2019 CVEs (page 69)
Page 69 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-17071 | Medium | 6.1 | 2019-10-10 | The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS. |
CVE-2019-17070 | Medium | 6.1 | 2019-10-10 | The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer. |
CVE-2019-17427 | Medium | 6.1 | 2019-10-10 | In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors. |
CVE-2019-17426 | Critical | 9.1 | 2019-10-10 | Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignor… |
CVE-2019-17420 | Medium | 5.3 | 2019-10-10 | In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the http_header signature to not alert on a r… |
CVE-2019-17419 | High | 7.2 | 2019-10-10 | An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=user&c=admin_user&a=doGetUserInfo id parameter. |
CVE-2019-17418 | High | 7.2 | 2019-10-10 | An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=language&c=language_general&a=doSearchParameter appno parameter, a different is… |
CVE-2019-17417 | Medium | 4.8 | 2019-10-10 | PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs. |
CVE-2019-5700 | High | 7.8 | 2019-10-09 | NVIDIA Shield TV Experience prior to v8.0.1, NVIDIA Tegra software contains a vulnerability in the bootloader, where it does not validate the fields of the boo… |
CVE-2019-5699 | High | 7.8 | 2019-10-09 | NVIDIA Shield TV Experience prior to v8.0.1, NVIDIA Tegra bootloader contains a vulnerability where the software performs an incorrect bounds check, which may… |
CVE-2019-17415 | Critical | 9.8 | 2019-10-09 | A Structured Exception Handler (SEH) based buffer overflow in File Sharing Wizard 1.5.0 26-8-2008 allows remote unauthenticated attackers to execute arbitrary… |
CVE-2019-17414 | High | 7.5 | 2019-10-09 | tinylcy Vino through 2017-12-15 allows remote attackers to cause a denial of service ("vn_get_string error: Resource temporarily unavailable" error and daemon… |
CVE-2019-17366 | High | 8.8 | 2019-10-09 | Citrix Application Delivery Management (ADM) 12.1 before build 54.13 has Incorrect Access Control. |
CVE-2019-17365 | High | 7.8 | 2019-10-09 | Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable. |
CVE-2019-17109 | Medium | 6.5 | 2019-10-09 | Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation. |
CVE-2019-5053 | High | 7.8 | 2019-10-09 | An exploitable use-after-free vulnerability exists in the Length parsing function of NitroPDF. A specially crafted PDF can cause a type confusion, resulting in… |
CVE-2019-5050 | High | 7.8 | 2019-10-09 | A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary… |
CVE-2019-5048 | High | 7.8 | 2019-10-09 | A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary… |
CVE-2019-5047 | High | 7.8 | 2019-10-09 | An exploitable Use After Free vulnerability exists in the CharProcs parsing functionality of NitroPDF. A specially crafted PDF can cause a type confusion, resu… |
CVE-2019-5046 | High | 7.8 | 2019-10-09 | A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.522. With careful mem… |
CVE-2019-5045 | High | 7.8 | 2019-10-09 | A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.522. With careful mem… |
CVE-2019-1584 | Critical | 9.8 | 2019-10-09 | A security vulnerability exists in Zingbox Inspector version 1.293 and earlier, that allows for remote code execution if the Inspector were sent a malicious co… |
CVE-2019-15023 | High | 7.5 | 2019-10-09 | A security vulnerability exists in Zingbox Inspector versions 1.294 and earlier, that results in passwords for 3rd party integrations being stored in cleartext… |
CVE-2019-15022 | High | 7.5 | 2019-10-09 | A security vulnerability exists in Zingbox Inspector versions 1.294 and earlier, that allows for the Inspector to be susceptible to ARP spoofing. |
CVE-2019-15021 | Medium | 5.3 | 2019-10-09 | A security vulnerability exists in the Zingbox Inspector versions 1.294 and earlier, that can allow an attacker to easily identify instances of Zingbox Inspect… |
CVE-2019-15020 | Critical | 9.8 | 2019-10-09 | A security vulnerability exists in the Zingbox Inspector versions 1.293 and earlier, that could allow an attacker to supply an invalid software update image to… |
CVE-2019-15019 | Critical | 9.8 | 2019-10-09 | A security vulnerability exists in the Zingbox Inspector versions 1.294 and earlier, that could allow an attacker to supply an invalid software update image to… |
CVE-2019-15018 | High | 7.5 | 2019-10-09 | A security vulnerability exists in the Zingbox Inspector versions 1.280 and earlier, where authentication is not required when binding the Inspector instance t… |
CVE-2019-15017 | High | 8.4 | 2019-10-09 | The SSH service is enabled on the Zingbox Inspector versions 1.294 and earlier, exposing SSH to the local network. When combined with PAN-SA-2019-0027, this ca… |
CVE-2019-15016 | High | 8.8 | 2019-10-09 | An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that allows for unsanitized data provided by… |
CVE-2019-15015 | High | 8.4 | 2019-10-09 | In the Zingbox Inspector, versions 1.294 and earlier, hardcoded credentials for root and inspector user accounts are present in the system software, which can… |
CVE-2019-15014 | High | 8.8 | 2019-10-09 | A command injection vulnerability exists in the Zingbox Inspector versions 1.286 and earlier, that allows for an authenticated user to execute arbitrary system… |
CVE-2019-9535 | Critical | 9.8 | 2019-10-09 | A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker to execute arbitrary commands by providing malic… |
CVE-2019-3765 | High | 8.1 | 2019-10-09 | Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1, 2.2, 2.3 and 2.4… |
CVE-2019-17112 | Medium | 4.3 | 2019-10-09 | An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user ("Operator" access level) to access th… |
CVE-2019-16905 | High | 7.8 | 2019-10-09 | OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is con… |
CVE-2019-15715 | High | 7.2 | 2019-10-09 | MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution. |
CVE-2019-0075 | High | 7.5 | 2019-10-09 | A vulnerability in the srxpfe process on Protocol Independent Multicast (PIM) enabled SRX series devices may lead to crash of the srxpfe process and an FPC reb… |
CVE-2019-0074 | Medium | 5.5 | 2019-10-09 | A path traversal vulnerability in NFX150 Series and QFX10K Series, EX9200 Series, MX Series and PTX Series devices with Next-Generation Routing Engine (NG-RE)… |
CVE-2019-0073 | Medium | 6.6 | 2019-10-09 | The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file permissions. This may allow another user… |
CVE-2019-0072 | Medium | 5.6 | 2019-10-09 | An Unprotected Storage of Credentials vulnerability in the identity and access management certificate generation procedure allows a local attacker to gain acce… |
CVE-2019-0071 | High | 7.8 | 2019-10-09 | Veriexec is a kernel-based file integrity subsystem in Junos OS that ensures only authorized binaries are able to be executed. Due to a flaw in specific versio… |
CVE-2019-0070 | High | 8.8 | 2019-10-09 | An Improper Input Validation weakness allows a malicious local attacker to elevate their permissions to take control of other portions of the NFX platform they… |
CVE-2019-0069 | Medium | 5.9 | 2019-10-09 | On EX4600, QFX5100 Series, NFX Series, QFX10K Series, QFX5110, QFX5200 Series, QFX5110, QFX5200, QFX10K Series, vSRX, SRX1500, SRX4000 Series, vSRX, SRX1500, S… |
CVE-2019-0068 | Medium | 6.5 | 2019-10-09 | The SRX flowd process, responsible for packet forwarding, may crash and restart when processing specific multicast packets. By continuously sending the specifi… |
CVE-2019-0067 | Medium | 6.5 | 2019-10-09 | Receipt of a specific link-local IPv6 packet destined to the RE may cause the system to crash and restart (vmcore). By continuously sending a specially crafted… |
CVE-2019-0066 | High | 7.5 | 2019-10-09 | An unexpected status return value weakness in the Next-Generation Multicast VPN (NG-mVPN) service of Juniper Networks Junos OS allows attacker to cause a Denia… |
CVE-2019-0065 | Medium | 5.3 | 2019-10-09 | On MX Series, when the SIP ALG is enabled, receipt of a certain malformed SIP packet may crash the MS-PIC component on MS-MIC or MS-MPC. By continuously sendin… |
CVE-2019-0064 | High | 7.5 | 2019-10-09 | On SRX5000 Series devices, if 'set security zones security-zone <zone> tcp-rst' is configured, the flowd process may crash when a specific TCP packet is receiv… |
CVE-2019-0063 | Medium | 6.5 | 2019-10-09 | When an MX Series Broadband Remote Access Server (BRAS) is configured as a Broadband Network Gateway (BNG) with DHCPv6 enabled, jdhcpd might crash when receivi… |
CVE-2019-0062 | High | 7.5 | 2019-10-09 | A session fixation vulnerability in J-Web on Junos OS may allow an attacker to use social engineering techniques to fix and hijack a J-Web administrators web s… |
CVE-2019-0061 | High | 7.8 | 2019-10-09 | The management daemon (MGD) is responsible for all configuration and management operations in Junos OS. The Junos CLI communicates with MGD over an internal un… |
CVE-2019-0060 | High | 7.5 | 2019-10-09 | The flowd process, responsible for forwarding traffic in SRX Series services gateways, may crash and restart when processing specific transit IP packets throug… |
CVE-2019-0059 | High | 7.5 | 2019-10-09 | A memory leak vulnerability in the of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by sending specific command… |
CVE-2019-0058 | High | 7.8 | 2019-10-09 | A vulnerability in the Veriexec subsystem of Juniper Networks Junos OS allowing an attacker to fully compromise the host system. A local authenticated user can… |
CVE-2019-0057 | High | 7.8 | 2019-10-09 | An improper authorization weakness in Juniper Networks Junos OS allows a local authenticated attacker to bypass regular security controls to access the Junos D… |
CVE-2019-0056 | High | 7.5 | 2019-10-09 | This issue only affects devices with three (3) or more MPC10's installed in a single chassis with OSPF enabled and configured on the device. An Insufficient Re… |
CVE-2019-0055 | High | 7.5 | 2019-10-09 | A vulnerability in the SIP ALG packet processing service of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by se… |
CVE-2019-0054 | Medium | 6.8 | 2019-10-09 | An Improper Certificate Validation weakness in the SRX Series Application Identification (app-id) signature update client of Juniper Networks Junos OS allows a… |
CVE-2019-0051 | Medium | 6.5 | 2019-10-09 | SSL-Proxy feature on SRX devices fails to handle a hardware resource limitation which can be exploited by remote SSL/TLS servers to crash the flowd daemon. Rep… |
CVE-2019-0050 | High | 7.5 | 2019-10-09 | Under certain heavy traffic conditions srxpfe process can crash and result in a denial of service condition for the SRX1500 device. Repeated crashes of the srx… |
CVE-2019-0047 | High | 8.8 | 2019-10-09 | A persistent Cross-Site Scripting (XSS) vulnerability in Junos OS J-Web interface may allow remote unauthenticated attackers to perform administrative actions… |
CVE-2019-5507 | Medium | 5.5 | 2019-10-09 | SnapManager for Oracle prior to version 3.4.2P1 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive info… |
CVE-2019-5506 | Medium | 5.9 | 2019-10-09 | Clustered Data ONTAP versions 9.0 and higher do not enforce hostname verification under certain circumstances making them susceptible to impersonation via man-… |
CVE-2019-17402 | Medium | 6.5 | 2019-10-09 | Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int… |
CVE-2019-17401 | Low | 3.3 | 2019-10-09 | libyal liblnk 20191006 has a heap-based buffer over-read in the network_share_name_offset>20 code block of liblnk_location_information_read_data in liblnk_loca… |
CVE-2019-17092 | Medium | 6.1 | 2019-10-09 | An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the… |
CVE-2019-17399 | Critical | 9.8 | 2019-10-09 | The Shack Forms Pro extension before 4.0.32 for Joomla! allows path traversal via a file attachment. |
CVE-2019-17389 | High | 7.5 | 2019-10-09 | In RIOT 2019.07, the MQTT-SN implementation (asymcute) mishandles errors occurring during a read operation on a UDP socket. The receive loop ends. This allows… |
CVE-2019-6471 | Medium | 5.9 | 2019-10-09 | A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affect… |
CVE-2019-6469 | High | 7.5 | 2019-10-09 | An error in the EDNS Client Subnet (ECS) feature for recursive resolvers can cause BIND to exit with an assertion failure when processing a response that has m… |
CVE-2019-6468 | High | 7.5 | 2019-10-09 | In BIND Supported Preview Edition, an error in the nxdomain-redirect feature can occur in versions which support EDNS Client Subnet (ECS) features. In those ve… |
CVE-2019-6467 | High | 7.5 | 2019-10-09 | A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descen… |
CVE-2019-6465 | Medium | 5.3 | 2019-10-09 | Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-… |
CVE-2019-4558 | High | 7.8 | 2019-10-09 | A security vulnerability has been identified in all levels of IBM Spectrum Scale V5.0.0.0 through V5.0.3.2 and IBM Spectrum Scale V4.2.0.0 through V4.2.3.17 th… |
CVE-2019-4512 | Medium | 4.3 | 2019-10-09 | IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in further attacks against the system. IB… |
CVE-2019-3653 | Medium | 4.6 | 2019-10-09 | Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to gain acc… |
CVE-2019-3652 | Medium | 5.0 | 2019-10-09 | Code Injection vulnerability in EPSetup.exe in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to get their malicious code… |
CVE-2019-17385 | Medium | 6.1 | 2019-10-09 | The animate-it plugin before 2.3.5 for WordPress has XSS. |
CVE-2019-17384 | Medium | 6.1 | 2019-10-09 | The animate-it plugin before 2.3.4 for WordPress has XSS. |
CVE-2019-17383 | Critical | 9.8 | 2019-10-09 | The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem. |
CVE-2019-17380 | Medium | 6.1 | 2019-10-09 | cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528). |
CVE-2019-17379 | Medium | 6.1 | 2019-10-09 | cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527). |
CVE-2019-17378 | Medium | 6.1 | 2019-10-09 | cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526). |
CVE-2019-17377 | Medium | 6.1 | 2019-10-09 | cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524). |
CVE-2019-17376 | Medium | 6.1 | 2019-10-09 | cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521). |
CVE-2019-17375 | High | 8.8 | 2019-10-09 | cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517). |
CVE-2019-17128 | High | 7.5 | 2019-10-09 | Netreo OmniCenter through 12.1.1 allows unauthenticated SQL Injection (Boolean Based Blind) in the redirect parameters and parameter name of the login page thr… |
CVE-2019-17124 | Critical | 9.8 | 2019-10-09 | Kramer VIAware 2.5.0719.1034 has Incorrect Access Control. |
CVE-2019-15859 | Critical | 9.8 | 2019-10-09 | Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get full access to a device via the /passwor… |
CVE-2019-15226 | High | 7.5 | 2019-10-09 | Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a m… |
CVE-2019-14808 | Medium | 6.8 | 2019-10-09 | An issue was discovered in the RENPHO application 3.0.0 for iOS. It transmits JSON data unencrypted to a server without an integrity check, if a user changes p… |
CVE-2019-13529 | High | 8.8 | 2019-10-09 | An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on t… |
CVE-2019-11341 | Medium | 4.6 | 2019-10-09 | On certain Samsung P(9.0) phones, an attacker with physical access can start a TCP Dump capture without the user's knowledge. This feature of the Service Mode… |
CVE-2019-11212 | Medium | 6.3 | 2019-10-09 | The MDM server component of TIBCO Software Inc's TIBCO MDM contains multiple vulnerabilities that theoretically allow an authenticated user with specific roles… |
CVE-2019-17382 | Critical | 9.1 | 2019-10-09 | An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard… |
CVE-2019-17373 | Critical | 9.8 | 2019-10-09 | Certain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg, such as by appending ?x=1.jpg to a URL… |
CVE-2019-17372 | High | 8.1 | 2019-10-09 | Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for ex… |
CVE-2019-17371 | Medium | 6.5 | 2019-10-09 | gif2png 2.5.13 has a memory leak in the writefile function. |
CVE-2019-17370 | High | 7.2 | 2019-10-09 | OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFile_deal.php blocks "into outfile" in a SELECT statement, but does not block the "into/*… |