2019 CVEs (page 84)
Page 84 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-6784 | Medium | 6.1 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 1 of 2)… |
CVE-2019-6783 | High | 8.8 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. GitLab Pages contains a direc… |
CVE-2019-6782 | High | 7.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclos… |
CVE-2019-16190 | Critical | 9.8 | 2019-09-09 | SharePort Web Access on D-Link DIR-868L REVB through 2.03, DIR-885L REVA through 1.20, and DIR-895L REVA through 1.21 devices allows Authentication Bypass, as… |
CVE-2019-16173 | Medium | 5.4 | 2019-09-09 | LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in application… |
CVE-2019-16172 | Medium | 5.4 | 2019-09-09 | LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey grou… |
CVE-2019-11605 | High | 7.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition 11.8.x before 11.8.10, 11.9.x before 11.9.11, and 11.10.x before 11.10.3. It allows Informat… |
CVE-2019-11549 | Medium | 6.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. Gitaly… |
CVE-2019-11548 | Medium | 5.4 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9. It has Incorrect Access Control. Unprivileged members of a project are able t… |
CVE-2019-11547 | Medium | 6.1 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has Improper Encoding o… |
CVE-2019-11546 | Medium | 5.3 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition wh… |
CVE-2019-11545 | Medium | 4.3 | 2019-09-09 | An issue was discovered in GitLab Community Edition 11.9.x before 11.9.10 and 11.10.x before 11.10.2. It allows Information Disclosure. When an issue is moved… |
CVE-2019-11544 | Medium | 4.3 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. I… |
CVE-2019-5473 | High | 7.2 | 2019-09-09 | An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitLab 12.1.2 and 12.0.4. |
CVE-2019-5471 | Medium | 5.4 | 2019-09-09 | An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSS. This was addresse… |
CVE-2019-5467 | Medium | 5.4 | 2019-09-09 | An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. This vulnerability… |
CVE-2019-5463 | Medium | 5.3 | 2019-09-09 | An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of the build status. This vulnerability was… |
CVE-2019-5483 | Medium | 5.3 | 2019-09-09 | Seneca < 3.9.0 contains a vulnerability that could lead to exposing environment variables to unauthorized users. |
CVE-2019-5461 | Low | 3.5 | 2019-09-09 | An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary POST requests in a… |
CVE-2019-16168 | Medium | 6.5 | 2019-09-09 | In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field… |
CVE-2019-16167 | Medium | 5.5 | 2019-09-09 | sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c. |
CVE-2019-16166 | Medium | 6.5 | 2019-09-09 | GNU cflow through 1.6 has a heap-based buffer over-read in the nexttoken function in parser.c. |
CVE-2019-16165 | Medium | 6.5 | 2019-09-09 | GNU cflow through 1.6 has a use-after-free in the reference function in parser.c. |
CVE-2019-16164 | Medium | 6.5 | 2019-09-09 | MyHTML through 4.0.5 has a NULL pointer dereference in myhtml_tree_node_remove in tree.c. |
CVE-2019-16163 | High | 7.5 | 2019-09-09 | Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. |
CVE-2019-16162 | High | 7.5 | 2019-09-09 | Onigmo through 6.2.0 has an out-of-bounds read in parse_char_class because of missing codepoint validation in regenc.c. |
CVE-2019-16161 | High | 7.5 | 2019-09-09 | Onigmo through 6.2.0 has a NULL pointer dereference in onig_error_code_to_str because of fetch_token in regparse.c. |
CVE-2019-12405 | Critical | 9.8 | 2019-09-09 | Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component. Given a u… |
CVE-2019-16159 | High | 7.5 | 2019-09-09 | BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8203 administrative… |
CVE-2019-12465 | High | 8.1 | 2019-09-09 | An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajax_rulesuggest.php file where the term parameter is used insecurely in… |
CVE-2019-12464 | High | 7.5 | 2019-09-09 | An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a partial filename in… |
CVE-2019-12463 | High | 8.8 | 2019-09-09 | An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options (includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.p… |
CVE-2019-10671 | High | 8.8 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An auth… |
CVE-2019-10670 | Medium | 6.1 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function mysqli_escape_real_string for filtering data. However, this is parti… |
CVE-2019-16148 | Medium | 6.1 | 2019-09-09 | Sakai through 12.6 allows XSS via a chat user name. |
CVE-2019-16146 | Medium | 4.8 | 2019-09-09 | Gophish through 0.8.0 allows XSS via a username. |
CVE-2019-16114 | Critical | 9.8 | 2019-09-09 | In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to t… |
CVE-2019-15895 | High | 7.5 | 2019-09-09 | search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes. |
CVE-2019-15639 | High | 7.5 | 2019-09-09 | main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific sc… |
CVE-2019-10669 | High | 7.2 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. There is a command injection vulnerability in html/includes/graphs/device/collectd.inc.php where user supplie… |
CVE-2019-10668 | Critical | 9.1 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. S… |
CVE-2019-10667 | Medium | 5.3 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose l… |
CVE-2019-10666 | High | 8.1 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script inclusion via the include() function on user supplied input wit… |
CVE-2019-10665 | Critical | 9.8 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options (html/includes/graphs/common.inc.php and html/includes/graphs/gr… |
CVE-2019-16144 | High | 7.5 | 2019-09-09 | An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield_ during API calls. |
CVE-2019-16143 | Critical | 9.8 | 2019-09-09 | An issue was discovered in the blake2 crate before 0.8.1 for Rust. The BLAKE2b and BLAKE2s algorithms, when used with HMAC, produce incorrect results because t… |
CVE-2019-16142 | Critical | 9.8 | 2019-09-09 | An issue was discovered in the renderdoc crate before 0.5.0 for Rust. Multiple exposed methods take self by immutable reference, which is incompatible with a m… |
CVE-2019-16141 | High | 7.5 | 2019-09-09 | An issue was discovered in the once_cell crate before 1.0.1 for Rust. There is a panic during initialization of Lazy. |
CVE-2019-16140 | Critical | 9.8 | 2019-09-09 | An issue was discovered in the chttp crate before 0.1.3 for Rust. There is a use-after-free during buffer conversion. |
CVE-2019-16139 | Critical | 9.8 | 2019-09-09 | An issue was discovered in the compact_arena crate before 0.4.0 for Rust. Generativity is mishandled, leading to an out-of-bounds write or read. |
CVE-2019-16138 | Critical | 9.8 | 2019-09-09 | An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, l… |
CVE-2019-16137 | High | 7.5 | 2019-09-09 | An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used. Because memory ordering is mishandled, two writers can acquire the lock a… |
CVE-2019-16133 | Medium | 6.5 | 2019-09-09 | An issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the account names and passwords of all employees in the company can… |
CVE-2019-16132 | Medium | 6.5 | 2019-09-09 | An issue was discovered in OKLite v1.2.25. framework/admin/tpl_control.php allows remote attackers to delete arbitrary files via a title directory-traversal pa… |
CVE-2019-16131 | High | 8.8 | 2019-09-09 | framework/admin/modulec_control.php in OKLite v1.2.25 has an Arbitrary File Upload Vulnerability because a .php file from a ZIP archive can be written to /data… |
CVE-2019-16130 | Medium | 6.1 | 2019-09-09 | YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html. |
CVE-2019-16126 | Medium | 6.1 | 2019-09-09 | Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images. |
CVE-2019-16125 | Critical | 9.8 | 2019-09-09 | In Jobberbase 2.0, the parameter category is not sanitized in public/page_subscribe.php, leading to /subscribe SQL injection. |
CVE-2019-16124 | Critical | 9.8 | 2019-09-09 | In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert… |
CVE-2019-16123 | High | 7.5 | 2019-09-09 | In Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled, leading to ../ Local File Disclosure. |
CVE-2019-16120 | High | 8.8 | 2019-09-08 | CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees featur… |
CVE-2019-16119 | Critical | 9.8 | 2019-09-08 | SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id param… |
CVE-2019-16118 | Medium | 6.1 | 2019-09-08 | Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php. |
CVE-2019-16117 | Medium | 6.1 | 2019-09-08 | Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php. |
CVE-2019-16115 | High | 7.8 | 2019-09-08 | In Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction::transform in Function.cc, used by GfxAxialShading::getColor. It can, f… |
CVE-2019-16113 | High | 8.8 | 2019-09-08 | Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code ca… |
CVE-2019-16109 | Medium | 5.3 | 2019-09-08 | An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database reco… |
CVE-2019-16105 | Medium | 4.9 | 2019-09-08 | Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows ..%2f directory traversal via a rest/json/configdb/download/ URI. |
CVE-2019-16104 | Medium | 6.1 | 2019-09-08 | Silver Peak EdgeConnect SD-WAN before 8.1.7.x has reflected XSS via the rest/json/configdb/download/ PATH_INFO. |
CVE-2019-16103 | High | 7.2 | 2019-09-08 | Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows privilege escalation (by administrators) from the menu to a root Bash OS shell via the spsshell feature. |
CVE-2019-16102 | Critical | 9.8 | 2019-09-08 | Silver Peak EdgeConnect SD-WAN before 8.1.7.x has an SNMP service with a public value for rocommunity and trapcommunity. |
CVE-2019-16101 | Medium | 5.3 | 2019-09-08 | Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to obtain potentially sensitive stack traces by sending incorrect JSON data to the REST A… |
CVE-2019-16100 | High | 7.5 | 2019-09-08 | Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to trigger a web-interface outage via slow client-side HTTP traffic from a single source. |
CVE-2019-16099 | High | 8.8 | 2019-09-08 | Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows CSRF via JSON data to a .swf file. |
CVE-2019-16097 | Medium | 6.5 | 2019-09-08 | core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as aut… |
CVE-2019-16096 | High | 7.5 | 2019-09-08 | Kilo 0.0.1 has a heap-based buffer overflow because there is an integer overflow in a calculation involving the number of tabs in one row. |
CVE-2019-16095 | High | 7.5 | 2019-09-08 | Symonics libmysofa 0.7 has an invalid read in getDimension in hrtf/reader.c. |
CVE-2019-16094 | High | 7.5 | 2019-09-08 | Symonics libmysofa 0.7 has an invalid read in readOHDRHeaderMessageDataLayout in hdf/dataobject.c. |
CVE-2019-16093 | Critical | 9.8 | 2019-09-08 | Symonics libmysofa 0.7 has an invalid write in readOHDRHeaderMessageDataLayout in hdf/dataobject.c. |
CVE-2019-16092 | Critical | 9.8 | 2019-09-08 | Symonics libmysofa 0.7 has a NULL pointer dereference in getHrtf in hrtf/reader.c. |
CVE-2019-16091 | High | 7.5 | 2019-09-08 | Symonics libmysofa 0.7 has an out-of-bounds read in directblockRead in hdf/fractalhead.c. |
CVE-2019-16089 | Medium | 4.1 | 2019-09-06 | An issue was discovered in the Linux kernel through 5.2.13. nbd_genl_status in drivers/block/nbd.c does not check the nla_nest_start_noflag return value. |
CVE-2019-9461 | Medium | 6.5 | 2019-09-06 | In the Android kernel in VPN routing there is a possible information disclosure. This could lead to remote information disclosure by an adjacent network attack… |
CVE-2019-9458 | High | 7.0 | 2019-09-06 | In the Android kernel in the video driver there is a use after free due to a race condition. This could lead to local escalation of privilege with no additiona… |
CVE-2019-9456 | Medium | 6.7 | 2019-09-06 | In the Android kernel in Pixel C USB monitor driver there is a possible OOB write due to a missing bounds check. This could lead to local escalation of privile… |
CVE-2019-9455 | Low | 2.3 | 2019-09-06 | In the Android kernel in the video driver there is a kernel pointer leak due to a WARN_ON statement. This could lead to local information disclosure with Syste… |
CVE-2019-9454 | Medium | 6.7 | 2019-09-06 | In the Android kernel in i2c driver there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with Sys… |
CVE-2019-9453 | Medium | 4.4 | 2019-09-06 | In the Android kernel in F2FS touch driver there is a possible out of bounds read due to improper input validation. This could lead to local information disclo… |
CVE-2019-9452 | Medium | 4.4 | 2019-09-06 | In the Android kernel in SEC_TS touch driver there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclos… |
CVE-2019-9451 | Medium | 6.7 | 2019-09-06 | In the Android kernel in the touchscreen driver there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p… |
CVE-2019-9450 | Medium | 6.4 | 2019-09-06 | In the Android kernel in the FingerTipS touchscreen driver there is a possible memory corruption due to a race condition. This could lead to local escalation o… |
CVE-2019-9449 | Medium | 4.4 | 2019-09-06 | In the Android kernel in FingerTipS touchscreen driver there is a possible out of bounds read due to a missing bounds check. This could lead to local informati… |
CVE-2019-9448 | Medium | 6.7 | 2019-09-06 | In the Android kernel in the FingerTipS touchscreen driver there is a possible out of bounds write due to a missing bounds check. This could lead to a local es… |
CVE-2019-9447 | Medium | 6.7 | 2019-09-06 | In the Android kernel in the FingerTipS touchscreen driver there is a possible use-after-free due to improper locking. This could lead to a local escalation of… |
CVE-2019-9446 | Medium | 6.7 | 2019-09-06 | In the Android kernel in the FingerTipS touchscreen driver there is a possible out of bounds write due to improper input validation. This could lead to a local… |
CVE-2019-9445 | Medium | 4.4 | 2019-09-06 | In the Android kernel in F2FS driver there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with… |
CVE-2019-9444 | Medium | 4.4 | 2019-09-06 | In the Android kernel in sync debug fs driver there is a kernel pointer leak due to the usage of printf with %p. This could lead to local information disclosur… |
CVE-2019-9443 | Medium | 6.7 | 2019-09-06 | In the Android kernel in the vl53L0 driver there is a possible out of bounds write due to a permissions bypass. This could lead to local escalation of privileg… |
CVE-2019-9442 | Medium | 6.7 | 2019-09-06 | In the Android kernel in the mnh driver there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with Syst… |
CVE-2019-9441 | Medium | 6.7 | 2019-09-06 | In the Android kernel in the mnh driver there is a possible out of bounds write due to improper input validation. This could lead to escalation of privilege wi… |