2019 CVEs (page 86)
Page 86 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-15918 | High | 7.8 | 2019-09-04 | An issue was discovered in the Linux kernel before 5.0.10. SMB2_negotiate in fs/cifs/smb2pdu.c has an out-of-bounds read because data structures are incomplete… |
CVE-2019-15917 | High | 7.0 | 2019-09-04 | An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hci_uart_register_dev() fails in hci_uart_set_proto() in drivers… |
CVE-2019-6646 | High | 8.8 | 2019-09-04 | On BIG-IP 11.5.2-11.6.4 and Enterprise Manager 3.1.1, REST users with guest privileges may be able to escalate their privileges and run commands with admin pri… |
CVE-2019-6643 | High | 7.5 | 2019-09-04 | On versions 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, 12.1.0-12.1.4.1, and 11.5.2-11.6.4, an attacker sending specifically crafted DHCPv6 requests throu… |
CVE-2019-6647 | Medium | 5.3 | 2019-09-04 | On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, 12.1.0-12.1.4.1, 11.5.2-11.6.4, when processing authentication attempts for control-plane users MCPD… |
CVE-2019-6644 | Critical | 9.4 | 2019-09-04 | Similar to the issue identified in CVE-2018-12120, on versions 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, and 12.1.0-12.1.4 BIG-IP will bind a debug node… |
CVE-2019-6648 | Medium | 4.4 | 2019-09-04 | On version 1.9.0, If DEBUG logging is enable, F5 Container Ingress Service (CIS) for Kubernetes and Red Hat OpenShift (k8s-bigip-ctlr) log files may contain BI… |
CVE-2019-6645 | High | 7.5 | 2019-09-04 | On BIG-IP 14.0.0-14.1.0.5, 13.0.0-13.1.2, 12.1.0-12.1.4.1, 11.5.2-11.6.4, FTP traffic passing through a Virtual Server with both an active FTP profile associat… |
CVE-2019-13976 | Critical | 9.8 | 2019-09-04 | eGain Chat 15.0.3 allows unrestricted file upload. |
CVE-2019-13975 | Medium | 6.1 | 2019-09-04 | eGain Chat 15.0.3 allows HTML Injection. |
CVE-2019-15916 | High | 7.5 | 2019-09-04 | An issue was discovered in the Linux kernel before 5.0.1. There is a memory leak in register_queue_kobjects() in net/core/net-sysfs.c, which will cause denial… |
CVE-2019-13522 | High | 7.8 | 2019-09-04 | An attacker could use a specially crafted project file to corrupt the memory and execute code under the privileges of the EZ PLC Editor Versions 1.8.41 and pri… |
CVE-2019-13518 | High | 7.8 | 2019-09-04 | An attacker could use a specially crafted project file to overflow the buffer and execute code under the privileges of the EZ Touch Editor Versions 2.1.0 and p… |
CVE-2019-15814 | Medium | 5.4 | 2019-09-04 | Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML. |
CVE-2019-15813 | High | 8.8 | 2019-09-04 | Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arbitrary code via a webshell. |
CVE-2019-13209 | Medium | 6.1 | 2019-09-04 | Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher. The at… |
CVE-2019-10988 | Low | 3.4 | 2019-09-04 | In Philips HDI 4000 Ultrasound Systems, all versions running on old, unsupported operating systems such as Windows 2000, the HDI 4000 Ultrasound System is buil… |
CVE-2019-15718 | Medium | 4.4 | 2019-09-04 | In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls s… |
CVE-2019-12588 | Medium | 6.5 | 2019-09-04 | The client 802.11 mac implementation in Espressif ESP8266_NONOS_SDK 2.2.0 through 3.1.0 does not validate correctly the RSN AuthKey suite list count in beacon… |
CVE-2019-12587 | High | 8.1 | 2019-09-04 | The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows the installation of a zero Pairwise Maste… |
CVE-2019-10709 | Critical | 9.8 | 2019-09-04 | AsusPTPFilter.sys on Asus Precision TouchPad 11.0.0.25 hardware has a Pool Overflow associated with the \\.\AsusTP device, leading to a DoS or potentially priv… |
CVE-2019-15903 | High | 7.5 | 2019-09-04 | In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCu… |
CVE-2019-15902 | Medium | 5.6 | 2019-09-04 | A backporting error was discovered in the Linux stable/longterm kernel 4.4.x through 4.4.190, 4.9.x through 4.9.190, 4.14.x through 4.14.141, 4.19.x through 4… |
CVE-2019-15898 | Medium | 6.1 | 2019-09-03 | Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page. |
CVE-2019-15892 | High | 7.5 | 2019-09-03 | An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an a… |
CVE-2019-5480 | Medium | 5.3 | 2019-09-03 | A path traversal vulnerability in <= v0.9.7 of statichttpserver npm module allows attackers to list files in arbitrary folders. |
CVE-2019-5479 | High | 7.5 | 2019-09-03 | An unintended require vulnerability in <v0.5.5 larvitbase-api may allow an attacker to load arbitrary non-production code (JavaScript file). |
CVE-2019-5478 | Medium | 5.5 | 2019-09-03 | A weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices. This could lead to an adversary being able to modify the control fields of the boot… |
CVE-2019-5475 | High | 8.8 | 2019-09-03 | The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such a… |
CVE-2019-6182 | Medium | 4.9 | 2019-09-03 | A stored CSV Injection vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an administrative user to st… |
CVE-2019-6181 | Medium | 6.1 | 2019-09-03 | A reflected cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow a crafted UR… |
CVE-2019-6180 | Medium | 4.8 | 2019-09-03 | A stored cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an administrati… |
CVE-2019-6179 | High | 7.5 | 2019-09-03 | An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo XClarity Integrator… |
CVE-2019-1125 | Medium | 5.6 | 2019-09-03 | An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory. An attacker who successfully exploited… |
CVE-2019-15889 | Medium | 6.1 | 2019-09-03 | The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] para… |
CVE-2019-14261 | High | 7.5 | 2019-09-03 | An issue was discovered on ABUS Secvest FUAA50000 3.01.01 devices. Due to an insufficient implementation of jamming detection, an attacker is able to suppress… |
CVE-2019-3754 | Medium | 4.7 | 2019-09-03 | Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe3200 versions prior to… |
CVE-2019-3751 | Medium | 6.4 | 2019-09-03 | Dell EMC Enterprise Copy Data Management (eCDM) versions 1.0, 1.1, 2.0, 2.1, and 3.0 contain a certificate validation vulnerability. An unauthenticated remote… |
CVE-2019-14817 | High | 7.8 | 2019-09-03 | A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabl… |
CVE-2019-14811 | High | 7.8 | 2019-09-03 | A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling… |
CVE-2019-13156 | High | 7.5 | 2019-09-03 | NDrive(1.2.2).sys in Naver Cloud Explorer has a stack-based buffer overflow, which allows attackers to cause a denial of service when reading data from IOCTL h… |
CVE-2019-10197 | Medium | 6.5 | 2019-09-03 | A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samb… |
CVE-2019-15873 | High | 8.8 | 2019-09-03 | The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with th… |
CVE-2019-15872 | Critical | 9.8 | 2019-09-03 | The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings. |
CVE-2019-15871 | Medium | 4.3 | 2019-09-03 | The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings. |
CVE-2019-15870 | Medium | 5.4 | 2019-09-03 | The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field. |
CVE-2019-15869 | Medium | 5.4 | 2019-09-03 | The JobCareer theme before 2.5.1 for WordPress has stored XSS. |
CVE-2019-15868 | High | 8.8 | 2019-09-03 | The affiliates-manager plugin before 2.6.6 for WordPress has CSRF. |
CVE-2019-15867 | High | 8.8 | 2019-09-03 | The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber calls a certain AJAX… |
CVE-2019-15866 | High | 8.8 | 2019-09-03 | The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider. |
CVE-2019-15865 | High | 8.8 | 2019-09-03 | The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF. |
CVE-2019-15864 | Medium | 6.1 | 2019-09-03 | The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS. |
CVE-2019-15863 | High | 7.5 | 2019-09-03 | The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants. |
CVE-2019-15043 | High | 7.5 | 2019-09-03 | In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the… |
CVE-2019-15860 | Medium | 5.5 | 2019-09-03 | Xpdf 2.00 allows a SIGSEGV in XRef::constructXRef in XRef.cc. NOTE: 2.00 is a version from November 2002. |
CVE-2019-15858 | High | 8.8 | 2019-09-03 | admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by… |
CVE-2019-15847 | High | 7.5 | 2019-09-02 | The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus re… |
CVE-2019-15842 | Medium | 6.1 | 2019-08-30 | The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS. |
CVE-2019-15841 | High | 8.8 | 2019-08-30 | The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, or ajax_fb_toggle_v… |
CVE-2019-15840 | High | 8.8 | 2019-08-30 | The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF. |
CVE-2019-15839 | High | 7.5 | 2019-08-30 | The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion. |
CVE-2019-15838 | Medium | 6.1 | 2019-08-30 | The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789. |
CVE-2019-15837 | Medium | 5.4 | 2019-08-30 | The webp-express plugin before 0.14.8 for WordPress has stored XSS. |
CVE-2019-15836 | Medium | 5.4 | 2019-08-30 | The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS. |
CVE-2019-15835 | High | 8.8 | 2019-08-30 | The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF. |
CVE-2019-15834 | High | 8.8 | 2019-08-30 | The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF. |
CVE-2019-15630 | High | 7.5 | 2019-08-30 | Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft… |
CVE-2019-12810 | High | 7.8 | 2019-08-30 | A memory corruption vulnerability exists in the .PSD parsing functionality of ALSee v5.3 ~ v8.39. A specially crafted .PSD file can cause an out of bounds writ… |
CVE-2019-2390 | High | 8.2 | 2019-08-30 | An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with M… |
CVE-2019-2389 | Medium | 5.3 | 2019-08-30 | Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to b… |
CVE-2019-15026 | High | 7.5 | 2019-08-30 | memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn_to_str in memcached.c. |
CVE-2019-15833 | Medium | 6.1 | 2019-08-30 | The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS. |
CVE-2019-15832 | High | 8.8 | 2019-08-30 | The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF. |
CVE-2019-15831 | High | 8.8 | 2019-08-30 | The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page. |
CVE-2019-15830 | Medium | 5.4 | 2019-08-30 | The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS. |
CVE-2019-15829 | Medium | 4.8 | 2019-08-30 | The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS. |
CVE-2019-15828 | High | 8.8 | 2019-08-30 | The one-click-ssl plugin before 1.4.7 for WordPress has CSRF. |
CVE-2019-15827 | Medium | 5.4 | 2019-08-30 | The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter. |
CVE-2019-15826 | Critical | 9.8 | 2019-08-30 | The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field. |
CVE-2019-15825 | Critical | 9.8 | 2019-08-30 | The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass. |
CVE-2019-15824 | Critical | 9.8 | 2019-08-30 | The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass. |
CVE-2019-15823 | Critical | 9.8 | 2019-08-30 | The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass. |
CVE-2019-15822 | Critical | 9.8 | 2019-08-30 | The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal. |
CVE-2019-15821 | High | 7.5 | 2019-08-30 | The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data. |
CVE-2019-15820 | Medium | 6.1 | 2019-08-30 | The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication. |
CVE-2019-15819 | Critical | 9.8 | 2019-08-30 | The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication. |
CVE-2019-15818 | Medium | 6.1 | 2019-08-30 | The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk30… |
CVE-2019-15817 | Medium | 6.1 | 2019-08-30 | The easy-property-listings plugin before 3.4 for WordPress has XSS. |
CVE-2019-15816 | High | 7.5 | 2019-08-30 | The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions. |
CVE-2019-9697 | Medium | 6.5 | 2019-08-30 | An information disclosure vulnerability in the Management Center (MC) REST API 2.0, 2.1, and 2.2 prior to 2.2.2.1 allows a malicious authenticated user to obta… |
CVE-2019-6113 | High | 7.5 | 2019-08-30 | Directory traversal vulnerability on ONKYO TX-NR686 1030-5000-1040-0010 A/V Receiver devices allows remote attackers to read arbitrary files via a .. (dot dot)… |
CVE-2019-5612 | High | 7.5 | 2019-08-30 | In FreeBSD 12.0-STABLE before r351264, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r351265, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE… |
CVE-2019-5611 | High | 7.5 | 2019-08-30 | In FreeBSD 12.0-STABLE before r350828, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r350829, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE… |
CVE-2019-5610 | High | 7.5 | 2019-08-30 | In FreeBSD 12.0-STABLE before r350637, 12.0-RELEASE before 12.0-RELEASE-p9, 11.3-STABLE before r350638, 11.3-RELEASE before 11.3-RELEASE-p2, and 11.2-RELEASE b… |
CVE-2019-5609 | High | 7.5 | 2019-08-30 | In FreeBSD 12.0-STABLE before r350619, 12.0-RELEASE before 12.0-RELEASE-p9, 11.3-STABLE before r350619, 11.3-RELEASE before 11.3-RELEASE-p2, and 11.2-RELEASE b… |
CVE-2019-5608 | Critical | 9.8 | 2019-08-30 | In FreeBSD 12.0-STABLE before r350648, 12.0-RELEASE before 12.0-RELEASE-p9, 11.3-STABLE before r350650, 11.3-RELEASE before 11.3-RELEASE-p2, and 11.2-RELEASE b… |
CVE-2019-1977 | Medium | 6.8 | 2019-08-30 | A vulnerability within the Endpoint Learning feature of Cisco Nexus 9000 Series Switches running in Application Centric Infrastructure (ACI) mode could allow a… |
CVE-2019-1969 | Medium | 5.3 | 2019-08-30 | A vulnerability in the implementation of the Simple Network Management Protocol (SNMP) Access Control List (ACL) feature of Cisco NX-OS Software could allow an… |
CVE-2019-1968 | High | 7.5 | 2019-08-30 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly… |
CVE-2019-1967 | High | 7.5 | 2019-08-30 | A vulnerability in the Network Time Protocol (NTP) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service… |