2019 CVEs (page 71)
Page 71 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-17298 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Administration module by a Developer user. |
CVE-2019-17297 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular user. |
CVE-2019-17296 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Contacts module by a Regular user. |
CVE-2019-17295 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the history function by a Regular user. |
CVE-2019-17294 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the export function by a Regular user. |
CVE-2019-17293 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Project module by a Regular user. |
CVE-2019-17292 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by an Admin user. |
CVE-2019-17042 | Critical | 9.8 | 2019-10-07 | An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to… |
CVE-2019-17041 | Critical | 9.8 | 2019-10-07 | An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parse… |
CVE-2019-15894 | Medium | 6.8 | 2019-10-07 | An issue was discovered in Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.3.x through 3.3.1. An attacker who uses… |
CVE-2019-17319 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Emails module by a Regular user. |
CVE-2019-17318 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by a Regular user. |
CVE-2019-17317 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user. |
CVE-2019-17316 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user. |
CVE-2019-17315 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user. |
CVE-2019-12812 | Critical | 9.8 | 2019-10-07 | MyBuilder viewer before 6.2.2019.814 allow an attacker to execute arbitrary command via specifically crafted configuration file. This can be leveraged for code… |
CVE-2019-12811 | Critical | 9.8 | 2019-10-07 | ActiveX Control in MyBuilder before 6.2.2019.814 allow an attacker to execute arbitrary command via the ShellOpen method. This can be leveraged for code execut… |
CVE-2019-3688 | Medium | 5.1 | 2019-10-07 | The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 1… |
CVE-2019-16263 | High | 7.4 | 2019-10-07 | The Twitter Kit framework through 3.4.2 for iOS does not properly validate the api.twitter.com SSL certificate. Although the certificate chain must contain one… |
CVE-2019-15751 | Critical | 9.8 | 2019-10-07 | An unrestricted file upload vulnerability in SITOS six Build v6.2.1 allows remote attackers to execute arbitrary code by uploading a SCORM file with an executa… |
CVE-2019-15750 | Medium | 6.1 | 2019-10-07 | A Cross-Site Scripting (XSS) vulnerability in the blog function in SITOS six Build v6.2.1 allows remote attackers to inject arbitrary web script or HTML via th… |
CVE-2019-15749 | Medium | 6.5 | 2019-10-07 | SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confirm the change with their old password… |
CVE-2019-15748 | Critical | 9.8 | 2019-10-07 | SITOS six Build v6.2.1 permits unauthorised users to upload and import a SCORM 2004 package by browsing directly to affected pages. An unauthenticated attacker… |
CVE-2019-15747 | High | 8.8 | 2019-10-07 | SITOS six Build v6.2.1 allows a user with the user role of Seminar Coordinator to escalate their permission to the Systemadministrator role due to insufficient… |
CVE-2019-15746 | Critical | 9.8 | 2019-10-07 | SITOS six Build v6.2.1 allows an attacker to inject arbitrary PHP commands. As a result, an attacker can compromise the running server and execute system comma… |
CVE-2019-17269 | Critical | 9.8 | 2019-10-07 | Intellian Remote Access 3.18 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the Ping Test field. |
CVE-2019-17267 | Critical | 9.8 | 2019-10-07 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLo… |
CVE-2019-17266 | Critical | 9.8 | 2019-10-06 | libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly check an… |
CVE-2019-17264 | Low | 3.3 | 2019-10-06 | In libyal liblnk before 20191006, liblnk_location_information_read_data in liblnk_location_information.c has a heap-based buffer over-read because an incorrect… |
CVE-2019-17263 | Low | 3.3 | 2019-10-06 | In libyal libfwsi before 20191006, libfwsi_extension_block_copy_from_byte_stream in libfwsi_extension_block.c has a heap-based buffer over-read because rejecti… |
CVE-2019-17240 | Critical | 9.8 | 2019-10-06 | bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Cl… |
CVE-2019-17226 | Medium | 4.8 | 2019-10-06 | CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field. |
CVE-2019-17225 | Medium | 5.4 | 2019-10-06 | Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue. |
CVE-2019-17219 | High | 8.8 | 2019-10-06 | An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the device does not enforce any authentication… |
CVE-2019-17218 | Critical | 9.1 | 2019-10-06 | An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the communication to the web service is unencryp… |
CVE-2019-17217 | High | 8.8 | 2019-10-06 | An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no CSRF protection established on the web service. |
CVE-2019-17216 | Critical | 9.8 | 2019-10-06 | An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. Password authentication uses MD5 to hash passwords. Cracking… |
CVE-2019-17215 | Critical | 9.8 | 2019-10-06 | An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no bruteforce protection (e.g., lockout) establishe… |
CVE-2019-17214 | High | 7.5 | 2019-10-06 | The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending &cc=1 to a URI. |
CVE-2019-17213 | Medium | 6.1 | 2019-10-06 | The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header. |
CVE-2019-17206 | Critical | 9.8 | 2019-10-05 | Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper (aka Redis Wrapper) before 0.3.0 allows attackers to execute arbitrary… |
CVE-2019-17205 | Medium | 6.1 | 2019-10-05 | TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins… |
CVE-2019-17204 | Medium | 5.4 | 2019-10-05 | TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item. |
CVE-2019-17203 | Medium | 5.4 | 2019-10-05 | TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder. |
CVE-2019-17199 | High | 7.5 | 2019-10-05 | www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal (for reading arbitrary files) because of an unanchored regular expression, as de… |
CVE-2019-17197 | Critical | 9.8 | 2019-10-05 | OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patient.inc. |
CVE-2019-17192 | Critical | 9.8 | 2019-10-05 | The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to… |
CVE-2019-17191 | High | 7.5 | 2019-10-05 | The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a conne… |
CVE-2019-17184 | Critical | 9.8 | 2019-10-04 | Xerox AtlaLink B8045/B8055/B8065/B8075/B8090 C8030/C8035/C8045/C8055/C8070 printers with software before 101.00x.089.22600 allow an attacker to gain privileges. |
CVE-2019-17188 | High | 7.2 | 2019-10-04 | An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. An attacker can bypass a front-end restri… |
CVE-2019-16865 | High | 7.5 | 2019-10-04 | An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memor… |
CVE-2019-17183 | High | 7.5 | 2019-10-04 | Foxit Reader before 9.7 allows an Access Violation and crash if insufficient memory exists. |
CVE-2019-17180 | High | 7.8 | 2019-10-04 | Valve Steam Client before 2019-09-12 allows placing or appending partially controlled filesystem content, as demonstrated by file modifications on Windows in t… |
CVE-2019-11656 | Medium | 5.4 | 2019-10-04 | Stored XSS vulnerability in Micro Focus ArcSight Logger, affects versions prior to Logger 6.7.1 HotFix 6.7.1.8262.0. This vulnerability could allow Improper Ne… |
CVE-2019-11655 | High | 8.8 | 2019-10-04 | Unrestricted file upload vulnerability in Micro Focus ArcSight Logger, version 6.7.0 and later. This vulnerability could allow Unrestricted Upload of File with… |
CVE-2019-6015 | High | 7.5 | 2019-10-04 | FON2601E-SE, FON2601E-RE, FON2601E-FSW-S, and FON2601E-FSW-B with firmware versions 1.1.7 and earlier contain an issue where they may behave as open resolvers… |
CVE-2019-17179 | Medium | 6.1 | 2019-10-04 | 4.1.0, 4.1.1, 4.1.2, 4.1.2.3, 4.1.2.6, 4.1.2.7, 4.2.0, 4.2.1, 4.2.2, 5.0.0, 5.0.0.5, 5.0.0.6, 5.0.1, 5.0.1.1, 5.0.1.2, 5.0.1.3, 5.0.1.4, 5.0.1.5, 5.0.1.6, 5.0… |
CVE-2019-6776 | High | 7.8 | 2019-10-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to… |
CVE-2019-6775 | High | 7.8 | 2019-10-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exp… |
CVE-2019-6774 | High | 7.8 | 2019-10-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.4.1.16828. User interaction is required to exp… |
CVE-2019-13320 | High | 7.8 | 2019-10-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exp… |
CVE-2019-13319 | High | 7.8 | 2019-10-04 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exp… |
CVE-2019-13318 | Medium | 5.5 | 2019-10-04 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 9.5.0.20723. User interaction is require… |
CVE-2019-13317 | High | 7.8 | 2019-10-04 | This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to… |
CVE-2019-13316 | High | 7.8 | 2019-10-04 | This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to… |
CVE-2019-13315 | High | 7.8 | 2019-10-04 | This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to expl… |
CVE-2019-17178 | High | 7.5 | 2019-10-04 | HuffmanTree_makeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as used in WinPR in FreeRDP and other products, has a memory leak because a supplie… |
CVE-2019-17177 | High | 7.5 | 2019-10-04 | libfreerdp/codec/region.c in FreeRDP through 1.1.x and 2.x through 2.0.0-rc4 has memory leaks because a supplied realloc pointer (i.e., the first argument to r… |
CVE-2019-17175 | High | 7.5 | 2019-10-04 | joyplus-cms 1.6.0 allows manager/admin_pic.php?rootpath= absolute path traversal. |
CVE-2019-4564 | Medium | 6.1 | 2019-10-04 | IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScrip… |
CVE-2019-4514 | Medium | 5.3 | 2019-10-04 | IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 discloses sensitive information to unauthorized users. The information can be used to mount further… |
CVE-2019-4227 | High | 7.3 | 2019-10-04 | IBM MQ 8.0.0.4 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 AMQP Listeners could allow an unauthorized user to conduct a session fixatio… |
CVE-2019-16891 | Critical | 9.8 | 2019-10-04 | Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload. |
CVE-2019-17133 | Critical | 9.8 | 2019-10-04 | In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a long SSID IE, leading to a Buffer Overflow. |
CVE-2019-17132 | Critical | 9.8 | 2019-10-04 | vBulletin through 5.5.4 mishandles custom avatars. |
CVE-2019-17131 | Medium | 4.3 | 2019-10-04 | vBulletin before 5.5.4 allows clickjacking. |
CVE-2019-17130 | Medium | 6.5 | 2019-10-04 | vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories. |
CVE-2019-17121 | Medium | 5.4 | 2019-10-04 | REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values. |
CVE-2019-17113 | Critical | 9.8 | 2019-10-04 | In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmod… |
CVE-2019-13332 | High | 7.8 | 2019-10-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25114. User interaction is required to exp… |
CVE-2019-13331 | High | 7.8 | 2019-10-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exp… |
CVE-2019-13330 | High | 7.8 | 2019-10-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exp… |
CVE-2019-13329 | High | 7.8 | 2019-10-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5. User interaction is required to exploit thi… |
CVE-2019-13328 | High | 7.8 | 2019-10-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exp… |
CVE-2019-13327 | High | 7.8 | 2019-10-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exp… |
CVE-2019-13326 | High | 7.8 | 2019-10-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exp… |
CVE-2019-13325 | High | 7.8 | 2019-10-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.909. User interaction is required to… |
CVE-2019-13324 | High | 7.8 | 2019-10-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.909. User interaction is required to… |
CVE-2019-13323 | High | 7.8 | 2019-10-03 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.909. User interaction is required to… |
CVE-2019-11932 | High | 8.8 | 2019-10-03 | A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android… |
CVE-2019-16198 | Medium | 6.5 | 2019-10-03 | KSLabs KSWEB 3.93 allows ../ directory traversal, as demonstrated by the hostFile parameter. |
CVE-2019-15766 | High | 8.8 | 2019-10-03 | The KSLABS KSWEB (aka ru.kslabs.ksweb) application 3.93 for Android allows authenticated remote code execution via a POST request to the AJAX handler with the… |
CVE-2019-16328 | High | 7.5 | 2019-10-03 | In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC ser… |
CVE-2019-16931 | Medium | 6.1 | 2019-10-03 | A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or oth… |
CVE-2019-16866 | High | 7.5 | 2019-10-03 | Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the q… |
CVE-2019-15165 | Medium | 5.3 | 2019-10-03 | sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. |
CVE-2019-15164 | Medium | 5.3 | 2019-10-03 | rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source. |
CVE-2019-15163 | High | 7.5 | 2019-10-03 | rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daemon crash) if a crypt() call fails. |
CVE-2019-15162 | Medium | 5.3 | 2019-10-03 | rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which might make it easier for attackers to… |
CVE-2019-15161 | Medium | 5.3 | 2019-10-03 | rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse of a variable. This may open up an attack vector involving extra data… |