP4_IodsAtom::InspectFields in Core/Ap… |
CVE-2019-17451 | Medium | 6.5 | 2019-10-10 | An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow leading to a S… |
CVE-2019-17450 | Medium | 6.5 | 2019-10-10 | find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to ca… |
CVE-2019-17449 | Medium | 6.7 | 2019-10-10 | Avira Software Updater before 2.0.6.21094 allows a DLL side-loading attack. NOTE: The vendor thinks that this vulnerability is invalid because exploiting it wo… |
CVE-2019-17320 | Critical | 9.8 | 2019-10-10 | NetSarang XFTP Client 6.0149 and earlier version contains a buffer overflow vulnerability caused by improper boundary checks when copying file name from an att… |
CVE-2019-4265 | Low | 2.4 | 2019-10-10 | IBM Maximo Anywhere 7.6.0, 7.6.1, 7.6.2, and 7.6.3 does not have device root detection which could result in an attacker gaining sensitive information about th… |
CVE-2019-1378 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists in Windows 10 Update Assistant in the way it handles permissions.A locally authenticated attacker could run arbi… |
CVE-2019-1376 | Medium | 6.5 | 2019-10-10 | An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when it improperly enforces permissions, aka 'SQL Server Manage… |
CVE-2019-1375 | Medium | 5.4 | 2019-10-10 | A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected… |
CVE-2019-1372 | Critical | 10.0 | 2019-10-10 | An remote code execution vulnerability exists when Azure App Service/ Antares on Azure Stack fails to check the length of a buffer prior to copying memory to i… |
CVE-2019-1371 | High | 7.5 | 2019-10-10 | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerabili… |
CVE-2019-1369 | Medium | 5.5 | 2019-10-10 | An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory, aka 'Open Enclave SDK Information D… |
CVE-2019-1368 | Medium | 4.6 | 2019-10-10 | A security feature bypass exists when Windows Secure Boot improperly restricts access to debugging functionality, aka 'Windows Secure Boot Security Feature Byp… |
CVE-2019-1366 | High | 7.5 | 2019-10-10 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
CVE-2019-1365 | Critical | 9.9 | 2019-10-10 | An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it.An attacker who su… |
CVE-2019-1364 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation… |
CVE-2019-1363 | Medium | 5.5 | 2019-10-10 | An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to r… |
CVE-2019-1362 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation… |
CVE-2019-1361 | Medium | 5.5 | 2019-10-10 | An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Infor… |
CVE-2019-1359 | High | 7.8 | 2019-10-10 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2019-1358 | High | 7.8 | 2019-10-10 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex… |
CVE-2019-1357 | Medium | 4.3 | 2019-10-10 | A spoofing vulnerability exists when Microsoft Browsers improperly handle browser cookies, aka 'Microsoft Browser Spoofing Vulnerability'. This CVE ID is uniqu… |
CVE-2019-1356 | Medium | 6.5 | 2019-10-10 | An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory, aka 'Microsoft Edge based on Edge H… |
CVE-2019-1347 | Medium | 6.5 | 2019-10-10 | A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. This CVE ID is uniqu… |
CVE-2019-1346 | Medium | 6.5 | 2019-10-10 | A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. This CVE ID is uniqu… |
CVE-2019-1345 | Medium | 5.5 | 2019-10-10 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera… |
CVE-2019-1344 | Medium | 5.5 | 2019-10-10 | An information disclosure vulnerability exists in the way that the Windows Code Integrity Module handles objects in memory, aka 'Windows Code Integrity Module… |
CVE-2019-1343 | Medium | 6.5 | 2019-10-10 | A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. This CVE ID is uniqu… |
CVE-2019-1342 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles a process crash, aka 'Windows Error Reporting Manager El… |
CVE-2019-1341 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists when umpo.dll of the Power Service, improperly handles a Registry Restore Key function, aka 'Windows Power Servi… |
CVE-2019-1340 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations.To exploit the vulnerability… |
CVE-2019-1339 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevati… |
CVE-2019-1338 | Medium | 5.9 | 2019-10-10 | A security feature bypass vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLMv2 protection if a… |
CVE-2019-1337 | Medium | 5.5 | 2019-10-10 | An information disclosure vulnerability exists when Windows Update Client fails to properly handle objects in memory, aka 'Windows Update Client Information Di… |
CVE-2019-1336 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'Microsoft Windows Updat… |
CVE-2019-1335 | High | 7.5 | 2019-10-10 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
CVE-2019-1334 | Medium | 5.5 | 2019-10-10 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera… |
CVE-2019-1333 | High | 8.8 | 2019-10-10 | A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote… |
CVE-2019-1331 | High | 8.8 | 2019-10-10 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
CVE-2019-1330 | Medium | 6.5 | 2019-10-10 | An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'. This CVE ID is unique… |
CVE-2019-1329 | Medium | 5.4 | 2019-10-10 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share… |
CVE-2019-1328 | Medium | 5.4 | 2019-10-10 | A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, a… |
CVE-2019-1327 | High | 8.8 | 2019-10-10 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Rem… |
CVE-2019-1326 | High | 7.5 | 2019-10-10 | A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted… |
CVE-2019-1325 | Medium | 5.5 | 2019-10-10 | An elevation of privilege vulnerability exists in the Windows redirected drive buffering system (rdbss.sys) when the operating system improperly handles specif… |
CVE-2019-1323 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'Microsoft Windows Updat… |
CVE-2019-1322 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege Vulnerabi… |
CVE-2019-1321 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists when Windows CloudStore improperly handles file Discretionary Access Control List (DACL), aka 'Microsoft Windows… |
CVE-2019-1320 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege Vulnerabi… |
CVE-2019-1319 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of… |
CVE-2019-1318 | Medium | 5.9 | 2019-10-10 | A spoofing vulnerability exists when Transport Layer Security (TLS) accesses non- Extended Master Secret (EMS) sessions, aka 'Microsoft Windows Transport Layer… |
CVE-2019-1317 | High | 7.3 | 2019-10-10 | A denial of service vulnerability exists when Windows improperly handles hard links, aka 'Microsoft Windows Denial of Service Vulnerability'. |
CVE-2019-1316 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists in Microsoft Windows Setup when it does not properly handle privileges, aka 'Microsoft Windows Setup Elevation o… |
CVE-2019-1315 | High | 7.8 | 2019-10-10 | An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevati… |
CVE-2019-1314 | Medium | 6.8 | 2019-10-10 | A security feature bypass vulnerability exists in Windows 10 Mobile when Cortana allows a user to access files and folders through the locked screen, aka 'Wind… |
CVE-2019-1313 | Medium | 6.5 | 2019-10-10 | An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when it improperly enforces permissions, aka 'SQL Server Manage… |
CVE-2019-1311 | High | 7.8 | 2019-10-10 | A remote code execution vulnerability exists when the Windows Imaging API improperly handles objects in memory, aka 'Windows Imaging API Remote Code Execution… |
CVE-2019-1308 | High | 7.5 | 2019-10-10 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
CVE-2019-1307 | High | 7.5 | 2019-10-10 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Eng… |
CVE-2019-1239 | High | 7.5 | 2019-10-10 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'… |
CVE-2019-1238 | Medium | 6.4 | 2019-10-10 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'… |
CVE-2019-1230 | Medium | 6.8 | 2019-10-10 | An information disclosure vulnerability exists when the Windows Hyper-V Network Switch on a host operating system fails to properly validate input from an auth… |
CVE-2019-1166 | Medium | 5.9 | 2019-10-10 | A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) p… |
CVE-2019-1070 | Medium | 5.4 | 2019-10-10 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2019-1060 | High | 8.8 | 2019-10-10 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerab… |
CVE-2019-13929 | Medium | 6.5 | 2019-10-10 | A vulnerability has been identified in SIMATIC IT UADM (All versions < V1.3). An authenticated remote attacker with network access to port 1434/tcp of SIMATIC… |
CVE-2019-13921 | High | 7.5 | 2019-10-10 | A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions < SP3 Update 1). Affected versions of the software contain a vulnerability that… |
CVE-2019-10936 | High | 7.5 | 2019-10-10 | Affected devices improperly handle large amounts of specially crafted UDP packets. This could allow an unauthenticated remote attacker to trigger a denial o… |
CVE-2019-10923 | High | 7.5 | 2019-10-10 | An attacker with network access to an affected product may cause a denial of service condition by breaking the real-time synchronization (IRT) of the affected… |
CVE-2019-0608 | Medium | 4.3 | 2019-10-10 | A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content, aka 'Microsoft Browser Spoofing Vulnerability'. This CVE ID is un… |
CVE-2019-17434 | Medium | 5.4 | 2019-10-10 | LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen. |
CVE-2019-17433 | Medium | 4.8 | 2019-10-10 | z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation log" screen. |
CVE-2019-17432 | Medium | 6.5 | 2019-10-10 | An issue was discovered in fastadmin 1.0.0.20190705_beta. There is a public/admin/general.config/edit CSRF vulnerability, as demonstrated by resultant XSS via… |
CVE-2019-17431 | High | 8.8 | 2019-10-10 | An issue was discovered in fastadmin 1.0.0.20190705_beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerability. |
CVE-2019-17430 | Medium | 6.1 | 2019-10-10 | EyouCms through 2019-07-11 has XSS related to the login.php web_recordnum parameter. |
CVE-2019-17429 | Critical | 9.8 | 2019-10-10 | Adhouma CMS through 2019-10-09 has SQL Injection via the post.php p_id parameter. |
CVE-2019-17072 | Critical | 9.8 | 2019-10-10 | The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php. |