2019 CVEs (page 78)
Page 78 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10425 | Medium | 6.5 | 2019-09-25 | Jenkins Google Calendar Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Rea… |
CVE-2019-10424 | Medium | 5.5 | 2019-09-25 | Jenkins elOyente Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-10423 | Medium | 5.5 | 2019-09-25 | Jenkins CodeScan Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-10422 | Medium | 6.5 | 2019-09-25 | Jenkins Call Remote Job Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Rea… |
CVE-2019-10421 | Medium | 4.3 | 2019-09-25 | Jenkins Azure Event Grid Build Notifier Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users w… |
CVE-2019-10420 | Medium | 5.5 | 2019-09-25 | Jenkins Assembla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to… |
CVE-2019-10419 | Medium | 5.5 | 2019-09-25 | Jenkins vFabric Application Director Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by u… |
CVE-2019-10418 | Critical | 9.9 | 2019-09-25 | Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, b… |
CVE-2019-10417 | Critical | 9.9 | 2019-09-25 | Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, b… |
CVE-2019-10416 | Medium | 6.5 | 2019-09-25 | Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be v… |
CVE-2019-10415 | Medium | 6.5 | 2019-09-25 | Jenkins Violation Comments to GitLab Plugin 2.28 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they c… |
CVE-2019-10414 | Medium | 6.5 | 2019-09-25 | Jenkins Git Changelog Plugin 2.17 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users… |
CVE-2019-10413 | Medium | 6.5 | 2019-09-25 | Jenkins Data Theorem: CI/CD Plugin 1.3 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by u… |
CVE-2019-10412 | High | 7.5 | 2019-09-25 | Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resu… |
CVE-2019-10411 | High | 7.5 | 2019-09-25 | Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potential… |
CVE-2019-10410 | Medium | 5.4 | 2019-09-25 | Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message, resulting in a cross-site scripting vulnerability exploitable by users able to defin… |
CVE-2019-10409 | Medium | 4.3 | 2019-09-25 | A missing permission check in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers with Overall/Read permission to trigger project generation… |
CVE-2019-10408 | Medium | 4.3 | 2019-09-25 | A cross-site request forgery vulnerability in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers to trigger project generation from templat… |
CVE-2019-10407 | Medium | 6.5 | 2019-09-25 | Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive variables contribute… |
CVE-2019-10406 | Medium | 4.8 | 2019-09-25 | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulting in a stored XSS… |
CVE-2019-10405 | Medium | 5.4 | 2019-09-25 | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting ano… |
CVE-2019-10404 | Medium | 5.4 | 2019-09-25 | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a stored XSS vulnerability… |
CVE-2019-10403 | Medium | 5.4 | 2019-09-25 | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability… |
CVE-2019-10402 | Medium | 5.4 | 2019-09-25 | In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability… |
CVE-2019-10401 | Medium | 5.4 | 2019-09-25 | In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a store… |
CVE-2019-13627 | Medium | 6.3 | 2019-09-25 | It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4… |
CVE-2019-16868 | Critical | 9.8 | 2019-09-25 | emlog through 6.0.0beta has an arbitrary file deletion vulnerability via an admin/data.php?action=dell_all_bak request with directory traversal sequences in th… |
CVE-2019-16867 | Medium | 6.5 | 2019-09-25 | HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774… |
CVE-2019-5094 | High | 7.5 | 2019-09-24 | An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-… |
CVE-2019-16759 | Critical | 9.8 | 2019-09-24 | vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request. |
CVE-2019-13528 | Medium | 4.4 | 2019-09-24 | A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 (JACE 3e, JACE 6e, JACE 7, JACE-8000), Niagara 4.4u3 (… |
CVE-2019-13527 | High | 7.8 | 2019-09-24 | In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a maliciously crafted Arena file opened by an unsuspecting user m… |
CVE-2019-16725 | Medium | 6.1 | 2019-09-24 | In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates. |
CVE-2019-16724 | Critical | 9.8 | 2019-09-24 | File Sharing Wizard 1.5.0 allows a remote attacker to obtain arbitrary code execution by exploiting a Structured Exception Handler (SEH) based buffer overflow… |
CVE-2019-14220 | Medium | 6.5 | 2019-09-24 | An issue was discovered in BlueStacks 4.110 and below on macOS and on 4.120 and below on Windows. BlueStacks employs Android running in a virtual machine (VM)… |
CVE-2019-5505 | Critical | 9.8 | 2019-09-24 | ONTAP Select Deploy administration utility versions 2.2 through 2.12.1 transmit credentials in plaintext. |
CVE-2019-5504 | Critical | 9.8 | 2019-09-24 | ONTAP Select Deploy administration utility versions 2.12 & 2.12.1 ship with an HTTP service bound to the network allowing unauthenticated remote attackers to p… |
CVE-2019-16411 | Critical | 9.8 | 2019-09-24 | An issue was discovered in Suricata 4.1.4. By sending multiple IPv4 packets that have invalid IPv4Options, the function IPV4OptValidateTimestamp in decode-ipv4… |
CVE-2019-16410 | Critical | 9.1 | 2019-09-24 | An issue was discovered in Suricata 4.1.4. By sending multiple fragmented IPv4 packets, the function Defrag4Reassemble in defrag.c tries to access a memory reg… |
CVE-2019-15699 | Critical | 9.1 | 2019-09-24 | An issue was discovered in app-layer-ssl.c in Suricata 4.1.4. Upon receiving a corrupted SSLv3 (TLS 1.2) packet, the parser function TLSDecodeHSHelloExtensions… |
CVE-2019-12068 | Low | 3.8 | 2019-09-24 | In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing scrip… |
CVE-2019-14239 | Medium | 6.6 | 2019-09-24 | On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeat… |
CVE-2019-16754 | High | 7.5 | 2019-09-24 | RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation (asymcute), potentially allowing an attacker to crash a network node running RIO… |
CVE-2019-16751 | Medium | 6.1 | 2019-09-24 | An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting (XSS) through the mes… |
CVE-2019-14238 | Medium | 6.6 | 2019-09-24 | On STMicroelectronics STM32F7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated with a debug probe via th… |
CVE-2019-14753 | High | 7.5 | 2019-09-24 | SICK FX0-GPNT00000 and FX0-GENT00000 devices through 3.4.0 have a Buffer Overflow |
CVE-2019-3726 | Medium | 6.7 | 2019-09-24 | An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versions prior to 19.1.0.413, and Framework… |
CVE-2019-16383 | Critical | 9.4 | 2019-09-24 | MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to ga… |
CVE-2019-13357 | High | 7.8 | 2019-09-24 | In Total Defense Anti-virus 9.0.0.773, resource acquisition from the untrusted search path C:\ used by caschelp.exe allows local attackers to hijack ccGUIFrm.d… |
CVE-2019-13356 | High | 7.8 | 2019-09-24 | In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\bd\TDUpdate2\ used by AMRT.exe allow… |
CVE-2019-13355 | High | 7.8 | 2019-09-24 | In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\ used by ccschedulersvc.exe allows l… |
CVE-2019-4566 | Medium | 5.5 | 2019-09-24 | IBM Security Key Lifecycle Manager 3.0 and 3.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 166627. |
CVE-2019-4515 | Medium | 6.5 | 2019-09-24 | IBM Security Key Lifecycle Manager 3.0 and 3.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorize… |
CVE-2019-16748 | Critical | 9.8 | 2019-09-24 | In wolfSSL through 4.1.0, there is a missing sanity check of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there is a one-… |
CVE-2019-16746 | Critical | 9.8 | 2019-09-24 | An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of variable elements in a beacon head, leadi… |
CVE-2019-16729 | High | 7.8 | 2019-09-24 | pam-python before 1.0.7-1 has an issue in regard to the default environment variable handling of Python, which could allow for local root escalation in certain… |
CVE-2019-16728 | Medium | 6.1 | 2019-09-24 | DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari. |
CVE-2019-10755 | Medium | 4.9 | 2019-09-23 | The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due… |
CVE-2019-10754 | High | 8.1 | 2019-09-23 | Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes th… |
CVE-2019-1367 | High | 7.5 | 2019-09-23 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory… |
CVE-2019-1255 | High | 7.5 | 2019-09-23 | A denial of service vulnerability exists when Microsoft Defender improperly handles files, aka 'Microsoft Defender Denial of Service Vulnerability'. |
CVE-2019-11277 | High | 8.1 | 2019-09-23 | Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated malic… |
CVE-2019-15635 | Medium | 4.9 | 2019-09-23 | An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana (e.g., MySQL) are not encrypted. An admin user can reveal passwords for an… |
CVE-2019-16377 | Critical | 9.8 | 2019-09-23 | The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control. |
CVE-2019-12407 | Medium | 6.1 | 2019-09-23 | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the rem… |
CVE-2019-10996 | High | 7.8 | 2019-09-23 | Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user ope… |
CVE-2019-10990 | Medium | 6.5 | 2019-09-23 | Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and… |
CVE-2019-10984 | High | 7.8 | 2019-09-23 | Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user ope… |
CVE-2019-10978 | High | 7.8 | 2019-09-23 | Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user ope… |
CVE-2019-10090 | Medium | 6.1 | 2019-09-23 | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the pla… |
CVE-2019-16723 | Medium | 4.3 | 2019-09-23 | In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_gra… |
CVE-2019-16518 | Medium | 4.3 | 2019-09-23 | An issue was discovered on Swell Kit Mod devices that use the Vandy Vape platform. An attacker may be able to trigger an unintended temperature in the victim's… |
CVE-2019-13063 | High | 7.5 | 2019-09-23 | Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on the Script_view page… |
CVE-2019-12404 | Medium | 6.1 | 2019-09-23 | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoCon… |
CVE-2019-10089 | Medium | 6.1 | 2019-09-23 | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYS… |
CVE-2019-10087 | Medium | 6.1 | 2019-09-23 | On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Pag… |
CVE-2019-3416 | Critical | 9.8 | 2019-09-23 | All versions up to V81511329.1008 of ZTE ZXV10 B860A products are impacted by input validation vulnerability. Due to input validation, unauthorized users can t… |
CVE-2019-16722 | Critical | 9.8 | 2019-09-23 | ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an str_ireplace operation. |
CVE-2019-16721 | Medium | 6.5 | 2019-09-23 | NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user. |
CVE-2019-16720 | High | 7.5 | 2019-09-23 | ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading… |
CVE-2019-16719 | Medium | 6.5 | 2019-09-23 | WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS. |
CVE-2019-16718 | High | 7.8 | 2019-09-23 | In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to ex… |
CVE-2019-16714 | High | 7.5 | 2019-09-23 | In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack memory because tos a… |
CVE-2019-16713 | Medium | 6.5 | 2019-09-23 | ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in MagickCore/constitute.c. |
CVE-2019-16712 | Medium | 6.5 | 2019-09-23 | ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by WritePS3Image. |
CVE-2019-16711 | Medium | 6.5 | 2019-09-23 | ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. |
CVE-2019-16710 | Medium | 6.5 | 2019-09-23 | ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in MagickCore/memory.c. |
CVE-2019-16709 | Medium | 6.5 | 2019-09-23 | ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. |
CVE-2019-16708 | Medium | 6.5 | 2019-09-23 | ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. |
CVE-2019-16707 | Medium | 6.5 | 2019-09-23 | Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx. |
CVE-2019-16706 | High | 8.8 | 2019-09-23 | kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cms_user_add.php. |
CVE-2019-16705 | Critical | 9.1 | 2019-09-23 | Ming (aka libming) 0.4.8 has an out of bounds read vulnerability in the function OpCode() in the decompile.c file in libutil.a. |
CVE-2019-16704 | Medium | 4.8 | 2019-09-23 | admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS. |
CVE-2019-16703 | Medium | 6.1 | 2019-09-23 | admin/infolist_add.php in PHPMyWind 5.6 has stored XSS. |
CVE-2019-16702 | Critical | 9.8 | 2019-09-23 | Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs parameter to the /LoginAdmin URI. |
CVE-2019-16696 | Critical | 9.8 | 2019-09-22 | phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used. |
CVE-2019-16695 | Critical | 9.8 | 2019-09-22 | phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used. |
CVE-2019-16694 | Critical | 9.8 | 2019-09-22 | phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is used. |
CVE-2019-16693 | Critical | 9.8 | 2019-09-22 | phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used. |
CVE-2019-16692 | Critical | 9.8 | 2019-09-22 | phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used. |