2019 CVEs (page 9)
Page 9 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10196 | Critical | 9.8 | 2021-03-19 | A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper… |
CVE-2019-10128 | High | 7.8 | 2021-03-19 | A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-supplied PostgreSQL does not lock down the ACL of t… |
CVE-2019-10127 | High | 8.8 | 2021-03-19 | A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the bin… |
CVE-2019-14852 | High | 7.5 | 2021-03-18 | A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol and break its encry… |
CVE-2019-14851 | Medium | 6.5 | 2021-03-18 | A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertion failure, causin… |
CVE-2019-3867 | Medium | 4.1 | 2021-03-18 | A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access to a session, could… |
CVE-2019-14850 | Low | 3.7 | 2021-03-18 | A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a… |
CVE-2019-18235 | Critical | 9.8 | 2021-03-17 | Advantech Spectre RT ERT351 Versions 5.1.3 and prior has insufficient login authentication parameters required for the web application may allow an attacker to… |
CVE-2019-18233 | Medium | 6.1 | 2021-03-17 | In Advantech Spectre RT Industrial Routers ERT351 5.1.3 and prior, the affected product does not neutralize special characters in the error response, allowing… |
CVE-2019-18231 | High | 7.5 | 2021-03-17 | Advantech Spectre RT ERT351 Versions 5.1.3 and prior logins and passwords are transmitted in clear text form, which may allow an attacker to intercept the requ… |
CVE-2019-3897 | Medium | 5.3 | 2021-03-16 | It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know its name. Red Hat Cer… |
CVE-2019-25025 | Medium | 5.3 | 2021-03-05 | The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when deliverin… |
CVE-2019-18630 | High | 7.5 | 2021-03-04 | On Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200, porti… |
CVE-2019-18629 | High | 8.1 | 2021-03-04 | Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow an… |
CVE-2019-18628 | Medium | 4.9 | 2021-03-04 | Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow a u… |
CVE-2019-25023 | Medium | 6.5 | 2021-02-27 | An issue was discovered in Scytl sVote 2.1. Because the IP address from an X-Forwarded-For header (which can be manipulated client-side) is used for the intern… |
CVE-2019-25022 | Critical | 9.8 | 2021-02-27 | An issue was discovered in Scytl sVote 2.1. An attacker can inject code that gets executed by creating an election-event and injecting a payload over an event… |
CVE-2019-25021 | High | 7.5 | 2021-02-27 | An issue was discovered in Scytl sVote 2.1. Due to the implementation of the database manager, an attacker can access the OrientDB by providing admin as the ad… |
CVE-2019-25020 | High | 7.5 | 2021-02-27 | An issue was discovered in Scytl sVote 2.1. Because the sdm-ws-rest API does not require authentication, an attacker can retrieve the administrative configurat… |
CVE-2019-11684 | Critical | 9.9 | 2021-02-26 | Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset… |
CVE-2019-18947 | Low | 3.5 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to information disclosure. |
CVE-2019-18946 | Medium | 4.8 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to session fixation. |
CVE-2019-18945 | High | 7.3 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to privilege escalation vulnerability. |
CVE-2019-18944 | Medium | 4.9 | 2021-02-26 | Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS. |
CVE-2019-18943 | Medium | 6.1 | 2021-02-26 | Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations. |
CVE-2019-18942 | Medium | 5.5 | 2021-02-26 | Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to stored XSS. The application reflects previously stored user input without enc… |
CVE-2019-25024 | Critical | 9.8 | 2021-02-19 | OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax_system.php post_service parameter. |
CVE-2019-18243 | Medium | 5.5 | 2021-02-18 | HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through the registry. This may allow privil… |
CVE-2019-18255 | Medium | 5.5 | 2021-02-18 | HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through section objects. This may allow pri… |
CVE-2019-25019 | Critical | 9.8 | 2021-02-14 | LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model. |
CVE-2019-19005 | High | 7.8 | 2021-02-11 | A bitmap double free in main.c in autotrace 0.31.1 allows attackers to cause an unspecified impact via a malformed bitmap image. This may occur after the use-a… |
CVE-2019-19004 | Low | 3.3 | 2021-02-11 | A biWidth*biBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an unexpected input value to malloc via a malformed bitmap i… |
CVE-2019-17582 | Critical | 9.8 | 2021-02-09 | A use-after-free in the _zip_dirent_read function of zip_dirent.c in libzip 1.2.0 allows attackers to have an unspecified impact by attempting to unzip a malfo… |
CVE-2019-16268 | Medium | 4.8 | 2021-02-03 | Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowU… |
CVE-2019-25018 | High | 7.5 | 2021-02-02 | In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, simil… |
CVE-2019-25017 | Medium | 5.9 | 2021-02-02 | An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/direct… |
CVE-2019-20473 | Medium | 6.8 | 2021-02-01 | An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. Any SIM card used with the device cannot have a PIN configured. If a PIN is co… |
CVE-2019-20471 | High | 7.8 | 2021-02-01 | An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. When using the device at initial setup, a default password is used (123456) fo… |
CVE-2019-20470 | High | 7.5 | 2021-02-01 | An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It performs actions based on certain SMS commands. This can be used to set up… |
CVE-2019-20468 | Critical | 9.8 | 2021-02-01 | An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It has unnecessary permissions such as READ_EXTERNAL_STORAGE, W… |
CVE-2019-25014 | Medium | 6.5 | 2021-01-29 | A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0. If a particular HTTP GET request is… |
CVE-2019-25016 | High | 8.8 | 2021-01-28 | In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execut… |
CVE-2019-25015 | Medium | 5.4 | 2021-01-26 | LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID. |
CVE-2019-16961 | Medium | 5.4 | 2021-01-15 | SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name. |
CVE-2019-4702 | High | 8.1 | 2021-01-13 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or mod… |
CVE-2019-4687 | Medium | 5.3 | 2021-01-13 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized par… |
CVE-2019-4160 | High | 7.5 | 2021-01-13 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive… |
CVE-2019-3405 | Medium | 5.3 | 2021-01-11 | In the 3.1.3.64296 and lower version of 360F5, the third party can trigger the device to send a deauth frame by constructing and sending a specific illegal 802… |
CVE-2019-18643 | Critical | 9.8 | 2021-01-07 | Rock RMS versions before 8.10 and versions 9.0 through 9.3 fails to properly validate files uploaded in the application. The only protection mechanism is a fil… |
CVE-2019-18642 | Critical | 9.8 | 2021-01-07 | Rock RMS version before 8.6 is vulnerable to account takeover by tampering with the user ID parameter in the profile update feature. The lack of validation and… |
CVE-2019-16962 | Medium | 5.4 | 2021-01-06 | Zoho ManageEngine Desktop Central 10.0.430 allows HTML injection via a modified Report Name in a New Custom Report. |
CVE-2019-16954 | Medium | 5.4 | 2021-01-06 | SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket. |
CVE-2019-20484 | High | 8.1 | 2021-01-05 | An issue was discovered in Viki Vera 4.9.1.26180. A user without access to a project could download or upload project files by opening the Project URL directly… |
CVE-2019-20483 | Medium | 5.4 | 2021-01-05 | An issue was discovered in Viki Vera 4.9.1.26180. An attacker could set a user's last name to an XSS Payload, and read another user's cookie and use that to lo… |
CVE-2019-4728 | High | 8.8 | 2021-01-05 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to execute arbitrary… |
CVE-2019-25013 | Medium | 5.9 | 2021-01-04 | The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a… |
CVE-2019-16960 | Medium | 5.4 | 2021-01-04 | SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field. |
CVE-2019-16956 | Medium | 5.4 | 2021-01-04 | SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket. |
CVE-2019-25012 | High | 7.5 | 2021-01-01 | The Webform Report project 7.x-1.x-dev for Drupal allows remote attackers to view submissions by visiting the /rss.xml page. NOTE: This project is not covered… |
CVE-2019-25011 | Medium | 5.4 | 2020-12-31 | NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field, as demonstrated by /dcim/sites/add/ comme… |
CVE-2019-25010 | Critical | 9.8 | 2020-12-31 | An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridden. |
CVE-2019-25009 | Critical | 9.8 | 2020-12-31 | An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness. |
CVE-2019-25007 | High | 7.5 | 2020-12-31 | An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can cause a panic. |
CVE-2019-25006 | High | 7.5 | 2020-12-31 | An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can produce the wrong answer. |
CVE-2019-25005 | High | 7.5 | 2020-12-31 | An issue was discovered in the chacha20 crate before 0.2.3 for Rust. A ChaCha20 counter overflow makes it easier for attackers to determine plaintext. |
CVE-2019-25004 | Critical | 9.8 | 2020-12-31 | An issue was discovered in the flatbuffers crate before 0.6.1 for Rust. Arbitrary bytes can be reinterpreted as a bool, defeating soundness. |
CVE-2019-25003 | High | 7.5 | 2020-12-31 | An issue was discovered in the libsecp256k1 crate before 0.3.1 for Rust. Scalar::check_overflow allows a timing side-channel attack; consequently, attackers ca… |
CVE-2019-25002 | Critical | 9.8 | 2020-12-31 | An issue was discovered in the sodiumoxide crate before 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security prop… |
CVE-2019-25001 | High | 7.5 | 2020-12-31 | An issue was discovered in the serde_cbor crate before 0.10.2 for Rust. The CBOR deserializer can cause stack consumption via nested semantic tags. |
CVE-2019-7726 | Critical | 9.8 | 2020-12-31 | modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request (e.g., Referer and User-Agent). |
CVE-2019-7725 | Critical | 9.8 | 2020-12-31 | includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies on PHP's serialization format when JSO… |
CVE-2019-20808 | Medium | 6.5 | 2020-12-31 | In QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA implementation. It occurs in the ati_cursor_define() routine while handling MMIO write opera… |
CVE-2019-16747 | High | 7.5 | 2020-12-30 | In MatrixSSL before 4.2.2 Open, the DTLS server can encounter an invalid pointer free (leading to memory corruption and a daemon crash) via a crafted incoming… |
CVE-2019-16281 | High | 7.5 | 2020-12-30 | Ptarmigan before 0.2.3 lacks API token validation, e.g., an "if (token === apiToken) {return true;} return false;" code block. |
CVE-2019-15523 | Medium | 5.3 | 2020-12-30 | An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake(… |
CVE-2019-15080 | High | 7.5 | 2020-12-30 | An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an Ethereum token. A typo in the constructor of the Owned contra… |
CVE-2019-15079 | High | 7.5 | 2020-12-30 | A typo exists in the constructor of a smart contract implementation for EAI through 2019-06-05, an Ethereum token. This vulnerability could be used by an attac… |
CVE-2019-15078 | High | 7.5 | 2020-12-30 | An issue was discovered in a smart contract implementation for AIRDROPX BORN through 2019-05-29, an Ethereum token. The name of the constructor has a typo (wro… |
CVE-2019-12953 | Medium | 5.3 | 2020-12-30 | Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-2018-15599. |
CVE-2019-12768 | Critical | 9.8 | 2020-12-30 | An issue was discovered on D-Link DAP-1650 devices through v1.03b07 before 1.04B02_J65H Hot Fix. Attackers can bypass authentication via forceful browsing. |
CVE-2019-11786 | Medium | 4.3 | 2020-12-22 | Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to modify translated terms… |
CVE-2019-11785 | Medium | 4.3 | 2020-12-22 | Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users t… |
CVE-2019-11784 | Medium | 6.5 | 2020-12-22 | Improper access control in mail module (notifications) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated use… |
CVE-2019-11783 | Medium | 6.5 | 2020-12-22 | Improper access control in mail module (channel partners) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated… |
CVE-2019-11782 | Medium | 6.5 | 2020-12-22 | Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with access to contact manag… |
CVE-2019-11781 | High | 8.8 | 2020-12-22 | Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackers to trick victims… |
CVE-2019-16959 | Medium | 6.5 | 2020-12-21 | SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket. |
CVE-2019-16957 | Medium | 5.4 | 2020-12-18 | SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account. |
CVE-2019-16955 | Medium | 5.4 | 2020-12-18 | SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request. |
CVE-2019-14481 | Medium | 5.4 | 2020-12-16 | AdRem NetCrunch 10.6.0.4587 has a Cross-Site Request Forgery (CSRF) vulnerability in the NetCrunch web client. Successful exploitation requires a logged-in use… |
CVE-2019-14479 | High | 8.8 | 2020-12-16 | AdRem NetCrunch 10.6.0.4587 allows Remote Code Execution. In the NetCrunch web client, a read-only administrator can execute arbitrary code on the server runni… |
CVE-2019-14478 | Medium | 5.4 | 2020-12-16 | AdRem NetCrunch 10.6.0.4587 has a stored Cross-Site Scripting (XSS) vulnerability in the NetCrunch web client. The user's input data is not properly encoded wh… |
CVE-2019-14476 | Medium | 6.5 | 2020-12-16 | AdRem NetCrunch 10.6.0.4587 has a Server-Side Request Forgery (SSRF) vulnerability in the NetCrunch server. Every user can trick the server into performing SMB… |
CVE-2019-14483 | High | 8.8 | 2020-12-16 | AdRem NetCrunch 10.6.0.4587 allows Credentials Disclosure. Every user can read the BSD, Linux, MacOS and Solaris private keys, private keys' passwords, and roo… |
CVE-2019-14482 | Critical | 9.8 | 2020-12-16 | AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client. The same hardcoded SSL private key is used across differ… |
CVE-2019-14480 | Critical | 9.8 | 2020-12-16 | AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalatio… |
CVE-2019-14477 | Medium | 5.5 | 2020-12-16 | AdRem NetCrunch 10.6.0.4587 has Improper Credential Storage since the internal user database is readable by low-privileged users and passwords in the database… |
CVE-2019-19289 | High | 8.8 | 2020-12-14 | A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting us… |
CVE-2019-19288 | Medium | 6.1 | 2020-12-14 | A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tri… |
CVE-2019-19287 | Medium | 6.5 | 2020-12-14 | A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow attackers to traverse through the file system of the server base… |