2019 CVEs (page 79)
Page 79 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-16681 | Medium | 4.7 | 2019-09-21 | The Traveloka application 3.14.0 for Android exports com.traveloka.android.activity.common.WebViewActivity, leading to the opening of arbitrary URLs, which can… |
CVE-2019-16680 | Medium | 4.3 | 2019-09-21 | An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwr… |
CVE-2019-16679 | Medium | 4.9 | 2019-09-21 | Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion. |
CVE-2019-16678 | Medium | 6.5 | 2019-09-21 | admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route. |
CVE-2019-16677 | Medium | 6.5 | 2019-09-21 | An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF. |
CVE-2019-16669 | Medium | 5.3 | 2019-09-21 | The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might… |
CVE-2019-16665 | Medium | 6.1 | 2019-09-21 | An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG… |
CVE-2019-16664 | Medium | 4.8 | 2019-09-21 | An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter. |
CVE-2019-16661 | Medium | 5.4 | 2019-09-21 | Ogma CMS 0.5 has XSS via creation of a new blog. |
CVE-2019-16660 | High | 8.8 | 2019-09-21 | joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF. |
CVE-2019-16659 | High | 8.8 | 2019-09-21 | TuziCMS 2.0.6 has index.php/manage/link/do_add CSRF. |
CVE-2019-16658 | High | 8.8 | 2019-09-21 | TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF. |
CVE-2019-16657 | Medium | 6.1 | 2019-09-21 | TuziCMS 2.0.6 has XSS via the PATH_INFO to a group URI, as demonstrated by index.php/article/group/id/2/. |
CVE-2019-16656 | Critical | 9.8 | 2019-09-21 | joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of an object in the database. |
CVE-2019-16655 | High | 7.5 | 2019-09-21 | joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available. |
CVE-2019-16650 | Critical | 10.0 | 2019-09-21 | On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number… |
CVE-2019-16649 | Critical | 10.0 | 2019-09-21 | On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of… |
CVE-2019-6650 | Critical | 9.1 | 2019-09-20 | F5 BIG-IP ASM 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 may expose sensitive information and… |
CVE-2019-6649 | Critical | 9.1 | 2019-09-20 | F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose… |
CVE-2019-6145 | Medium | 6.7 | 2019-09-20 | Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user… |
CVE-2019-15138 | High | 7.5 | 2019-09-20 | The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL. |
CVE-2019-16645 | High | 8.6 | 2019-09-20 | An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) create links containing a hostname obtaine… |
CVE-2019-14816 | High | 7.8 | 2019-09-20 | There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local users to c… |
CVE-2019-14814 | High | 7.8 | 2019-09-20 | There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allows local user… |
CVE-2019-11327 | Medium | 4.9 | 2019-09-20 | An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product has a local file inclusion vul… |
CVE-2019-11326 | High | 8.8 | 2019-09-20 | An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protected by a login. A gue… |
CVE-2019-11280 | High | 8.8 | 2019-09-20 | Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to… |
CVE-2019-5521 | Critical | 9.6 | 2019-09-20 | VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6) and Fusion (11.x before… |
CVE-2019-4565 | High | 7.5 | 2019-09-20 | IBM Security Key Lifecycle Manager 3.0 and 3.0.1 does not require that users should have strong passwords by default, which makes it easier for attackers to co… |
CVE-2019-4505 | Medium | 5.3 | 2019-09-20 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Network Deployment could allow a remote attacker to obtain sensitive information, caused by sending a s… |
CVE-2019-16644 | Critical | 9.8 | 2019-09-20 | App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring. |
CVE-2019-16643 | Medium | 5.4 | 2019-09-20 | An issue was discovered in ZrLog 2.1.1. There is a Stored XSS vulnerability in the article_edit area. |
CVE-2019-16534 | Medium | 6.1 | 2019-09-20 | On DrayTek Vigor2925 devices with firmware 3.8.4.3, XSS exists via a crafted WAN name on the General Setup screen. NOTE: this is an end-of-life product. |
CVE-2019-16533 | Medium | 6.1 | 2019-09-20 | On DrayTek Vigor2925 devices with firmware 3.8.4.3, Incorrect Access Control exists in loginset.htm, and can be used to trigger XSS. NOTE: this is an end-of-li… |
CVE-2019-16642 | Critical | 9.8 | 2019-09-20 | App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring. |
CVE-2019-15089 | High | 8.8 | 2019-09-20 | An issue was discovered in PRiSE adAS 1.7.0. Forms have no CSRF protection, letting an attacker execute actions as the administrator. |
CVE-2019-15088 | Critical | 9.8 | 2019-09-20 | An issue was discovered in PRiSE adAS 1.7.0. Password hashes are compared using the equality operator. Thus, under specific circumstances, it is possible to by… |
CVE-2019-15087 | High | 7.2 | 2019-09-20 | An issue was discovered in PRiSE adAS 1.7.0. An authenticated user can change the function used to hash passwords to any function, leading to remote code execu… |
CVE-2019-15086 | Medium | 6.1 | 2019-09-20 | An issue was discovered in PRiSE adAS 1.7.0. The newentityID parameter is not properly escaped, leading to a reflected XSS in the error message. |
CVE-2019-15085 | High | 7.5 | 2019-09-20 | An issue was discovered in PRiSE adAS 1.7.0. The current database password is embedded in the change password form. |
CVE-2019-14916 | Medium | 6.5 | 2019-09-20 | An issue was discovered in PRiSE adAS 1.7.0. A file's format is not properly checked, leading to an unrestricted file upload. |
CVE-2019-14915 | Medium | 6.1 | 2019-09-20 | An issue was discovered in PRiSE adAS 1.7.0. Certificate data are not properly escaped. This leads to XSS when submitting a rogue certificate. |
CVE-2019-14914 | Critical | 9.1 | 2019-09-20 | An issue was discovered in PRiSE adAS 1.7.0. The path is not properly escaped in the medatadata_del method, leading to an arbitrary file read and deletion via… |
CVE-2019-14913 | Medium | 5.4 | 2019-09-20 | An issue was discovered in PRiSE adAS 1.7.0. Log data are not properly escaped, leading to persistent XSS in the administration panel. |
CVE-2019-14912 | Medium | 6.1 | 2019-09-20 | An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly check the goto parameter, leading to an open redirect that leaks the session… |
CVE-2019-14911 | Medium | 6.1 | 2019-09-20 | An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly escape output on error, leading to reflected XSS. |
CVE-2019-16531 | High | 8.8 | 2019-09-20 | LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php. |
CVE-2019-9720 | Medium | 6.5 | 2019-09-19 | A stack-based buffer overflow in the subtitle decoder in Libav 12.3 allows attackers to corrupt the stack via a crafted video file in Matroska format, because… |
CVE-2019-9719 | High | 8.8 | 2019-09-19 | A stack-based buffer overflow in the subtitle decoder in Libav 12.3 allows attackers to corrupt the stack via a crafted video file in Matroska format, because… |
CVE-2019-9717 | Medium | 6.5 | 2019-09-19 | In Libav 12.3, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because srt_to_ass in l… |
CVE-2019-16525 | Medium | 6.1 | 2019-09-19 | An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, an… |
CVE-2019-14821 | High | 8.8 | 2019-09-19 | An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO w… |
CVE-2019-15033 | High | 7.7 | 2019-09-19 | Pydio 6.0.8 allows Authenticated SSRF during a Remote Link Feature download. An attacker can specify an intranet address in the file parameter to index.php, wh… |
CVE-2019-15032 | Medium | 5.3 | 2019-09-19 | Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the remote-upload option is used with the http://localhost:22 URL… |
CVE-2019-16511 | Medium | 5.5 | 2019-09-19 | An issue was discovered in DTF in FireGiant WiX Toolset before 3.11.2. Microsoft.Deployment.Compression.Cab.dll and Microsoft.Deployment.Compression.Zip.dll al… |
CVE-2019-16510 | High | 7.5 | 2019-09-19 | libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrated by server_example_goose. |
CVE-2019-16412 | High | 7.5 | 2019-09-19 | In goform/setSysTools on Tenda N301 wireless routers, attackers can trigger a device crash via a zero wanMTU value. (Prohibition of this zero value is only enf… |
CVE-2019-16398 | Medium | 6.8 | 2019-09-19 | On Keeper K5 20.1.0.25 and 20.1.0.63 devices, remote code execution can occur by inserting an SD card containing a file named zskj_script_run.sh that executes… |
CVE-2019-15001 | High | 7.2 | 2019-09-19 | The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, fr… |
CVE-2019-15000 | Critical | 9.8 | 2019-09-19 | The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 (the fixed version for 5.16.x ), from 6.0.0 before 6.0.10 (the fixed version f… |
CVE-2019-14994 | High | 7.5 | 2019-09-19 | The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before version 3.9.16, from version 3.10.0 before version 3… |
CVE-2019-6010 | High | 7.8 | 2019-09-19 | Integer overflow vulnerability in LINE(Android) from 4.4.0 to the version before 9.15.1 allows remote attackers to cause a denial of service (DoS) condition or… |
CVE-2019-3689 | Medium | 5.1 | 2019-09-19 | The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including… |
CVE-2019-11779 | Medium | 6.5 | 2019-09-19 | In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or m… |
CVE-2019-15943 | High | 8.8 | 2019-09-19 | vphysics.dll in Counter-Strike: Global Offensive before 1.37.1.1 allows remote attackers to achieve code execution or denial of service by creating a gaming se… |
CVE-2019-16413 | High | 7.5 | 2019-09-19 | An issue was discovered in the Linux kernel before 5.0.4. The 9p filesystem did not protect i_size_write() properly, which causes an i_size_read() infinite loo… |
CVE-2019-3758 | Critical | 9.8 | 2019-09-18 | RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability. The vulnerability allows sysadmins to create user accounts wi… |
CVE-2019-3756 | Medium | 6.5 | 2019-09-18 | RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to… |
CVE-2019-3740 | Medium | 6.5 | 2019-09-18 | RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A ma… |
CVE-2019-3739 | Medium | 6.5 | 2019-09-18 | RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A mal… |
CVE-2019-3738 | Medium | 6.5 | 2019-09-18 | RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially… |
CVE-2019-11778 | Medium | 5.4 | 2019-09-18 | If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay interval, sets a sessio… |
CVE-2019-11211 | Critical | 9.9 | 2019-09-18 | The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and TIBCO Spotfire Analytics Platform for AWS Marketplace contai… |
CVE-2019-11210 | Critical | 10.0 | 2019-09-18 | The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and TIBCO Spotfire Analytics Platform for AWS Marketplace contai… |
CVE-2019-5531 | Medium | 5.4 | 2019-09-18 | VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6… |
CVE-2019-13558 | Critical | 9.8 | 2019-09-18 | In WebAccess versions 8.4.1 and prior, an exploit executed over the network may cause improper control of generation of code, which may allow remote code execu… |
CVE-2019-13556 | High | 8.8 | 2019-09-18 | In WebAccess versions 8.4.1 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-sup… |
CVE-2019-11664 | Medium | 6.5 | 2019-09-18 | Clear text password in browser in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9… |
CVE-2019-11663 | Medium | 6.5 | 2019-09-18 | Clear text credentials are used to access managers app in Tomcat in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41… |
CVE-2019-11662 | Medium | 4.3 | 2019-09-18 | Class and method names in error message in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60… |
CVE-2019-11661 | High | 8.3 | 2019-09-18 | Allow changes to some table by non-SysAdmin in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9… |
CVE-2019-5534 | High | 7.7 | 2019-09-18 | VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability where Virtual Mach… |
CVE-2019-5532 | High | 7.7 | 2019-09-18 | VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability due to the logging… |
CVE-2019-5067 | Critical | 9.8 | 2019-09-18 | An uninitialized memory access vulnerability exists in the way Aspose.PDF 19.2 for C++ handles invalid parent object pointers. A specially crafted PDF can caus… |
CVE-2019-5066 | Critical | 9.8 | 2019-09-18 | An exploitable use-after-free vulnerability exists in the way LZW-compressed streams are processed in Aspose.PDF 19.2 for C++. A specially crafted PDF can caus… |
CVE-2019-5042 | High | 8.8 | 2019-09-18 | An exploitable Use-After-Free vulnerability exists in the way FunctionType 0 PDF elements are processed in Aspose.PDF 19.2 for C++. A specially crafted PDF can… |
CVE-2019-15301 | Critical | 9.8 | 2019-09-18 | A SQL injection vulnerability in the method Terrasoft.Core.DB.Column.Const() in Terrasoft Bpm'online CRM-System SDK 7.13 allows attackers to execute arbitrary… |
CVE-2019-13552 | High | 8.8 | 2019-09-18 | In WebAccess versions 8.4.1 and prior, multiple command injection vulnerabilities are caused by a lack of proper validation of user-supplied data and may allow… |
CVE-2019-13550 | Critical | 9.8 | 2019-09-18 | In WebAccess, versions 8.4.1 and prior, an improper authorization vulnerability may allow an attacker to disclose sensitive information, cause improper control… |
CVE-2019-9680 | Medium | 5.3 | 2019-09-18 | Some Dahua products have information leakage issues. Attackers can obtain the IP address and device model information of the device by constructing malicious d… |
CVE-2019-9679 | High | 8.8 | 2019-09-18 | Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function after logging in. Affected products include… |
CVE-2019-9678 | High | 7.5 | 2019-09-18 | Some Dahua products have the problem of denial of service during the login process. An attacker can cause a device crashed by constructing a malicious packet… |
CVE-2019-9677 | Critical | 9.8 | 2019-09-18 | The specific fields of CGI interface of some Dahua products are not strictly verified, an attacker can cause a buffer overflow by constructing malicious packet… |
CVE-2019-14458 | High | 7.5 | 2019-09-18 | VIVOTEK IP Camera devices with firmware before 0x20x allow a denial of service via a crafted HTTP header. |
CVE-2019-1975 | Medium | 6.1 | 2019-09-18 | A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS)… |
CVE-2019-12620 | Medium | 5.3 | 2019-09-18 | A vulnerability in the statistics collection service of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to inject arbitrary values on… |
CVE-2019-14254 | Critical | 9.8 | 2019-09-18 | An issue was discovered in the secure portal in Publisure 2.1.2. Because SQL queries are not well sanitized, there are multiple SQL injections in userAccFuncti… |
CVE-2019-14253 | Medium | 6.5 | 2019-09-18 | An issue was discovered in servletcontroller in the secure portal in Publisure 2.1.2. One can bypass authentication and perform a query on PHP forms within the… |
CVE-2019-14252 | High | 7.2 | 2019-09-18 | An issue was discovered in the secure portal in Publisure 2.1.2. Once successfully authenticated as an administrator, one is able to inject arbitrary PHP code… |
CVE-2019-15843 | High | 7.4 | 2019-09-18 | A malicious file upload vulnerability was discovered in Xiaomi Millet mobile phones 1-6.3.9.3. A particular condition involving a man-in-the-middle attack may… |