2019 CVEs (page 81)
Page 81 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-16170 | High | 7.1 | 2019-09-16 | An issue was discovered in GitLab Enterprise Edition 11.x and 12.x before 12.0.9, 12.1.x before 12.1.9, and 12.2.x before 12.2.5. It has Incorrect Access Contr… |
CVE-2019-16057 | Critical | 9.8 | 2019-09-16 | The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection. |
CVE-2019-13474 | Critical | 9.8 | 2019-09-16 | TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd, Imperial i400, Imperial i450, Imperial… |
CVE-2019-16335 | Critical | 9.8 | 2019-09-15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different… |
CVE-2019-16334 | Medium | 4.8 | 2019-09-15 | In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories -> Add New Category -> Name field. NOTE: this may overlap CVE-2017-16636. |
CVE-2019-16333 | Medium | 5.4 | 2019-09-15 | GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php. |
CVE-2019-16332 | Medium | 6.1 | 2019-09-15 | In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is poss… |
CVE-2019-14540 | Critical | 9.8 | 2019-09-15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig. |
CVE-2019-16321 | Medium | 6.1 | 2019-09-15 | ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATH_INFO. |
CVE-2019-16320 | Medium | 5.3 | 2019-09-15 | Cobham Sea Tel v170 224521 through v194 225444 devices allow attackers to obtain potentially sensitive information, such as a vessel's latitude and longitude… |
CVE-2019-16319 | High | 7.5 | 2019-09-15 | In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite loop. This was addressed in plugins/epan/gryphon/packet-grypho… |
CVE-2019-16318 | High | 8.8 | 2019-09-14 | In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failur… |
CVE-2019-16317 | High | 8.8 | 2019-09-14 | In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uplo… |
CVE-2019-16307 | Medium | 6.1 | 2019-09-14 | A Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp and deleteWebExMeetingCheck.jsp in Fuji Xerox DocuShare throu… |
CVE-2019-16314 | Critical | 9.8 | 2019-09-14 | Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2. |
CVE-2019-16313 | High | 7.5 | 2019-09-14 | ifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML source code. |
CVE-2019-16312 | Medium | 6.1 | 2019-09-14 | s-cms V3.0 has XSS in index.php?type=text via the S_id parameter. |
CVE-2019-16311 | High | 8.8 | 2019-09-14 | NIUSHOP V1.11 has CSRF via search_info to index.php. |
CVE-2019-16310 | Medium | 5.4 | 2019-09-14 | NIUSHOP V1.11 has XSS via the index.php?s=/admin URI. |
CVE-2019-16309 | Critical | 9.8 | 2019-09-14 | FlameCMS 3.3.5 has SQL injection in account/login.php via accountName. |
CVE-2019-16294 | High | 7.8 | 2019-09-14 | SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file. |
CVE-2019-16305 | High | 8.8 | 2019-09-14 | In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted link can trigger a popup asking whether the user wants to run Mo… |
CVE-2019-16303 | Critical | 9.8 | 2019-09-14 | A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache… |
CVE-2019-5485 | Critical | 10.0 | 2019-09-13 | NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be injected through the repository name. |
CVE-2019-5484 | High | 7.5 | 2019-09-13 | Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitra… |
CVE-2019-11660 | High | 7.8 | 2019-09-13 | Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40. This vulnerability could be expl… |
CVE-2019-5315 | High | 7.2 | 2019-09-13 | A command injection vulnerability is present in the web management interface of ArubaOS that permits an authenticated user to execute arbitrary commands on the… |
CVE-2019-5314 | Medium | 6.1 | 2019-09-13 | Some web components in the ArubaOS software are vulnerable to HTTP Response splitting (CRLF injection) and Reflected XSS. An attacker would be able to accompli… |
CVE-2019-16293 | High | 8.8 | 2019-09-13 | The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field. |
CVE-2019-13923 | Critical | 9.6 | 2019-09-13 | A vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway (All versions). The integrated configuration web server of the affected device could… |
CVE-2019-13922 | Low | 2.7 | 2019-09-13 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). An attacker with administrative privileges can obtain the hash o… |
CVE-2019-13920 | Medium | 4.3 | 2019-09-13 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some parts of the web application are not protected against Cros… |
CVE-2019-13919 | Medium | 4.3 | 2019-09-13 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some pages that should only be accessible by a privileged user c… |
CVE-2019-13918 | Critical | 9.8 | 2019-09-13 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). The web interface has no means to prevent password guessing atta… |
CVE-2019-13548 | Critical | 9.8 | 2019-09-13 | CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow… |
CVE-2019-13532 | High | 7.5 | 2019-09-13 | CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files out… |
CVE-2019-10937 | High | 7.5 | 2019-09-13 | A vulnerability has been identified in SIMATIC TDC CP51M1 (All versions < V1.1.7). An attacker with network access to the device could cause a Denial-of-Servic… |
CVE-2019-16289 | Medium | 5.4 | 2019-09-13 | The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter. |
CVE-2019-16288 | High | 7.5 | 2019-09-13 | On Tenda N301 wireless routers, a long string in the wifiSSID parameter of a goform/setWifi POST request causes the device to crash. |
CVE-2019-3646 | Medium | 6.9 | 2019-09-13 | DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Free Antivirus Trial 16.0.R18 and earlier allows local us… |
CVE-2019-15031 | Medium | 4.4 | 2019-09-13 | In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via an interrupt. To exploit the v… |
CVE-2019-15030 | Medium | 4.4 | 2019-09-13 | In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable excepti… |
CVE-2019-13364 | Critical | 9.6 | 2019-09-13 | admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter. This is exploitable… |
CVE-2019-13363 | Critical | 9.6 | 2019-09-13 | admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_send_detailed_… |
CVE-2019-12922 | Medium | 6.5 | 2019-09-13 | A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page. |
CVE-2019-12517 | Medium | 6.1 | 2019-09-13 | An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality available via the /wp-admin/admin-ajax.php… |
CVE-2019-12516 | High | 8.8 | 2019-09-13 | The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id=… |
CVE-2019-16277 | High | 7.8 | 2019-09-13 | PicoC 2.1 has a heap-based buffer overflow in StringStrcpy in cstdlib/string.c when called from ExpressionParseFunctionCall in expression.c. |
CVE-2019-16275 | Medium | 6.5 | 2019-09-12 | hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mi… |
CVE-2019-13534 | High | 7.2 | 2019-09-12 | Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Fi… |
CVE-2019-13530 | High | 7.2 | 2019-09-12 | Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Fi… |
CVE-2019-8076 | High | 7.8 | 2019-09-12 | Adobe application manager installer version 10.0 have an Insecure Library Loading (DLL hijacking) vulnerability. Successful exploitation could lead to Arbitrar… |
CVE-2019-8070 | Critical | 9.8 | 2019-09-12 | Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use after free vulnerability. Successful exploitation could lead to… |
CVE-2019-8069 | Critical | 9.8 | 2019-09-12 | Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Same Origin Method Execution vulnerability. Successful exploitation… |
CVE-2019-11899 | High | 7.5 | 2019-09-12 | An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a client installation. With Bosch Access Pr… |
CVE-2019-11898 | Critical | 9.9 | 2019-09-12 | Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. The service tool is discontinued with Bosch Acc… |
CVE-2019-14237 | Critical | 9.8 | 2019-09-12 | On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeat… |
CVE-2019-14236 | Critical | 9.8 | 2019-09-12 | On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection… |
CVE-2019-11774 | High | 7.4 | 2019-09-12 | Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for… |
CVE-2019-11773 | High | 7.8 | 2019-09-12 | Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users. |
CVE-2019-6009 | Medium | 6.1 | 2019-09-12 | Open redirect vulnerability in SHIRASAGI v1.7.0 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via u… |
CVE-2019-6007 | High | 8.8 | 2019-09-12 | Integer overflow vulnerability in apng-drawable 1.0.0 to 1.6.0 allows an attacker to cause a denial of service (DoS) condition or execute arbitrary code via un… |
CVE-2019-6005 | Critical | 9.8 | 2019-09-12 | Smart TV Box firmware version prior to 1300 allows remote attackers to bypass access restriction to conduct arbitrary operations on the device without user's i… |
CVE-2019-6004 | Medium | 6.1 | 2019-09-12 | Open redirect vulnerability in ApeosWare Management Suite Ver.1.4.0.18 and earlier, and ApeosWare Management Suite 2 Ver.2.1.2.4 and earlier allow remote attac… |
CVE-2019-6003 | Medium | 6.1 | 2019-09-12 | Cross-site scripting vulnerability in EC-CUBE plugin 'Amazon Pay Plugin 2.12,2.13' version 2.4.2 and earlier allows remote attackers to inject arbitrary web sc… |
CVE-2019-5996 | High | 8.8 | 2019-09-12 | SQL injection vulnerability in the Video Insight VMS 7.3.2.5 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecifie… |
CVE-2019-5993 | High | 8.8 | 2019-09-12 | Cross-site request forgery (CSRF) vulnerability in Category Specific RSS feed Subscription version v2.0 and earlier allows remote attackers to hijack the authe… |
CVE-2019-5992 | High | 8.8 | 2019-09-12 | Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentic… |
CVE-2019-5991 | High | 7.6 | 2019-09-12 | SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.3 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vector… |
CVE-2019-5986 | High | 8.8 | 2019-09-12 | Cross-site request forgery (CSRF) vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHON… |
CVE-2019-5985 | Medium | 6.1 | 2019-09-12 | Cross-site scripting vulnerability in Hikari Denwa router/Home GateWay (Hikari Denwa router/Home GateWay provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPOR… |
CVE-2019-5978 | Medium | 6.1 | 2019-09-12 | Open redirect vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via… |
CVE-2019-5977 | Medium | 4.3 | 2019-09-12 | Mail header injection vulnerability in Cybozu Garoon 4.0.0 to 4.10.2 may allow a remote authenticated attackers to alter mail header via the application 'E-Mai… |
CVE-2019-5976 | Medium | 4.9 | 2019-09-12 | Cybozu Garoon 4.0.0 to 4.10.2 allows an attacker with administrative rights to cause a denial of service condition via unspecified vectors. |
CVE-2019-5975 | Medium | 5.4 | 2019-09-12 | DOM-based cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.2 allows remote authenticated attackers to inject arbitrary web script or HTML via… |
CVE-2019-5956 | Medium | 6.5 | 2019-09-12 | Directory traversal vulnerability in WonderCMS 2.6.0 and earlier allows remote attackers to delete arbitrary files via unspecified vectors. |
CVE-2019-3638 | High | 8.1 | 2019-09-12 | Reflected Cross Site Scripting vulnerability in Administrators web console in McAfee Web Gateway (MWG) 7.8.x prior to 7.8.2.13 allows remote attackers to colle… |
CVE-2019-16238 | Medium | 6.1 | 2019-09-12 | Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login. |
CVE-2019-16261 | Critical | 9.1 | 2019-09-12 | Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the ma… |
CVE-2019-10400 | Medium | 4.2 | 2019-09-12 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment and decrement expressi… |
CVE-2019-10399 | Medium | 4.2 | 2019-09-12 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions in incremen… |
CVE-2019-10398 | Medium | 5.5 | 2019-09-12 | Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed… |
CVE-2019-10397 | Low | 3.1 | 2019-09-12 | Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentiall… |
CVE-2019-10396 | Medium | 5.4 | 2019-09-12 | Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able t… |
CVE-2019-10395 | Medium | 5.4 | 2019-09-12 | Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerability in Jenkins 2.14… |
CVE-2019-10394 | Medium | 4.2 | 2019-09-12 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions on the left… |
CVE-2019-10393 | Medium | 4.2 | 2019-09-12 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed at… |
CVE-2019-10392 | High | 8.8 | 2019-09-12 | Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting… |
CVE-2019-16257 | Critical | 9.8 | 2019-09-12 | Some Motorola devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI i… |
CVE-2019-16256 | Critical | 9.8 | 2019-09-12 | Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI in… |
CVE-2019-16250 | High | 7.5 | 2019-09-11 | includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Shee… |
CVE-2019-16249 | Medium | 5.3 | 2019-09-11 | OpenCV 4.1.1 has an out-of-bounds read in hal_baseline::v_load in core/hal/intrin_sse.hpp when called from computeSSDMeanNorm in modules/video/src/dis_flow.cpp. |
CVE-2019-16248 | Medium | 5.5 | 2019-09-11 | The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory. In other words, there is a p… |
CVE-2019-5055 | High | 7.5 | 2019-09-11 | An exploitable denial-of-service vulnerability exists in the Host Access Point Daemon (hostapd) on the NETGEAR N300 (WNR2000v5 with Firmware Version V1.0.0.70)… |
CVE-2019-5054 | High | 7.5 | 2019-09-11 | An exploitable denial-of-service vulnerability exists in the session handling functionality of the NETGEAR N300 (WNR2000v5 with Firmware Version V1.0.0.70) HTT… |
CVE-2019-1306 | Critical | 9.8 | 2019-09-11 | A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properly, aka 'Azure DevOps… |
CVE-2019-1305 | Medium | 5.4 | 2019-09-11 | A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross… |
CVE-2019-1303 | High | 7.8 | 2019-09-11 | An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker… |
CVE-2019-1302 | High | 8.8 | 2019-09-11 | An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web… |
CVE-2019-1301 | High | 7.5 | 2019-09-11 | A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'. |