2019 CVEs (page 87)
Page 87 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1966 | High | 7.8 | 2019-08-30 | A vulnerability in a specific CLI command within the local management (local-mgmt) context for Cisco UCS Fabric Interconnect Software could allow an authentica… |
CVE-2019-13526 | High | 8.8 | 2019-08-30 | Datalogic AV7000 Linear barcode scanner all versions prior to 4.6.0.0 is vulnerable to authentication bypass, which may allow an attacker to remotely execute a… |
CVE-2019-12754 | Medium | 4.8 | 2019-08-30 | Symantec My VIP portal, previous version which has already been auto updated, was susceptible to a cross-site scripting (XSS) exploit, which is a type of issue… |
CVE-2019-12753 | Medium | 4.9 | 2019-08-30 | An information disclosure vulnerability in Symantec Reporter web UI 10.3 prior to 10.3.2.5 allows a malicious authenticated administrator user to obtain passwo… |
CVE-2019-12402 | High | 7.5 | 2019-08-30 | The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs… |
CVE-2019-11658 | Medium | 4.3 | 2019-08-30 | Information exposure in Micro Focus Content Manager, versions 9.1, 9.2 and 9.3. This vulnerability when configured to use an Oracle database, allows valid syst… |
CVE-2019-8461 | High | 7.8 | 2019-08-29 | Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH location on a clean image without Endpoin… |
CVE-2019-11364 | High | 7.2 | 2019-08-29 | An OS Command Injection vulnerability in Snare Central before 7.4.5 allows remote authenticated attackers to inject arbitrary OS commands via the ServerConf/Da… |
CVE-2019-11363 | High | 7.2 | 2019-08-29 | A SQL injection vulnerability in Snare Central before 7.4.5 allows remote authenticated attackers to execute arbitrary SQL commands via the AgentConsole/UserGr… |
CVE-2019-11396 | High | 7.8 | 2019-08-29 | An issue was discovered in Avira Free Security Suite 10. The permissive access rights on the SoftwareUpdater folder (files / folders and configuration) are inc… |
CVE-2019-15811 | Medium | 6.1 | 2019-08-29 | In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS. |
CVE-2019-14979 | Medium | 5.3 | 2019-08-29 | cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such… |
CVE-2019-14978 | Medium | 5.3 | 2019-08-29 | /payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as… |
CVE-2019-14970 | High | 7.8 | 2019-08-29 | A vulnerability in mkv::event_thread_t in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer overflow via a crafted .mkv… |
CVE-2019-14778 | High | 7.8 | 2019-08-29 | The mkv::virtual_segment_c::seek method of demux/mkv/virtual_segment.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free. |
CVE-2019-14777 | High | 7.8 | 2019-08-29 | The Control function of demux/mkv/mkv.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free. |
CVE-2019-14776 | High | 7.8 | 2019-08-29 | A heap-based buffer over-read exists in DemuxInit() in demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 via a crafted .mkv file. |
CVE-2019-14534 | Medium | 5.5 | 2019-08-29 | In VideoLAN VLC media player 3.0.7.1, there is a NULL pointer dereference at the function SeekPercent of demux/asf/asf.c that will lead to a denial of service… |
CVE-2019-14533 | High | 7.8 | 2019-08-29 | The Control function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 has a use-after-free. |
CVE-2019-13608 | High | 7.5 | 2019-08-29 | Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks. |
CVE-2019-15807 | Medium | 4.7 | 2019-08-29 | In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails. This will cause a BUG and de… |
CVE-2019-15806 | Critical | 9.8 | 2019-08-29 | CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they i… |
CVE-2019-15805 | Critical | 9.8 | 2019-08-29 | CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they i… |
CVE-2019-14535 | High | 7.8 | 2019-08-29 | A divide-by-zero error exists in the SeekIndex function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be triggered via a cra… |
CVE-2019-14498 | High | 7.8 | 2019-08-29 | A divide-by-zero error exists in the Control function of demux/caf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be triggered via a crafted C… |
CVE-2019-14438 | High | 7.8 | 2019-08-29 | A heap-based buffer over-read in xiph_PackHeaders() in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-base… |
CVE-2019-14437 | High | 7.8 | 2019-08-29 | The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a result, a heap-based buf… |
CVE-2019-15717 | Critical | 9.8 | 2019-08-29 | Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP. |
CVE-2019-15502 | High | 7.5 | 2019-08-29 | The TeamSpeak client before 3.3.2 allows remote servers to trigger a crash via the 0xe2 0x81 0xa8 0xe2 0x81 0xa7 byte sequence, aka Unicode characters U+2068 (… |
CVE-2019-7307 | High | 7.0 | 2019-08-29 | Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability… |
CVE-2019-4536 | Medium | 6.3 | 2019-08-29 | IBM i 7.4 users who have done a Restore User Profile (RSTUSRPRF) on a system which has been configured with Db2 Mirror for i might have user profiles with elev… |
CVE-2019-4133 | Medium | 5.2 | 2019-08-29 | IBM Cloud Automation Manager 3.1.2 could allow a malicious user on the client side (with access to client computer) to run a custom script. IBM X-Force ID: 158… |
CVE-2019-4132 | Low | 3.3 | 2019-08-29 | IBM Cloud Automation Manager 3.1.2 could allow a user to be impropertly redirected and obtain sensitive information rather than receive a 404 error message. IB… |
CVE-2019-3394 | High | 8.8 | 2019-08-29 | There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. An attacker with permission to editing a pa… |
CVE-2019-11476 | Medium | 6.5 | 2019-08-29 | An integer overflow in whoopsie before versions 0.2.52.5ubuntu0.1, 0.2.62ubuntu0.1, 0.2.64ubuntu0.1, 0.2.66, results in an out-of-bounds write to a heap alloca… |
CVE-2019-11500 | Critical | 9.8 | 2019-08-29 | In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0'… |
CVE-2019-15788 | Critical | 9.8 | 2019-08-29 | Clara Genomics Analysis before 0.2.0 has an integer overflow for cudapoa memory management in allocate_block.cpp. |
CVE-2019-15786 | Critical | 9.8 | 2019-08-29 | ROBOTIS Dynamixel SDK through 3.7.11 has a buffer overflow via a large rxpacket. |
CVE-2019-15785 | Critical | 9.8 | 2019-08-29 | FontForge 20190813 through 20190820 has a buffer overflow in PrefsUI_LoadPrefs in prefs.c. |
CVE-2019-15784 | Critical | 9.8 | 2019-08-29 | Secure Reliable Transport (SRT) through 1.3.4 has a CSndUList array overflow if there are many SRT connections. |
CVE-2019-15781 | High | 8.8 | 2019-08-29 | The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF. |
CVE-2019-15779 | High | 8.8 | 2019-08-29 | The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete. |
CVE-2019-15778 | Medium | 5.4 | 2019-08-29 | The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS. |
CVE-2019-15771 | Medium | 6.1 | 2019-08-29 | The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. |
CVE-2019-15745 | High | 8.8 | 2019-08-29 | The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app. The communica… |
CVE-2019-15787 | High | 7.5 | 2019-08-29 | libZetta.rs through 0.1.2 has an integer overflow in the zpool parser (for error stats) that leads to a panic. |
CVE-2019-15783 | Critical | 9.8 | 2019-08-29 | Lute-Tab before 2019-08-23 has a buffer overflow in pdf_print.cc. |
CVE-2019-15782 | Medium | 6.1 | 2019-08-29 | WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name. |
CVE-2019-15780 | Critical | 9.8 | 2019-08-29 | The formidable plugin before 4.02.01 for WordPress has unsafe deserialization. |
CVE-2019-15777 | Medium | 5.4 | 2019-08-29 | The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS. |
CVE-2019-15776 | Medium | 6.1 | 2019-08-29 | The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file. |
CVE-2019-15775 | Medium | 6.1 | 2019-08-29 | The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. |
CVE-2019-15774 | Medium | 6.1 | 2019-08-29 | The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. |
CVE-2019-15773 | Medium | 6.1 | 2019-08-29 | The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. |
CVE-2019-15772 | Medium | 6.1 | 2019-08-29 | The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting. |
CVE-2019-15770 | High | 8.8 | 2019-08-29 | The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks. |
CVE-2019-15769 | High | 8.8 | 2019-08-29 | The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option. |
CVE-2019-14943 | Critical | 9.8 | 2019-08-29 | An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4. It uses Hard-coded Credentials. |
CVE-2019-15767 | High | 7.8 | 2019-08-29 | In GNU Chess 6.2.5, there is a stack-based buffer overflow in the cmd_load function in frontend/cmd.cc via a crafted chess position in an EPD file. |
CVE-2019-15759 | Medium | 6.5 | 2019-08-29 | An issue was discovered in Binaryen 1.38.32. Two visitors in ir/ExpressionManipulator.cpp can lead to a NULL pointer dereference in wasm::LocalSet::finalize in… |
CVE-2019-15758 | Medium | 6.5 | 2019-08-29 | An issue was discovered in Binaryen 1.38.32. Missing validation rules in asmjs/asmangle.cpp can lead to an Assertion Failure at wasm/wasm.cpp in wasm::asmangle… |
CVE-2019-5530 | High | 7.8 | 2019-08-29 | Windows binaries generated with InstallBuilder versions earlier than 19.7.0 are vulnerable to tampering even if they contain a valid Authenticode signature. |
CVE-2019-15757 | Medium | 6.5 | 2019-08-29 | libMirage 3.2.2 in CDemu has a NULL pointer dereference in the NRG parser in parser.c. |
CVE-2019-13408 | High | 7.5 | 2019-08-29 | A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportS… |
CVE-2019-13407 | Medium | 6.1 | 2019-08-29 | A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It l… |
CVE-2019-13406 | High | 7.5 | 2019-08-29 | A broken access control vulnerability found in Advan VD-1 firmware versions up to 230. An attacker can send a POST request to cgibin/ApkUpload.cgi to install a… |
CVE-2019-13405 | Critical | 9.8 | 2019-08-29 | A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/Adb… |
CVE-2019-11250 | Medium | 6.5 | 2019-08-29 | The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or comma… |
CVE-2019-11249 | Medium | 6.5 | 2019-08-29 | The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container t… |
CVE-2019-11248 | High | 8.2 | 2019-08-29 | The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port… |
CVE-2019-11247 | High | 8.1 | 2019-08-29 | The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authoriza… |
CVE-2019-11246 | Medium | 6.5 | 2019-08-29 | The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container t… |
CVE-2019-11245 | Medium | 4.9 | 2019-08-29 | In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the im… |
CVE-2019-11064 | Critical | 9.8 | 2019-08-29 | A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is… |
CVE-2019-11063 | Critical | 10.0 | 2019-08-29 | A broken access control vulnerability in SmartHome app (Android versions up to 3.0.42_190515, ios versions up to 2.0.22) allows an attacker in the same local a… |
CVE-2019-11061 | Critical | 10.0 | 2019-08-29 | A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that co… |
CVE-2019-11060 | High | 7.5 | 2019-08-29 | The web api server on Port 8080 of ASUS HG100 firmware up to 1.05.12, which is vulnerable to Slowloris HTTP Denial of Service: an attacker can cause a Denial o… |
CVE-2019-10724 | Medium | 6.5 | 2019-08-29 | There is a vulnerability with the Dolby DAX2 API system services in which a low-privileged user can terminate arbitrary processes that are running at a higher… |
CVE-2019-9933 | Critical | 9.8 | 2019-08-28 | Various Lexmark products have a Buffer Overflow (issue 3 of 3). |
CVE-2019-9932 | Critical | 9.8 | 2019-08-28 | Various Lexmark products have a Buffer Overflow (issue 2 of 3). |
CVE-2019-9931 | High | 7.5 | 2019-08-28 | Various Lexmark printers contain a denial of service vulnerability in the SNMP service that can be exploited to crash the device. |
CVE-2019-9930 | Critical | 9.8 | 2019-08-28 | Various Lexmark products have an Integer Overflow. |
CVE-2019-10059 | Medium | 5.3 | 2019-08-28 | The legacy finger service (TCP port 79) is enabled by default on various older Lexmark devices. |
CVE-2019-10057 | Medium | 6.5 | 2019-08-28 | Various Lexmark products have CSRF. |
CVE-2019-15753 | Critical | 9.1 | 2019-08-28 | In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet floodi… |
CVE-2019-15752 | High | 7.8 | 2019-08-28 | Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMD… |
CVE-2019-10056 | High | 7.5 | 2019-08-28 | An issue was discovered in Suricata 4.1.3. The code mishandles the case of sending a network packet with the right type, such that the function DecodeEthernet… |
CVE-2019-10055 | High | 7.5 | 2019-08-28 | An issue was discovered in Suricata 4.1.3. The function ftp_pasv_response lacks a check for the length of part1 and part2, leading to a crash within the ftp/mo… |
CVE-2019-10054 | High | 7.5 | 2019-08-28 | An issue was discovered in Suricata 4.1.3. The function process_reply_record_v3 lacks a check for the length of reply.data. It causes an invalid memory access… |
CVE-2019-14694 | Medium | 4.7 | 2019-08-28 | A use-after-free flaw in the sandbox container implemented in cmdguard.sys in Comodo Antivirus 12.0.0.6870 can be triggered due to a race condition when handli… |
CVE-2019-10052 | High | 7.5 | 2019-08-28 | An issue was discovered in Suricata 4.1.3. If the network packet does not have the right length, the parser tries to access a part of a DHCP packet. At this po… |
CVE-2019-10051 | High | 7.5 | 2019-08-28 | An issue was discovered in Suricata 4.1.3. If the function filetracker_newchunk encounters an unsafe "Some(sfcm) => { ft.new_chunk }" item, then the program en… |
CVE-2019-1965 | High | 7.7 | 2019-08-28 | A vulnerability in the Virtual Shell (VSH) session management for Cisco NX-OS Software could allow an authenticated, remote attacker to cause a VSH process to… |
CVE-2019-1964 | High | 8.6 | 2019-08-28 | A vulnerability in the IPv6 traffic processing of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an unexpected restart of the ne… |
CVE-2019-1963 | High | 7.7 | 2019-08-28 | A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco FXOS Software and Cisco NX-OS Software could allow an authenti… |
CVE-2019-1962 | High | 8.6 | 2019-08-28 | A vulnerability in the Cisco Fabric Services component of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause process crashes, which… |
CVE-2019-12643 | Critical | 10.0 | 2019-08-28 | A vulnerability in the Cisco REST API virtual service container for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass authenticat… |
CVE-2019-5590 | Medium | 6.1 | 2019-08-28 | The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands (Cr… |
CVE-2019-15720 | High | 7.8 | 2019-08-28 | CloudBerry Backup v6.1.2.34 allows local privilege escalation via a Pre or Post backup action. With only user-level access, a user can modify the backup plan a… |
CVE-2019-15496 | High | 8.8 | 2019-08-28 | MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead to an attacker tricking the administrato… |