2019 CVEs (page 7)
Page 7 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-25152 | High | 7.2 | 2023-06-22 | The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple… |
CVE-2019-25136 | Critical | 10.0 | 2023-06-19 | A compromised child process could have injected XBL Bindings into privileged CSS rules, resulting in arbitrary code execution and a sandbox escape. This vulner… |
CVE-2019-16283 | High | 7.8 | 2023-06-09 | A potential security vulnerability has been identified with a version of the HP Softpaq installer that can lead to arbitrary code execution. |
CVE-2019-25151 | Medium | 5.4 | 2023-06-07 | The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin function in versions up… |
CVE-2019-25150 | High | 8.8 | 2023-06-07 | The Email Templates plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.3. This makes it possible for attackers to present… |
CVE-2019-25149 | High | 7.6 | 2023-06-07 | The Gallery Images Ape plugin for WordPress is vulnerable to Arbitrary Plugin Deactivation in versions up to, and including, 2.0.6. This allows authenticated a… |
CVE-2019-25148 | Medium | 6.1 | 2023-06-07 | The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.9.0.3 due to insufficient input sanitization. This ma… |
CVE-2019-25147 | High | 7.2 | 2023-06-07 | The Pretty Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various IP headers as well as the referer header in versions up to, and… |
CVE-2019-25146 | High | 7.2 | 2023-06-07 | The DELUCKS SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the saveSettings() function that had no capability checks in versions up… |
CVE-2019-25145 | High | 7.2 | 2023-06-07 | The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in version… |
CVE-2019-25144 | Medium | 5.4 | 2023-06-07 | The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.2.10 due to insufficient input sanitization. This mak… |
CVE-2019-25143 | Medium | 5.4 | 2023-06-07 | The GDPR Cookie Compliance plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the gdpr_cookie_compliance_reset_set… |
CVE-2019-25142 | High | 8.8 | 2023-06-07 | The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172… |
CVE-2019-25141 | Critical | 9.8 | 2023-06-07 | The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks o… |
CVE-2019-25140 | High | 7.2 | 2023-06-07 | The WordPress Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logo_width, logo_height, rcsp_logo_… |
CVE-2019-25139 | Medium | 6.5 | 2023-06-07 | The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthenticated settings reset in versions up to, and including 1.8.1 due to miss… |
CVE-2019-25138 | Critical | 9.8 | 2023-06-07 | The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the usp_check_images function in v… |
CVE-2019-19791 | Critical | 9.8 | 2023-05-29 | In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/REST endpoints (when s… |
CVE-2019-25137 | High | 7.2 | 2023-05-18 | Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/… |
CVE-2019-14944 | Medium | 6.5 | 2023-04-16 | An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows injection of command… |
CVE-2019-14942 | Medium | 5.9 | 2023-04-16 | An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Cookies for GitLab Pages (which ha… |
CVE-2019-8963 | High | 7.5 | 2023-03-29 | A Denial of Service (DoS) vulnerability was discovered in FlexNet Publisher's lmadmin 11.16.5, when doing a crafted POST request on lmadmin using the web-based… |
CVE-2019-8720 | High | 8.8 | 2023-03-06 | A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved… |
CVE-2019-25105 | Low | 3.5 | 2023-02-26 | A vulnerability, which was classified as problematic, was found in dro.pm. This affects an unknown part of the file web/fileman.php. The manipulation of the ar… |
CVE-2019-25104 | Low | 3.5 | 2023-02-20 | A vulnerability has been found in rtcwcoop 1.0.2 and classified as problematic. Affected by this vulnerability is the function AICast_ScriptLoad of the file co… |
CVE-2019-17003 | Medium | 6.1 | 2023-02-16 | Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed. |
CVE-2019-25103 | Medium | 4.3 | 2023-02-12 | A vulnerability has been found in simple-markdown 0.5.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file s… |
CVE-2019-25102 | Medium | 4.3 | 2023-02-12 | A vulnerability, which was classified as problematic, was found in simple-markdown 0.6.0. Affected is an unknown function of the file simple-markdown.js. The m… |
CVE-2019-25101 | Medium | 6.3 | 2023-02-04 | A vulnerability classified as critical has been found in OnShift TurboGears 1.0.11.10. This affects an unknown part of the file turbogears/controllers.py of th… |
CVE-2019-25053 | High | 7.5 | 2023-01-27 | A path traversal vulnerability exists in Sage FRP 1000 before November 2019. This allows remote unauthenticated attackers to access files outside of the web tr… |
CVE-2019-25100 | Medium | 5.5 | 2023-01-08 | A vulnerability was found in happyman twmap. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file twmap3/da… |
CVE-2019-25099 | Medium | 5.5 | 2023-01-06 | A vulnerability classified as critical was found in Arthmoor QSF-Portal. This vulnerability affects unknown code of the file index.php. The manipulation of the… |
CVE-2019-25098 | Medium | 5.5 | 2023-01-05 | A vulnerability was found in soerennb eXtplorer up to 2.1.12. It has been classified as critical. This affects an unknown part of the file include/archive.php… |
CVE-2019-25097 | Medium | 5.5 | 2023-01-05 | A vulnerability was found in soerennb eXtplorer up to 2.1.12 and classified as critical. Affected by this issue is some unknown functionality of the component… |
CVE-2019-25096 | Low | 3.5 | 2023-01-05 | A vulnerability has been found in soerennb eXtplorer up to 2.1.12 and classified as problematic. Affected by this vulnerability is an unknown functionality. Th… |
CVE-2019-25095 | Low | 3.5 | 2023-01-05 | A vulnerability, which was classified as problematic, was found in kakwa LdapCherry up to 0.x. Affected is an unknown function of the component URL Handler. Th… |
CVE-2019-25094 | Low | 3.5 | 2023-01-04 | A vulnerability, which was classified as problematic, was found in innologi appointments Extension up to 2.0.5 on TYPO3. This affects an unknown part of the co… |
CVE-2019-13768 | High | 7.4 | 2023-01-02 | Use after free in FileAPI in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Ch… |
CVE-2019-25093 | Low | 2.4 | 2023-01-02 | A vulnerability, which was classified as problematic, was found in dragonexpert Recent Threads on Index. Affected is the function recentthread_list_threads of… |
CVE-2019-25092 | Low | 2.4 | 2022-12-28 | A vulnerability classified as problematic was found in Nakiami Mellivora up to 2.1.x. Affected by this vulnerability is the function print_user_ip_log of the f… |
CVE-2019-25091 | Low | 3.7 | 2022-12-27 | A vulnerability classified as problematic has been found in nsupdate.info. This affects an unknown part of the file src/nsupdate/settings/base.py of the compon… |
CVE-2019-25073 | High | 7.5 | 2022-12-27 | Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory. |
CVE-2019-25072 | High | 7.5 | 2022-12-27 | Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a sig… |
CVE-2019-25090 | Low | 3.5 | 2022-12-27 | A vulnerability was found in FreePBX arimanager up to 13.0.5.3 and classified as problematic. Affected by this issue is some unknown functionality of the compo… |
CVE-2019-25089 | Low | 3.1 | 2022-12-27 | A vulnerability has been found in Morgawr Muon 0.1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file src/… |
CVE-2019-25088 | Low | 3.5 | 2022-12-27 | A vulnerability was found in ytti Oxidized Web. It has been classified as problematic. Affected is an unknown function of the file lib/oxidized/web/views/conf_… |
CVE-2019-25087 | Medium | 5.3 | 2022-12-27 | A vulnerability was found in RamseyK httpserver. It has been rated as critical. This issue affects the function ResourceHost::getResource of the file src/Resou… |
CVE-2019-25086 | Low | 3.5 | 2022-12-27 | A vulnerability was found in IET-OU Open Media Player up to 1.5.0. It has been declared as problematic. This vulnerability affects the function webvtt of the f… |
CVE-2019-19030 | Medium | 5.3 | 2022-12-26 | Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP… |
CVE-2019-11851 | Critical | 9.8 | 2022-12-26 | The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows remote attackers to… |
CVE-2019-19705 | High | 7.8 | 2022-12-26 | Realtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8, 20BS, and 20BT before 6.0.8882.1 and 20KH and 20KG before 6.0.8907.1 (a… |
CVE-2019-18177 | Medium | 6.5 | 2022-12-26 | In certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is a configured SSL VPN endpoint. This affects Citri… |
CVE-2019-14802 | Medium | 5.3 | 2022-12-26 | HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template rendering, aka GHSA-6hv3-7c… |
CVE-2019-13988 | Medium | 6.5 | 2022-12-26 | Sierra Wireless MGOS before 3.15.2 and 4.x before 4.3 allows attackers to read log files via a Direct Request (aka Forced Browsing). |
CVE-2019-9579 | High | 8.1 | 2022-12-26 | An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other products. The SMB server allows an attacker to have unintended access, e.g… |
CVE-2019-9011 | Medium | 5.3 | 2022-12-26 | In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid usernames. |
CVE-2019-25085 | Medium | 6.3 | 2022-12-26 | A vulnerability was found in GNOME gvdb. It has been classified as critical. This affects the function gvdb_table_write_contents_async of the file gvdb-builder… |
CVE-2019-25084 | Low | 3.5 | 2022-12-25 | A vulnerability, which was classified as problematic, has been found in Hide Files on GitHub up to 2.x. This issue affects the function addEventListener of the… |
CVE-2019-25078 | Medium | 5.3 | 2022-12-13 | A vulnerability classified as problematic was found in pacparser up to 1.3.x. Affected by this vulnerability is the function pacparser_find_proxy of the file s… |
CVE-2019-18265 | Medium | 4.7 | 2022-11-30 | Digital Alert Systems’ DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrar… |
CVE-2019-14841 | High | 8.8 | 2022-10-17 | A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header. This flaw allows an attacker to gain admin… |
CVE-2019-14840 | High | 7.5 | 2022-10-17 | A flaw was found in the RHDM, where sensitive HTML form fields like Password has auto-complete enabled which may lead to leak of credentials. |
CVE-2019-5797 | High | 7.5 | 2022-09-29 | Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2019-5641 | Low | 3.3 | 2022-09-21 | Rapid7 InsightVM suffers from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the Inspect Eleme… |
CVE-2019-25076 | Medium | 5.8 | 2022-09-08 | The TSS (Tuple Space Search) algorithm in Open vSwitch 2.x through 2.17.2 and 3.0.0 allows remote attackers to cause a denial of service (delays of legitimate… |
CVE-2019-15167 | Critical | 9.1 | 2022-08-27 | The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 3, a different vulnerability than CVE-2018-14463. |
CVE-2019-25075 | Medium | 6.1 | 2022-08-23 | HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a… |
CVE-2019-10800 | Medium | 6.5 | 2022-07-13 | This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method. |
CVE-2019-10761 | High | 8.3 | 2022-07-13 | This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the… |
CVE-2019-25071 | Medium | 6.3 | 2022-06-25 | A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video fil… |
CVE-2019-12359 | High | 7.2 | 2022-06-17 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/ztliuyan_sendmail.php (when the attacker has admin authority) via the i… |
CVE-2019-12358 | High | 8.8 | 2022-06-17 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendsms.php (when the attacker has dls_print authority) via a dlid cook… |
CVE-2019-12357 | High | 7.2 | 2022-06-17 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/deluser.php (when the attacker has admin authority) via the id paramete… |
CVE-2019-12356 | High | 8.8 | 2022-06-17 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /user/dls_download.php (when the attacker has dls_download authority) via the… |
CVE-2019-12355 | High | 8.8 | 2022-06-17 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /user/dls_print.php (when the attacker has dls_print authority) via the id par… |
CVE-2019-12354 | High | 7.2 | 2022-06-17 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/showbad.php (when the attacker has admin authority) via the id paramete… |
CVE-2019-12353 | High | 7.2 | 2022-06-17 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/dl_sendmail.php (when the attacker has admin authority) via the id para… |
CVE-2019-12352 | High | 8.8 | 2022-06-17 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendmail.php (when the attacker has dls_print authority) via a dlid coo… |
CVE-2019-4575 | Critical | 9.8 | 2022-06-15 | IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.9 is vulnerable to SQL injection. A remote attacker could send spec… |
CVE-2019-25070 | Low | 3.5 | 2022-06-09 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in WolfCMS up to 0.8.3.1. It has been rated as problematic. This issue affects some unknown processin… |
CVE-2019-25069 | Medium | 5.3 | 2022-06-09 | A vulnerability, which was classified as problematic, has been found in Axios Italia Axios RE 1.7.0/7.0.0. This issue affects some unknown processing of the co… |
CVE-2019-25068 | Medium | 6.3 | 2022-06-09 | A vulnerability classified as critical was found in Axios Italia Axios RE 1.7.0/7.0.0. This vulnerability affects unknown code of the file REDefault.aspx of th… |
CVE-2019-25067 | Medium | 6.3 | 2022-06-09 | A vulnerability, which was classified as critical, was found in Podman and Varlink 1.5.1. This affects an unknown part of the component API. The manipulation l… |
CVE-2019-25066 | Medium | 6.3 | 2022-06-09 | A vulnerability has been found in ajenti 2.1.31 and classified as critical. This vulnerability affects unknown code of the component API. The manipulation lead… |
CVE-2019-25065 | Medium | 6.3 | 2022-06-09 | A vulnerability was found in OpenNetAdmin 18.1.1. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads t… |
CVE-2019-25064 | Medium | 4.3 | 2022-06-09 | A vulnerability was found in CoreHR Core Portal up to 27.0.7. It has been classified as problematic. Affected is an unknown function. The manipulation leads to… |
CVE-2019-25063 | Medium | 5.3 | 2022-06-08 | A vulnerability was found in Sricam IP CCTV Camera. It has been classified as critical. Affected is an unknown function of the component Device Viewer. The man… |
CVE-2019-25062 | Medium | 5.3 | 2022-06-08 | A vulnerability was found in Sricam IP CCTV Camera and classified as critical. This issue affects some unknown processing of the component Device Viewer. The m… |
CVE-2019-9972 | High | 8.8 | 2022-06-07 | PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands with the phonesyste… |
CVE-2019-9971 | High | 8.8 | 2022-06-07 | PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an attacker to gain root privileges by using sudo with the tcpdump comm… |
CVE-2019-12351 | Critical | 9.8 | 2022-06-02 | An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_print.php via an id parameter value with a trailing comma. |
CVE-2019-12350 | Critical | 9.8 | 2022-06-02 | An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_download.php via an id parameter value with a trailing comma. |
CVE-2019-12349 | Critical | 9.8 | 2022-06-02 | An issue was discovered in zzcms 2019. SQL Injection exists in /admin/dl_sendsms.php via the id parameter. |
CVE-2019-25061 | High | 7.5 | 2022-05-18 | The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature… |
CVE-2019-25060 | Medium | 5.3 | 2022-05-09 | The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a r… |
CVE-2019-12254 | Critical | 9.8 | 2022-05-06 | In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for savi… |
CVE-2019-25059 | High | 7.8 | 2022-04-25 | Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839. |
CVE-2019-6834 | High | 7.3 | 2022-04-13 | A CWE-502: Deserialization of Untrusted Data vulnerability exists which could allow an attacker to execute arbitrary code on the targeted system with SYSTEM pr… |
CVE-2019-14839 | High | 7.5 | 2022-04-01 | It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password when intercepted using… |
CVE-2019-9564 | High | 7.5 | 2022-03-30 | A vulnerability in the authentication logic of Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to bypass login and control the devices. This issue affects… |