2019 CVEs (page 73)
Page 73 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-17064 | Medium | 5.5 | 2019-10-01 | Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog constructor. |
CVE-2019-17063 | Medium | 5.5 | 2019-10-01 | In Snowtide PDFxStream before 3.7.1 (for Java), a crafted PDF file can trigger an extremely long running computation because of page-tree mishandling. |
CVE-2019-15038 | High | 7.5 | 2019-10-01 | An issue was discovered in JetBrains TeamCity 2018.2.4. The TeamCity server was not using some security-related HTTP headers. The issue was fixed in TeamCity 2… |
CVE-2019-14960 | High | 7.8 | 2019-10-01 | JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file. |
CVE-2019-14957 | Medium | 5.3 | 2019-10-01 | The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vim_settings.xml file. This xml file could be synchronized to a… |
CVE-2019-14955 | Medium | 5.3 | 2019-10-01 | In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration policy was implement… |
CVE-2019-14953 | Medium | 6.1 | 2019-10-01 | JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser. |
CVE-2019-4497 | Medium | 5.4 | 2019-10-01 | IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows us… |
CVE-2019-4495 | Medium | 5.4 | 2019-10-01 | IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows us… |
CVE-2019-4494 | Medium | 5.4 | 2019-10-01 | IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows us… |
CVE-2019-4246 | Medium | 5.3 | 2019-10-01 | IBM Daeja ViewONE Virtual 5.0 through 5.0.6 could expose internal parameters to ViewONE clients that could be used in further attacks against the system. IBM X… |
CVE-2019-11275 | Medium | 4.3 | 2019-10-01 | Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior… |
CVE-2019-10202 | Critical | 9.8 | 2019-10-01 | A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017… |
CVE-2019-17056 | Low | 3.3 | 2019-10-01 | llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivile… |
CVE-2019-17055 | Low | 3.3 | 2019-10-01 | base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that… |
CVE-2019-17054 | Low | 3.3 | 2019-10-01 | atalk_create in net/appletalk/ddp.c in the AF_APPLETALK network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivi… |
CVE-2019-17053 | Low | 3.3 | 2019-10-01 | ieee802154_create in net/ieee802154/socket.c in the AF_IEEE802154 network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means th… |
CVE-2019-17052 | Low | 3.3 | 2019-10-01 | ax25_create in net/ax25/af_ax25.c in the AF_AX25 network module in the Linux kernel 3.16 through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivile… |
CVE-2019-15039 | Critical | 9.8 | 2019-10-01 | An issue was discovered in JetBrains TeamCity 2018.2.4. It had a possible remote code execution issue. This was fixed in TeamCity 2019.1. |
CVE-2019-14954 | Medium | 5.9 | 2019-10-01 | JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection. |
CVE-2019-14952 | Medium | 6.1 | 2019-10-01 | JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles. |
CVE-2019-10435 | High | 7.5 | 2019-10-01 | Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. |
CVE-2019-10434 | High | 7.5 | 2019-10-01 | Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their expos… |
CVE-2019-10433 | Low | 3.3 | 2019-10-01 | Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read p… |
CVE-2019-10432 | Medium | 5.4 | 2019-10-01 | Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a cross-site scripting… |
CVE-2019-10431 | Critical | 9.9 | 2019-10-01 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allo… |
CVE-2019-15940 | Critical | 9.8 | 2019-10-01 | Victure PC530 devices allow unauthenticated TELNET access as root. |
CVE-2019-16508 | High | 7.8 | 2019-10-01 | The Imagination Technologies driver for Chrome OS before R74-11895.B, R75 before R75-12105.B, and R76 before R76-12208.0.0 allows attackers to trigger an Integ… |
CVE-2019-3733 | Medium | 4.9 | 2019-09-30 | RSA BSAFE Crypto-C Micro Edition, all versions prior to 4.1.4, is vulnerable to three (3) different Improper Clearing of Heap Memory Before Release vulnerabili… |
CVE-2019-3732 | High | 7.5 | 2019-09-30 | RSA BSAFE Crypto-C Micro Edition, versions prior to 4.0.5.3 (in 4.0.x) and versions prior to 4.1.3.3 (in 4.1.x), and RSA Micro Edition Suite, versions prior to… |
CVE-2019-3731 | High | 7.5 | 2019-09-30 | RSA BSAFE Crypto-C Micro Edition versions prior to 4.1.4 and RSA Micro Edition Suite versions prior to 4.4 are vulnerable to an Information Exposure Through Ti… |
CVE-2019-3730 | High | 7.5 | 2019-09-30 | RSA BSAFE Micro Edition Suite versions prior to 4.1.6.3 (in 4.1.x) and prior to 4.4 (in 4.2.x and 4.3.x), are vulnerable to an Information Exposure Through an… |
CVE-2019-3729 | Low | 2.4 | 2019-09-30 | RSA BSAFE Micro Edition Suite versions prior to 4.4 (in 4.0.x, 4.1.x, 4.2.x and 4.3.x) are vulnerable to a Heap-based Buffer Overflow vulnerability when parsin… |
CVE-2019-3728 | High | 7.5 | 2019-09-30 | RSA BSAFE Crypto-C Micro Edition versions from 4.0.0.0 before 4.0.5.4 and from 4.1.0 before 4.1.4, RSA BSAFE Micro Edition Suite versions from 4.0.0 before 4.0… |
CVE-2019-16760 | Medium | 4.6 | 2019-09-30 | Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rena… |
CVE-2019-17051 | High | 7.8 | 2019-09-30 | Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attachment files, as demonstrated by a one-cl… |
CVE-2019-13124 | High | 7.5 | 2019-09-30 | Foxit Reader 9.6.0.25114 and earlier has two unique RecursiveCall bugs involving 3 functions exhausting available stack memory because of Uncontrolled Recursio… |
CVE-2019-13123 | High | 7.5 | 2019-09-30 | Foxit Reader 9.6.0.25114 and earlier has two unique RecursiveCall bugs involving 3 functions exhausting available stack memory because of Uncontrolled Recursio… |
CVE-2019-17050 | High | 7.2 | 2019-09-30 | An issue was discovered in the Voyager package through 1.2.7 for Laravel. An attacker with admin privileges and Compass access can read or delete arbitrary fil… |
CVE-2019-17049 | High | 7.5 | 2019-09-30 | NETGEAR SRX5308 4.3.5-3 devices allow SQL Injection, as exploited in the wild in September 2019 to add a new user account. |
CVE-2019-16276 | High | 7.5 | 2019-09-30 | Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling. |
CVE-2019-13467 | Medium | 5.9 | 2019-09-30 | Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle… |
CVE-2019-13466 | High | 7.5 | 2019-09-30 | Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. The “generate reports” archive is protecte… |
CVE-2019-15810 | Medium | 6.1 | 2019-09-30 | Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter. |
CVE-2019-4423 | Medium | 5.3 | 2019-09-30 | IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-craft… |
CVE-2019-4305 | Medium | 5.3 | 2019-09-30 | IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. IBM X-Force… |
CVE-2019-4304 | Medium | 6.3 | 2019-09-30 | IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session validation. IBM X-Force ID… |
CVE-2019-4280 | Medium | 5.3 | 2019-09-30 | IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 displays sensitive information in HTTP requests which could be used in further attacks against the system. IB… |
CVE-2019-4115 | Medium | 5.4 | 2019-09-30 | IBM WebSphere eXtreme Scale 8.6 Admin API is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2019-4112 | Low | 3.3 | 2019-09-30 | IBM WebSphere eXtreme Scale 8.6 Admin Console allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 158105. |
CVE-2019-4109 | Medium | 6.1 | 2019-09-30 | IBM WebSphere eXtreme Scale 8.6 Admin Console could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a mali… |
CVE-2019-4106 | Medium | 4.8 | 2019-09-30 | IBM WebSphere eXtreme Scale 8.6 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2019-2341 | High | 7.8 | 2019-09-30 | Buffer overflow when the audio buffer size provided by user is larger than the maximum allowable audio buffer size. in Snapdragon Auto, Snapdragon Compute, Sna… |
CVE-2019-2333 | High | 7.8 | 2019-09-30 | Buffer overflow due to improper validation of buffer size while IPA driver processing to perform read operation in Snapdragon Auto, Snapdragon Compute, Snapdra… |
CVE-2019-2294 | Critical | 9.8 | 2019-09-30 | Usage of hard-coded magic number for calculating heap guard bytes can allow users to corrupt heap blocks without heap algorithm knowledge in Snapdragon Auto, S… |
CVE-2019-2284 | High | 7.0 | 2019-09-30 | Possible use-after-free issue due to a race condition while calling camera ioctl concurrently in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Indust… |
CVE-2019-2252 | Critical | 9.8 | 2019-09-30 | Classic buffer overflow vulnerability while playing the specific video whose Decode picture buffer size is more than 16 in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-16932 | Critical | 10.0 | 2019-09-30 | A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data. |
CVE-2019-16684 | Medium | 4.8 | 2019-09-30 | An issue was discovered in the image-manager in Xoops 2.5.10. When any image with a JavaScript payload as its name is hovered over in the list or in the Edit p… |
CVE-2019-16683 | Medium | 4.8 | 2019-09-30 | An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered over while editing any image, a JavaScri… |
CVE-2019-10540 | Critical | 9.8 | 2019-09-30 | Buffer overflow in WLAN NAN function due to lack of check of count value received in NAN availability attribute in Snapdragon Auto, Snapdragon Compute, Snapdra… |
CVE-2019-10539 | Critical | 9.8 | 2019-09-30 | Possible buffer overflow issue due to lack of length check when parsing the extended cap IE header length in Snapdragon Auto, Snapdragon Compute, Snapdragon Co… |
CVE-2019-10538 | Critical | 9.8 | 2019-09-30 | Lack of check of address range received from firmware response allows modem to respond arbitrary pages into its address range which can compromise HLOS in Snap… |
CVE-2019-10510 | High | 8.2 | 2019-09-30 | BT process died and BT toggled due to null pointer dereference when invalid vendor pass through command sent from remote in Snapdragon Auto, Snapdragon Consume… |
CVE-2019-10509 | Critical | 9.8 | 2019-09-30 | Device record of the pairing device used after free during ACL disconnection in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consum… |
CVE-2019-10508 | High | 7.8 | 2019-09-30 | Lack of input validation for data received from user space can lead to OOB access in WLAN in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Sna… |
CVE-2019-10507 | High | 7.8 | 2019-09-30 | Lack of check of extscan change results received from firmware can lead to an out of buffer read in Snapdragon Auto, Snapdragon Consumer Electronics Connectivi… |
CVE-2019-10506 | High | 7.8 | 2019-09-30 | While processing QCA_NL80211_VENDOR_SUBCMD_AVOID_FREQUENCY vendor command, driver does not validate the data obtained from the user space which could be invali… |
CVE-2019-10501 | High | 7.8 | 2019-09-30 | Possible use after free issue due to improper input validation in volume listener library in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snap… |
CVE-2019-10499 | High | 7.8 | 2019-09-30 | Improper validation of read and write index of tx and rx fifo`s before using for data copy from fifo can lead to out-of-bound access. in Snapdragon Mobile, Sna… |
CVE-2019-10498 | High | 7.8 | 2019-09-30 | Buffer overflow scenario if the client sends more than 5 io_vec requests to the server in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdra… |
CVE-2019-10497 | High | 7.8 | 2019-09-30 | Use after free issue occurs If another instance of open for voice_svc node has been called from application without closing the previous one. in Snapdragon Aut… |
CVE-2019-10492 | High | 7.8 | 2019-09-30 | Boot image not getting verified by AVB in Snapdragon Auto, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W, Qualcomm 215, SD 210/SD 212/SD 205, SD… |
CVE-2019-10489 | High | 7.5 | 2019-09-30 | Possible null-pointer dereference can occur while parsing avi clip during copy in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Indu… |
CVE-2019-17046 | High | 7.2 | 2019-09-30 | Ilch 2.1.22 allows remote code execution because php is listed under "Allowed files" on the index.php/admin/media/settings/index page. |
CVE-2019-17045 | Medium | 4.8 | 2019-09-30 | Ilch 2.1.22 allows stored XSS via the title, text, or email id to the Jobs Tab. |
CVE-2019-17040 | Critical | 9.8 | 2019-09-30 | contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled. |
CVE-2019-16999 | Critical | 9.8 | 2019-09-30 | CloudBoot through 2019-03-08 allows SQL Injection via a crafted Status field in JSON data to the api/osinstall/v1/device/getNumByStatus URI. |
CVE-2019-16997 | High | 7.2 | 2019-09-30 | In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doE… |
CVE-2019-16996 | High | 7.2 | 2019-09-30 | In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_… |
CVE-2019-16995 | High | 7.5 | 2019-09-30 | In the Linux kernel before 5.0.3, a memory leak exits in hsr_dev_finalize() in net/hsr/hsr_device.c if hsr_add_port fails to add a port, which may cause denial… |
CVE-2019-16994 | Medium | 4.7 | 2019-09-30 | In the Linux kernel before 5.0, a memory leak exists in sit_init_net() in net/ipv6/sit.c when register_netdev() fails to register sitn->fb_tunnel_dev, which ma… |
CVE-2019-16745 | High | 8.8 | 2019-09-30 | eBrigade before 5.0 has evenement_choice.php chxCal SQL Injection. |
CVE-2019-16744 | High | 8.8 | 2019-09-30 | eBrigade before 5.0 has evenements.php cid SQL Injection. |
CVE-2019-16743 | High | 8.8 | 2019-09-30 | eBrigade before 5.0 has evenement_ical.php evenement SQL Injection. |
CVE-2019-16414 | Medium | 6.1 | 2019-09-30 | A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to… |
CVE-2019-14752 | Medium | 6.1 | 2019-09-30 | SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS. |
CVE-2019-16993 | High | 8.8 | 2019-09-30 | In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An ac… |
CVE-2019-16676 | Critical | 9.8 | 2019-09-30 | Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string is invoked as a metho… |
CVE-2019-16992 | High | 7.5 | 2019-09-30 | The Keybase app 2.13.2 for iOS provides potentially insufficient notice that it is employing a user's private key to sign a certain cryptocurrency attestation… |
CVE-2019-16930 | Medium | 5.3 | 2019-09-28 | Zcashd in Zcash before 2.0.7-3 allows discovery of the IP address of a full node that owns a shielded address, related to mishandling of exceptions during dese… |
CVE-2019-16941 | Critical | 9.8 | 2019-09-28 | NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used wit… |
CVE-2019-16935 | Medium | 6.1 | 2019-09-28 | The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/Do… |
CVE-2019-16926 | Medium | 6.1 | 2019-09-28 | Flower 0.9.3 has XSS via a crafted worker name. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name… |
CVE-2019-16925 | Medium | 6.1 | 2019-09-28 | Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker n… |
CVE-2019-3766 | Critical | 9.8 | 2019-09-27 | Dell EMC ECS versions prior to 3.4.0.0 contain an improper restriction of excessive authentication attempts vulnerability. An unauthenticated remote attacker m… |
CVE-2019-3747 | Medium | 4.8 | 2019-09-27 | Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious ACM admin user may… |
CVE-2019-3746 | High | 8.8 | 2019-09-27 | Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote… |
CVE-2019-3736 | High | 7.2 | 2019-09-27 | Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a password storage vulnerability in the ACM component. A remote authenticated malic… |
CVE-2019-16928 | Critical | 9.8 | 2019-09-27 | Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat i… |