2019 CVEs (page 8)
Page 8 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-12266 | High | 7.6 | 2022-03-30 | Stack-based Buffer Overflow vulnerability in Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to run arbitrary code on the affected device. This issue affect… |
CVE-2019-25058 | High | 7.8 | 2022-02-24 | An issue was discovered in USBGuard before 1.1.0. On systems with the usbguard-dbus daemon running, an unprivileged user could make USBGuard allow all USB devi… |
CVE-2019-4352 | Low | 2.4 | 2022-02-16 | IBM Maximo Anywhere 7.6.4.0 applications could allow obfuscation of the application source code. IBM X-Force ID: 161494. |
CVE-2019-4351 | Medium | 4.6 | 2022-02-16 | IBM Maximo Anywhere 7.6.4.0 applications could disclose sensitive information to a user with physical access to the device. IBM X-Force ID: 161493. |
CVE-2019-4291 | Medium | 6.5 | 2022-02-16 | IBM Maximo Anywhere 7.6.4.0 could allow an attacker to reverse engineer the application due to the lack of binary protection precautions. IBM X-Force ID: 16069… |
CVE-2019-25057 | High | 7.5 | 2022-02-14 | In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer. |
CVE-2019-16864 | High | 8.8 | 2022-02-14 | CompleteFTPService.exe in the server in EnterpriseDT CompleteFTP before 12.1.4 allows Remote Code Execution by leveraging a Windows user account that has SSH a… |
CVE-2019-25056 | Medium | 5.3 | 2022-01-26 | In Bromite through 78.0.3904.130, there are adblock rules in the release APK; therefore, probing which resources are blocked and which aren't can identify the… |
CVE-2019-20082 | Critical | 9.8 | 2021-12-28 | ASUS RT-N53 3.0.0.4.376.3754 devices have a buffer overflow via a long lan_dns1_x or lan_dns2_x parameter to Advanced_LAN_Content.asp. |
CVE-2019-25055 | High | 7.5 | 2021-12-27 | An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary. |
CVE-2019-25054 | High | 7.5 | 2021-12-27 | An issue was discovered in the pnet crate before 0.27.2 for Rust. There is a segmentation fault (upon attempted dereference of an uninitialized descriptor) bec… |
CVE-2019-8703 | Critical | 9.8 | 2021-12-23 | This issue was addressed with improved entitlements. This issue is fixed in watchOS 6, tvOS 13, macOS Catalina 10.15, iOS 13. An application may be able to gai… |
CVE-2019-8702 | Medium | 5.5 | 2021-12-23 | This issue was addressed with a new entitlement. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Si… |
CVE-2019-8643 | Critical | 9.8 | 2021-12-23 | CVE-2019-8643: Arun Sharma of VMWare This issue is fixed in macOS Mojave 10.14. Description: A logic issue was addressed with improved state management.. |
CVE-2019-19138 | High | 7.5 | 2021-12-15 | Ivanti Workspace Control before 10.4.50.0 allows attackers to degrade integrity. |
CVE-2019-8922 | High | 8.8 | 2021-11-29 | A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there is enough space in the destination buff… |
CVE-2019-8921 | Medium | 6.5 | 2021-11-29 | An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a… |
CVE-2019-5640 | Low | 3.3 | 2021-11-22 | Rapid7 Nexpose versions prior to 6.6.114 suffer from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker ca… |
CVE-2019-18914 | Medium | 6.1 | 2021-11-09 | A potential security vulnerability has been identified for certain HP printers and MFPs that would allow redirection page Cross-Site Scripting in a client’s br… |
CVE-2019-18912 | High | 7.8 | 2021-11-09 | A potential security vulnerability has been identified for certain HP printers and MFPs with Troy solutions. For affected printers with FutureSmart Firmware bu… |
CVE-2019-16240 | Critical | 9.1 | 2021-11-09 | A Buffer Overflow and Information Disclosure issue exists in HP OfficeJet Pro Printers before 001.1937C, and HP PageWide Managed Printers and HP PageWide Pro P… |
CVE-2019-18916 | High | 7.8 | 2021-11-09 | A potential security vulnerability has been identified for HP LaserJet Solution Software (for certain HP LaserJet Printers) which may lead to unauthorized elev… |
CVE-2019-19810 | Critical | 10.0 | 2021-10-28 | Zoom Call Recording 6.3.1 from Eleveo is vulnerable to Java Deserialization attacks targeting the inbuilt RMI service. A remote unauthenticated attacker can ex… |
CVE-2019-3556 | High | 8.1 | 2021-10-26 | HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to outp… |
CVE-2019-6288 | Critical | 9.8 | 2021-09-22 | Edgecore ECS2020 Firmware 1.0.0.0 devices allow Unauthenticated Command Injection via the command1 HTTP header to the /EXCU_SHELL URI. |
CVE-2019-16651 | Medium | 5.3 | 2021-09-20 | An issue was discovered on Virgin Media Super Hub 3 (based on ARRIS TG2492) devices. Because their SNMP commands have insufficient protection mechanisms, it is… |
CVE-2019-9060 | High | 7.5 | 2021-09-17 | An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExtensions module (in the file action.setde… |
CVE-2019-10941 | Medium | 5.3 | 2021-09-14 | A vulnerability has been identified in SINEMA Server (All versions < V14 SP3). Missing authentication for functionality that requires administrative user ident… |
CVE-2019-20101 | Medium | 5.3 | 2021-09-14 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via a Broken Access Control vulnerability i… |
CVE-2019-5318 | Medium | 6.5 | 2021-09-07 | A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba Operating System Software version(s): 6.x.x.x: all versions, 8.x.x.x: all vers… |
CVE-2019-10095 | Critical | 9.8 | 2021-09-02 | bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache… |
CVE-2019-25052 | Critical | 9.1 | 2021-08-11 | In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a cra… |
CVE-2019-14453 | High | 8.8 | 2021-08-03 | An issue was discovered in Comelit "App lejos de casa (web)" 2.8.0. It allows privilege escalation via modified domus and logged fields, related to js/bridge.m… |
CVE-2019-20467 | Critical | 9.8 | 2021-07-22 | An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. The device by default has a TELNET interface available (which is n… |
CVE-2019-25051 | High | 7.8 | 2021-07-20 | objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_l… |
CVE-2019-25050 | High | 7.8 | 2021-07-20 | netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_att_tc and nc_get_att_text) and in uffd_cleanup (calle… |
CVE-2019-3752 | High | 8.2 | 2021-07-16 | Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1, 2.2, 2.3 and 2.4… |
CVE-2019-11098 | Medium | 6.8 | 2021-07-14 | Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/o… |
CVE-2019-25049 | High | 7.1 | 2021-07-01 | LibreSSL 2.9.1 through 3.2.1 has an out-of-bounds read in asn1_item_print_ctx (called from asn1_template_print_ctx). |
CVE-2019-25048 | High | 7.1 | 2021-07-01 | LibreSSL 2.9.1 through 3.2.1 has a heap-based buffer over-read in do_print_ex (called from asn1_item_print_ctx and ASN1_item_print). |
CVE-2019-18906 | Critical | 9.8 | 2021-06-30 | A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the… |
CVE-2019-25047 | Medium | 6.1 | 2021-06-21 | Greenbone Security Assistant (GSA) before 8.0.2 and Greenbone OS (GOS) before 5.0.10 allow XSS during 404 URL handling in gsad. |
CVE-2019-9475 | Medium | 5.5 | 2021-06-11 | In /proc/net of the kernel filesystem, there is a possible information leak due to a permissions bypass. This could lead to local information disclosure with n… |
CVE-2019-25046 | Medium | 6.1 | 2021-06-10 | The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG document. |
CVE-2019-17567 | Medium | 5.3 | 2021-06-10 | Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the who… |
CVE-2019-25045 | High | 7.8 | 2021-06-07 | An issue was discovered in the Linux kernel before 5.0.19. The XFRM subsystem has a use-after-free, related to an xfrm_state_fini panic, aka CID-dbb2483b2a46. |
CVE-2019-14584 | High | 7.8 | 2021-06-03 | Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2019-12067 | Medium | 6.5 | 2021-06-02 | The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) when the command header 'ad->cur_cmd' is nu… |
CVE-2019-4730 | High | 7.1 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit thi… |
CVE-2019-4724 | High | 7.5 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Content… |
CVE-2019-4723 | High | 7.5 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings in New Data Se… |
CVE-2019-4722 | Medium | 4.3 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information via a stack trace due to mishandling of certain error conditio… |
CVE-2019-4653 | Medium | 5.4 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2019-4471 | Medium | 6.5 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for a sensitive… |
CVE-2019-25030 | Medium | 5.5 | 2021-05-26 | In Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive cryptographic hash function or key derivation function prior to storage… |
CVE-2019-25029 | Critical | 9.8 | 2021-05-26 | In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable applic… |
CVE-2019-4588 | High | 7.8 | 2021-05-26 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to execute arbitrary code and conduc… |
CVE-2019-14836 | High | 8.8 | 2021-05-26 | A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login CSRF. An attacker could use this flaw to access un… |
CVE-2019-12348 | Critical | 9.8 | 2021-05-24 | An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter. |
CVE-2019-14827 | Medium | 6.1 | 2021-05-17 | A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. Mustache helper t… |
CVE-2019-25044 | High | 7.8 | 2021-05-14 | The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalatio… |
CVE-2019-10062 | Medium | 6.1 | 2021-05-13 | The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts… |
CVE-2019-19276 | Medium | 5.3 | 2021-05-12 | A vulnerability has been identified in SIMATIC HMI Comfort Panels 1st Generation (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile… |
CVE-2019-25043 | Medium | 5.3 | 2021-05-06 | ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error and worker-process crash for a "Cookie… |
CVE-2019-25042 | Critical | 9.8 | 2021-04-27 | Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy. NOTE: The vendor disputes that this is a vulnerability. Although the co… |
CVE-2019-25041 | High | 7.5 | 2021-04-27 | Unbound before 1.9.5 allows an assertion failure via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the… |
CVE-2019-25040 | High | 7.5 | 2021-04-27 | Unbound before 1.9.5 allows an infinite loop via a compressed name in dname_pkt_copy. NOTE: The vendor disputes that this is a vulnerability. Although the code… |
CVE-2019-25039 | Critical | 9.8 | 2021-04-27 | Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c. NOTE: The vendor disputes that this is a vulnerability. Although the… |
CVE-2019-25038 | Critical | 9.8 | 2021-04-27 | Unbound before 1.9.5 allows an integer overflow in a size calculation in dnscrypt/dnscrypt.c. NOTE: The vendor disputes that this is a vulnerability. Although… |
CVE-2019-25037 | High | 7.5 | 2021-04-27 | Unbound before 1.9.5 allows an assertion failure and denial of service in dname_pkt_copy via an invalid packet. NOTE: The vendor disputes that this is a vulner… |
CVE-2019-25036 | High | 7.5 | 2021-04-27 | Unbound before 1.9.5 allows an assertion failure and denial of service in synth_cname. NOTE: The vendor disputes that this is a vulnerability. Although the cod… |
CVE-2019-25035 | Critical | 9.8 | 2021-04-27 | Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vu… |
CVE-2019-25034 | Critical | 9.8 | 2021-04-27 | Unbound before 1.9.5 allows an integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write. NOTE: The vendor disputes that this is a… |
CVE-2019-25033 | Critical | 9.8 | 2021-04-27 | Unbound before 1.9.5 allows an integer overflow in the regional allocator via the ALIGN_UP macro. NOTE: The vendor disputes that this is a vulnerability. Altho… |
CVE-2019-25032 | Critical | 9.8 | 2021-04-27 | Unbound before 1.9.5 allows an integer overflow in the regional allocator via regional_alloc. NOTE: The vendor disputes that this is a vulnerability. Although… |
CVE-2019-25031 | Medium | 5.9 | 2021-04-27 | Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session… |
CVE-2019-25028 | Medium | 5.4 | 2021-04-23 | Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8… |
CVE-2019-25027 | Medium | 6.1 | 2021-04-23 | Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1… |
CVE-2019-10881 | Critical | 9.8 | 2021-04-13 | Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 includes two accounts with… |
CVE-2019-15059 | High | 7.5 | 2021-04-12 | In Liberty lisPBX 2.0-4, configuration backup files can be retrieved remotely from /backup/lispbx-CONF-YYYY-MM-DD.tar or /backup/lispbx-CDR-YYYY-MM-DD.tar with… |
CVE-2019-17656 | Medium | 5.4 | 2021-04-12 | A Stack-based Buffer Overflow vulnerability in the HTTPD daemon of FortiOS 6.0.10 and below, 6.2.2 and below and FortiProxy 1.0.x, 1.1.x, 1.2.9 and below, 2.0… |
CVE-2019-25026 | Medium | 5.3 | 2021-04-06 | Redmine before 3.4.13 and 4.x before 4.0.6 mishandles markup data during Textile formatting. |
CVE-2019-20466 | High | 7.8 | 2021-04-02 | An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. A local attacker with the "default" account is capable of reading… |
CVE-2019-20465 | High | 7.5 | 2021-04-02 | An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. It is possible (using TELNET without a password) to control the ca… |
CVE-2019-20464 | High | 7.5 | 2021-04-02 | An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. By default, a mobile application is used to stream over UDP. Howev… |
CVE-2019-20463 | High | 7.5 | 2021-04-02 | An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. A crash and reboot can be triggered by crafted IP traffic, as demo… |
CVE-2019-5319 | Critical | 9.8 | 2021-03-30 | A remote buffer overflow vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4.17 an… |
CVE-2019-5317 | Medium | 6.8 | 2021-03-29 | A local authentication bypass vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.4.x: 6.4.4.8-4.2.4… |
CVE-2019-19354 | High | 7.8 | 2021-03-24 | An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hadoop as shipped in Red Hat Openshift 4. An attacker with a… |
CVE-2019-19353 | High | 7.0 | 2021-03-24 | An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hive as shipped in Red Hat Openshift 4. An attacker with acc… |
CVE-2019-19352 | High | 7.0 | 2021-03-24 | An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/presto as shipped in Red Hat Openshift 4. An attacker with a… |
CVE-2019-19350 | High | 7.8 | 2021-03-24 | An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ansible-service-broker as shipped in Red Hat Openshift 4 and 3.11. An… |
CVE-2019-19349 | High | 7.8 | 2021-03-24 | An insecure modification vulnerability in the /etc/passwd file was found in the container operator-framework/operator-metering as shipped in Red Hat Openshift… |
CVE-2019-19343 | High | 7.5 | 2021-03-23 | A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener due to holding remote… |
CVE-2019-14831 | Medium | 6.1 | 2021-03-19 | A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where forum subscribe link contained an open red… |
CVE-2019-14830 | Medium | 6.1 | 2021-03-19 | A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the mobile launch endpoint contained an op… |
CVE-2019-14829 | Medium | 4.3 | 2021-03-19 | A vulnerability was found in Moodle affection 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions where activity creation capabilities we… |
CVE-2019-14828 | Medium | 4.3 | 2021-03-19 | A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where users with the capability to cre… |
CVE-2019-10225 | Medium | 6.3 | 2021-03-19 | A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS… |
CVE-2019-10200 | High | 7.2 | 2021-03-19 | A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedule workloads on mast… |