2019 CVEs (page 88)
Page 88 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-15230 | Medium | 5.4 | 2019-08-28 | LibreNMS v1.54 has XSS in the Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template sections of the admin conso… |
CVE-2019-9935 | Medium | 5.3 | 2019-08-28 | Various Lexmark products have Incorrect Access Control (issue 2 of 2). |
CVE-2019-9934 | Medium | 5.3 | 2019-08-28 | Various Lexmark products have Incorrect Access Control (issue 1 of 2). |
CVE-2019-13348 | High | 8.8 | 2019-08-28 | In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes… |
CVE-2019-13189 | Medium | 6.1 | 2019-08-28 | In Knowage through 6.1.1, there is XSS via the start_url or user_id field to the ChangePwdServlet page. |
CVE-2019-10391 | Medium | 6.5 | 2019-08-28 | Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potential… |
CVE-2019-10390 | High | 8.8 | 2019-08-28 | A sandbox bypass vulnerability in Jenkins Splunk Plugin 1.7.4 and earlier allowed attackers with Overall/Read permission to provide a Groovy script to an HTTP… |
CVE-2019-10384 | High | 8.8 | 2019-08-28 | Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did… |
CVE-2019-10383 | Medium | 4.8 | 2019-08-28 | A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to confi… |
CVE-2019-10058 | Critical | 9.1 | 2019-08-28 | Various Lexmark products have Incorrect Access Control. |
CVE-2019-15716 | Medium | 5.5 | 2019-08-28 | WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys if the permissions w… |
CVE-2019-15714 | Medium | 5.3 | 2019-08-28 | cli/lib/main.js in Entropic before 2019-06-13 does not reject / and \ in command names, which might allow a directory traversal attack in unusual situations. |
CVE-2019-15713 | Medium | 6.1 | 2019-08-28 | The my-calendar plugin before 3.1.10 for WordPress has XSS. |
CVE-2019-15294 | Critical | 9.8 | 2019-08-28 | An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). Upon an upgrade, if a custom service account is in use and the visitor manageme… |
CVE-2019-15702 | High | 7.5 | 2019-08-27 | In the TCP implementation (gnrc_tcp) in RIOT through 2019.07, the parser for TCP options does not terminate on all inputs, allowing a denial-of-service, becaus… |
CVE-2019-15701 | High | 8.8 | 2019-08-27 | components/Modals/HelpModal.jsx in BloodHound 2.2.0 allows remote attackers to execute arbitrary OS commands (by spawning a child process as the current user o… |
CVE-2019-15700 | Medium | 6.1 | 2019-08-27 | public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed va… |
CVE-2019-13270 | High | 8.8 | 2019-08-27 | Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. In order… |
CVE-2019-13269 | High | 8.8 | 2019-08-27 | Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP R… |
CVE-2019-13268 | High | 8.8 | 2019-08-27 | TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the… |
CVE-2019-13267 | High | 8.8 | 2019-08-27 | TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the… |
CVE-2019-13266 | High | 8.8 | 2019-08-27 | TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the… |
CVE-2019-13265 | High | 8.8 | 2019-08-27 | D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They for… |
CVE-2019-13264 | High | 8.8 | 2019-08-27 | D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. In order… |
CVE-2019-13263 | High | 8.8 | 2019-08-27 | D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP R… |
CVE-2019-15698 | Medium | 4.3 | 2019-08-27 | In Octopus Deploy 2019.7.3 through 2019.7.9, in certain circumstances, an authenticated user with VariableView permissions could view sensitive values. This is… |
CVE-2019-13486 | Critical | 9.8 | 2019-08-27 | In Xymon through 4.3.28, a stack-based buffer overflow exists in the status-log viewer component because of expansion in svcstatus.c. |
CVE-2019-13485 | Critical | 9.8 | 2019-08-27 | In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the history viewer component via a long hostname or service parameter to history… |
CVE-2019-13484 | Critical | 9.8 | 2019-08-27 | In Xymon through 4.3.28, a buffer overflow exists in the status-log viewer CGI because of expansion in appfeed.c. |
CVE-2019-13455 | Critical | 9.8 | 2019-08-27 | In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the alert acknowledgment CGI tool because of expansion in acknowledge.c. |
CVE-2019-13452 | Critical | 9.8 | 2019-08-27 | In Xymon through 4.3.28, a buffer overflow vulnerability exists in reportlog.c. |
CVE-2019-13451 | Critical | 9.8 | 2019-08-27 | In Xymon through 4.3.28, a buffer overflow vulnerability exists in history.c. |
CVE-2019-13274 | Medium | 6.1 | 2019-08-27 | In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter. |
CVE-2019-13273 | Critical | 9.8 | 2019-08-27 | In Xymon through 4.3.28, a buffer overflow vulnerability exists in the csvinfo CGI script. The overflow may be exploited by sending a crafted GET request that… |
CVE-2019-13271 | High | 8.8 | 2019-08-27 | Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They for… |
CVE-2019-14314 | Critical | 9.8 | 2019-08-27 | A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vulnerability would all… |
CVE-2019-11457 | High | 8.8 | 2019-08-27 | Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /co… |
CVE-2019-15660 | High | 8.8 | 2019-08-27 | The wp-members plugin before 3.2.8 for WordPress has CSRF. |
CVE-2019-15650 | Medium | 4.3 | 2019-08-27 | The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme u… |
CVE-2019-15659 | Critical | 9.8 | 2019-08-27 | The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969. |
CVE-2019-15649 | High | 8.8 | 2019-08-27 | The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload. |
CVE-2019-15648 | Medium | 6.5 | 2019-08-27 | The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber. |
CVE-2019-15647 | High | 8.8 | 2019-08-27 | The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution. |
CVE-2019-15646 | Critical | 9.8 | 2019-08-27 | The rsvpmaker plugin before 6.2 for WordPress has SQL injection. |
CVE-2019-15645 | High | 8.8 | 2019-08-27 | The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF. |
CVE-2019-15644 | Medium | 6.1 | 2019-08-27 | The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS. |
CVE-2019-15643 | Medium | 6.1 | 2019-08-27 | The ultimate-faqs plugin before 1.8.22 for WordPress has XSS. |
CVE-2019-13237 | Medium | 4.3 | 2019-08-27 | In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearh… |
CVE-2019-13236 | Medium | 6.1 | 2019-08-27 | In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface. |
CVE-2019-13235 | Medium | 6.1 | 2019-08-27 | In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form. |
CVE-2019-13234 | Medium | 6.1 | 2019-08-27 | In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine. |
CVE-2019-15666 | Medium | 4.4 | 2019-08-27 | An issue was discovered in the Linux kernel before 5.0.19. There is an out-of-bounds array access in __xfrm_policy_unlink, which will cause denial of service… |
CVE-2019-15658 | High | 7.3 | 2019-08-26 | connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data. |
CVE-2019-15657 | Critical | 9.8 | 2019-08-26 | In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code. |
CVE-2019-15651 | Critical | 9.8 | 2019-08-26 | wolfSSL 4.1.0 has a one-byte heap-based buffer over-read in DecodeCertExtensions in wolfcrypt/src/asn.c because reading the ASN_BOOLEAN byte is mishandled for… |
CVE-2019-15497 | Critical | 9.8 | 2019-08-26 | Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attack… |
CVE-2019-15055 | Medium | 6.5 | 2019-08-26 | MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attack… |
CVE-2019-9569 | Critical | 9.8 | 2019-08-26 | Buffer Overflow in dactetra in Delta Controls enteliBUS Manager V3.40_B-571848 allows remote unauthenticated users to execute arbitrary code and possibly cause… |
CVE-2019-8460 | High | 7.5 | 2019-08-26 | OpenBSD kernel version <= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() for every incoming SA… |
CVE-2019-8001 | Critical | 9.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound write vulnerability. Successful exploitation could lead to arbitrary… |
CVE-2019-8000 | Medium | 6.5 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound read vulnerability. Successful exploitation could lead to memory lea… |
CVE-2019-7999 | Medium | 6.5 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound read vulnerability. Successful exploitation could lead to memory lea… |
CVE-2019-7998 | Critical | 9.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound write vulnerability. Successful exploitation could lead to arbitrary… |
CVE-2019-7997 | Critical | 9.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound write vulnerability. Successful exploitation could lead to arbitrary… |
CVE-2019-7996 | High | 8.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound read vulnerability. Successful exploitation could lead to memory lea… |
CVE-2019-7995 | High | 8.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound read vulnerability. Successful exploitation could lead to memory lea… |
CVE-2019-7994 | High | 8.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound write vulnerability. Successful exploitation could lead to arbitrary… |
CVE-2019-7993 | Critical | 9.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2019-7992 | Critical | 9.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound write vulnerability. Successful exploitation could lead to arbitrary… |
CVE-2019-7991 | High | 8.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound read vulnerability. Successful exploitation could lead to memory lea… |
CVE-2019-7990 | Critical | 9.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2019-7989 | High | 8.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary c… |
CVE-2019-7988 | High | 8.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound write vulnerability. Successful exploitation could lead to arbitrary… |
CVE-2019-7987 | Medium | 6.5 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound read vulnerability. Successful exploitation could lead to memory lea… |
CVE-2019-7986 | High | 8.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound write vulnerability. Successful exploitation could lead to arbitrary… |
CVE-2019-7985 | High | 8.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2019-7984 | High | 8.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound write vulnerability. Successful exploitation could lead to arbitrary… |
CVE-2019-7983 | High | 8.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound write vulnerability. Successful exploitation could lead to arbitrary… |
CVE-2019-7982 | High | 8.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound write vulnerability. Successful exploitation could lead to arbitrary… |
CVE-2019-7981 | Medium | 6.5 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound read vulnerability. Successful exploitation could lead to memory lea… |
CVE-2019-7980 | High | 8.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2019-7979 | High | 8.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound write vulnerability. Successful exploitation could lead to arbitrary… |
CVE-2019-7978 | High | 8.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2019-7975 | Critical | 9.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2019-7977 | Medium | 6.5 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound read vulnerability. Successful exploitation could lead to memory lea… |
CVE-2019-7976 | High | 8.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound write vulnerability. Successful exploitation could lead to arbitrary… |
CVE-2019-7974 | Critical | 9.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2019-7973 | Critical | 9.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2019-7972 | Critical | 9.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2019-7971 | Critical | 9.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2019-7970 | Critical | 9.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2019-7969 | Critical | 9.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2019-7968 | Critical | 9.8 | 2019-08-26 | Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary c… |
CVE-2019-15642 | High | 8.8 | 2019-08-26 | rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the… |
CVE-2019-15641 | Medium | 6.5 | 2019-08-26 | xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi. |
CVE-2019-15548 | Critical | 9.8 | 2019-08-26 | An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are instr and mvwinstr buffer overflows because interaction with C functions is mis… |
CVE-2019-15547 | High | 7.5 | 2019-08-26 | An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are format string issues in printw functions because C format arguments are mishand… |
CVE-2019-15546 | High | 7.5 | 2019-08-26 | An issue was discovered in the pancurses crate through 0.16.1 for Rust. printw and mvprintw have format string vulnerabilities. |
CVE-2019-15545 | High | 7.5 | 2019-08-26 | An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures. |
CVE-2019-15544 | High | 7.5 | 2019-08-26 | An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls. |