2019 CVEs (page 72)
Page 72 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-15166 | Low | 1.6 | 2019-10-03 | lmp_print_data_link_subobjs() in print-lmp.c in tcpdump before 4.9.3 lacks certain bounds checks. |
CVE-2019-4441 | Medium | 5.3 | 2019-10-03 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned i… |
CVE-2019-4422 | High | 8.8 | 2019-10-03 | IBM Security Guardium 9.0, 9.5, and 10.6 are vulnerable to a privilege escalation which could allow an authenticated user to change the accessmgr password. IBM… |
CVE-2019-3834 | High | 7.3 | 2019-10-03 | It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader propert… |
CVE-2019-15809 | Medium | 4.7 | 2019-10-03 | Smart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, contain a timing side channel in ECDSA signature gene… |
CVE-2019-13629 | Medium | 5.9 | 2019-10-03 | MatrixSSL 4.2.1 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or a remote attacker, able to measure the duratio… |
CVE-2019-13628 | Medium | 4.7 | 2019-10-03 | wolfSSL and wolfCrypt 4.0.0 and earlier (when configured without --enable-fpecc, --enable-sp, or --enable-sp-math) contain a timing side channel in ECDSA signa… |
CVE-2019-11651 | Medium | 6.1 | 2019-10-02 | Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server, all versions prior to version 3.0 Patch Update 20, version 4.0 Patch Update 12, and ve… |
CVE-2019-1915 | Medium | 6.5 | 2019-10-02 | A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisc… |
CVE-2019-16407 | High | 7.3 | 2019-10-02 | JetBrains ReSharper installers for versions before 2019.2 had a DLL Hijacking vulnerability. |
CVE-2019-16171 | Medium | 6.1 | 2019-10-02 | In JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page. |
CVE-2019-15272 | Medium | 6.5 | 2019-10-02 | A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) co… |
CVE-2019-15259 | Medium | 6.1 | 2019-10-02 | A vulnerability in Cisco Unified Contact Center Express (UCCX) Software could allow an unauthenticated, remote attacker to conduct an HTTP response splitting a… |
CVE-2019-15256 | High | 8.6 | 2019-10-02 | A vulnerability in the Internet Key Exchange version 1 (IKEv1) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (… |
CVE-2019-15040 | High | 8.8 | 2019-10-02 | JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page. |
CVE-2019-15037 | Medium | 6.1 | 2019-10-02 | An issue was discovered in JetBrains TeamCity 2018.2.4. It had several XSS vulnerabilities on the settings pages. The issues were fixed in TeamCity 2019.1. |
CVE-2019-15036 | High | 7.2 | 2019-10-02 | An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could execute any command on the server machine. The issue was fixed i… |
CVE-2019-14959 | Medium | 5.9 | 2019-10-02 | JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection. |
CVE-2019-14958 | High | 7.5 | 2019-10-02 | JetBrains PyCharm before 2019.2 was allocating a buffer of unknown size for one of the connection processes. In a very specific situation, it could lead to a r… |
CVE-2019-14956 | Medium | 4.3 | 2019-10-02 | JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names. |
CVE-2019-13957 | Critical | 9.8 | 2019-10-02 | In Umbraco 7.3.8, there is SQL Injection in the backoffice/PageWApprove/PageWApproveApi/GetInpectSearch method via the nodeName parameter. |
CVE-2019-12737 | Medium | 5.3 | 2019-10-02 | UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials. |
CVE-2019-12736 | Critical | 9.8 | 2019-10-02 | JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command injection. |
CVE-2019-12716 | Medium | 6.1 | 2019-10-02 | A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) co… |
CVE-2019-12715 | Medium | 6.1 | 2019-10-02 | A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) co… |
CVE-2019-12714 | Medium | 6.5 | 2019-10-02 | A vulnerability in the web-based management interface of Cisco IC3000 Industrial Compute Gateway could allow an authenticated, remote attacker to cause a denia… |
CVE-2019-12713 | Medium | 6.1 | 2019-10-02 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scr… |
CVE-2019-12712 | Medium | 6.1 | 2019-10-02 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scr… |
CVE-2019-12711 | Medium | 6.5 | 2019-10-02 | A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) co… |
CVE-2019-12710 | Medium | 4.9 | 2019-10-02 | A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) co… |
CVE-2019-12707 | Medium | 6.1 | 2019-10-02 | A vulnerability in the web-based interface of multiple Cisco Unified Communications products could allow an unauthenticated, remote attacker to conduct a cross… |
CVE-2019-12706 | High | 7.5 | 2019-10-02 | A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenti… |
CVE-2019-12701 | Medium | 5.8 | 2019-10-02 | A vulnerability in the file and malware inspection feature of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker… |
CVE-2019-12700 | Medium | 6.5 | 2019-10-02 | A vulnerability in the configuration of the Pluggable Authentication Module (PAM) used in Cisco Firepower Threat Defense (FTD) Software, Cisco Firepower Manage… |
CVE-2019-12699 | High | 7.8 | 2019-10-02 | Multiple vulnerabilities in the CLI of Cisco FXOS Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to ex… |
CVE-2019-12698 | High | 7.5 | 2019-10-02 | A vulnerability in the WebVPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unau… |
CVE-2019-12697 | High | 7.5 | 2019-10-02 | Multiple vulnerabilities in the Cisco Firepower System Software Detection Engine could allow an unauthenticated, remote attacker to bypass configured Malware a… |
CVE-2019-12696 | High | 7.5 | 2019-10-02 | Multiple vulnerabilities in the Cisco Firepower System Software Detection Engine could allow an unauthenticated, remote attacker to bypass configured Malware a… |
CVE-2019-12695 | Medium | 6.1 | 2019-10-02 | A vulnerability in the Clientless SSL VPN (WebVPN) portal of Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) Software could al… |
CVE-2019-12694 | Medium | 6.7 | 2019-10-02 | A vulnerability in the command line interface (CLI) of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker with administ… |
CVE-2019-12693 | Medium | 4.9 | 2019-10-02 | A vulnerability in the Secure Copy (SCP) feature of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to cause a d… |
CVE-2019-12691 | Medium | 4.9 | 2019-10-02 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perf… |
CVE-2019-12690 | High | 7.2 | 2019-10-02 | A vulnerability in the web UI of the Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to inject arbitrary commands that ar… |
CVE-2019-12689 | High | 8.8 | 2019-10-02 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to exec… |
CVE-2019-12688 | High | 8.8 | 2019-10-02 | A vulnerability in the web UI of the Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to execute arbitrary commands on an… |
CVE-2019-12687 | High | 8.8 | 2019-10-02 | A vulnerability in the web UI of the Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to execute arbitrary commands on an… |
CVE-2019-12686 | High | 8.8 | 2019-10-02 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2019-12685 | High | 8.8 | 2019-10-02 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2019-12684 | High | 8.8 | 2019-10-02 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2019-12683 | High | 8.8 | 2019-10-02 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2019-12682 | High | 8.8 | 2019-10-02 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2019-12681 | High | 8.8 | 2019-10-02 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2019-12680 | High | 8.8 | 2019-10-02 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2019-12679 | High | 8.8 | 2019-10-02 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2019-12678 | High | 7.5 | 2019-10-02 | A vulnerability in the Session Initiation Protocol (SIP) inspection module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defen… |
CVE-2019-12677 | Medium | 6.5 | 2019-10-02 | A vulnerability in the Secure Sockets Layer (SSL) VPN feature of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker… |
CVE-2019-12676 | High | 7.4 | 2019-10-02 | A vulnerability in the Open Shortest Path First (OSPF) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (F… |
CVE-2019-12675 | High | 8.8 | 2019-10-02 | Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape… |
CVE-2019-12674 | High | 8.2 | 2019-10-02 | Multiple vulnerabilities in the multi-instance feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to escape… |
CVE-2019-12673 | High | 7.5 | 2019-10-02 | A vulnerability in the FTP inspection engine of Cisco Adaptive Security (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthe… |
CVE-2019-12631 | Medium | 6.1 | 2019-10-02 | A vulnerability in the web-based guest portal of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site s… |
CVE-2019-12630 | Critical | 9.8 | 2019-10-02 | A vulnerability in the Java deserialization function used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary comman… |
CVE-2019-12157 | Critical | 9.8 | 2019-10-02 | In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands. |
CVE-2019-12156 | Medium | 5.3 | 2019-10-02 | Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity versions before 2018.2… |
CVE-2019-11929 | Critical | 9.8 | 2019-10-02 | Insufficient boundary checks when formatting numbers in number_format allows read/write access to out-of-bounds memory, potentially leading to remote code exec… |
CVE-2019-10212 | Critical | 9.8 | 2019-10-02 | A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the… |
CVE-2019-8462 | High | 7.5 | 2019-10-02 | In a rare scenario, Check Point R80.30 Security Gateway before JHF Take 50 managed by Check Point R80.30 Management crashes with a unique configuration of enha… |
CVE-2019-13658 | Critical | 9.8 | 2019-10-02 | CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise s… |
CVE-2019-5031 | High | 8.8 | 2019-10-02 | An exploitable memory corruption vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.4.1.16828. A specially crafted P… |
CVE-2019-16116 | Medium | 4.3 | 2019-10-02 | EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file. This allows an attacker to obtain the… |
CVE-2019-13343 | High | 7.5 | 2019-10-02 | Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymo… |
CVE-2019-4549 | Medium | 5.3 | 2019-10-02 | IBM Security Directory Server 6.4.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system… |
CVE-2019-4542 | Medium | 6.1 | 2019-10-02 | IBM Security Directory Server 6.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu… |
CVE-2019-4539 | High | 7.1 | 2019-10-02 | IBM Security Directory Server 6.4.0 does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or co… |
CVE-2019-4538 | High | 8.2 | 2019-10-02 | IBM Security Directory Server 6.4.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a… |
CVE-2019-4520 | High | 7.5 | 2019-10-02 | IBM Security Directory Server 6.4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-For… |
CVE-2019-13025 | Critical | 9.8 | 2019-10-02 | Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices have Incorrect Access Control because of Improper Input Validation. The attacker can send a malicious… |
CVE-2019-17091 | Medium | 6.1 | 2019-10-02 | faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, all… |
CVE-2019-17080 | High | 7.8 | 2019-10-02 | mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a REVIEWS_CACHE file is controlled by an attacker, because an unpickle occurs… |
CVE-2019-14454 | Critical | 9.8 | 2019-10-02 | SuiteCRM 7.11.x and 7.10.x before 7.11.8 and 7.10.20 is vulnerable to vertical privilege escalation. |
CVE-2019-13335 | Critical | 9.8 | 2019-10-02 | SalesAgility SuiteCRM 7.10.x 7.10.19 and 7.11.x before and 7.11.7 has SSRF. |
CVE-2019-17075 | High | 7.5 | 2019-10-01 | An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver is directly calling dma_map… |
CVE-2019-8292 | Medium | 5.3 | 2019-10-01 | Online Store System v1.0 delete_product.php doesn't check to see if a user authtenticated or has administrative rights allowing arbitrary product deletion. |
CVE-2019-8291 | High | 7.5 | 2019-10-01 | Online Store System v1.0 delete_file.php doesn't check to see if a user has administrative rights nor does it check for path traversal. |
CVE-2019-8290 | Medium | 6.1 | 2019-10-01 | Vulnerability in Online Store v1.0, The registration form requirements for the member email format can be bypassed by posting directly to sent_register.php all… |
CVE-2019-8289 | Medium | 5.4 | 2019-10-01 | Vulnerability in Online Store v1.0, stored XSS in admin/user_view.php adidas_member_email variable |
CVE-2019-8288 | Medium | 5.4 | 2019-10-01 | Vulnerability in Online Store v1.0, Stored XSS in user_view.php where adidas_member_user variable is not sanitized. |
CVE-2019-17074 | Medium | 5.4 | 2019-10-01 | An issue was discovered in XunRuiCMS 4.3.1. There is a stored XSS in the module_category area. |
CVE-2019-17073 | Medium | 6.5 | 2019-10-01 | emlog through 6.0.0beta allows remote authenticated users to delete arbitrary files via admin/template.php?action=del&tpl=../ directory traversal. |
CVE-2019-15041 | Medium | 6.1 | 2019-10-01 | JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted Control Sphere. |
CVE-2019-15035 | Medium | 4.9 | 2019-10-01 | An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could get access to potentially confidential server-level data. The is… |
CVE-2019-0231 | High | 7.5 | 2019-10-01 | Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client poten… |
CVE-2019-7618 | Medium | 6.5 | 2019-10-01 | A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to… |
CVE-2019-17069 | High | 7.5 | 2019-10-01 | PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message. |
CVE-2019-17068 | High | 7.5 | 2019-10-01 | PuTTY before 0.73 mishandles the "bracketed paste mode" protection mechanism, which may allow a session to be affected by malicious clipboard content. |
CVE-2019-17067 | Critical | 9.8 | 2019-10-01 | PuTTY before 0.73 on Windows improperly opens port-forwarding listening sockets, which allows attackers to listen on the same port to steal an incoming connect… |
CVE-2019-16943 | Critical | 9.8 | 2019-10-01 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific… |
CVE-2019-16942 | Critical | 9.8 | 2019-10-01 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific… |
CVE-2019-15042 | High | 7.5 | 2019-10-01 | An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for some external https connections. This was fixed in TeamCity 20… |
CVE-2019-14961 | Medium | 6.1 | 2019-10-01 | JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS. |