2019 CVEs (page 90)
Page 90 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-11588 | Medium | 4.3 | 2019-08-23 | The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before versi… |
CVE-2019-11587 | Medium | 6.5 | 2019-08-23 | Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before versio… |
CVE-2019-11586 | Medium | 4.3 | 2019-08-23 | The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remo… |
CVE-2019-11585 | Medium | 6.1 | 2019-08-23 | The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote atta… |
CVE-2019-11584 | Medium | 6.1 | 2019-08-23 | The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… |
CVE-2019-15514 | Medium | 5.3 | 2019-08-23 | The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attac… |
CVE-2019-15494 | Critical | 9.8 | 2019-08-23 | openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21. |
CVE-2019-15493 | High | 7.5 | 2019-08-23 | openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21. |
CVE-2019-15492 | Medium | 6.1 | 2019-08-23 | openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21. |
CVE-2019-15491 | High | 8.8 | 2019-08-23 | openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21. |
CVE-2019-15490 | Critical | 9.8 | 2019-08-23 | openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21. |
CVE-2019-15488 | Medium | 6.1 | 2019-08-23 | Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test. |
CVE-2019-15487 | Medium | 6.1 | 2019-08-23 | DfE School Experience before v16333-GA has XSS via a teacher training URL. |
CVE-2019-15486 | Medium | 6.1 | 2019-08-23 | django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline. |
CVE-2019-15485 | Medium | 6.1 | 2019-08-23 | Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php. |
CVE-2019-15484 | Medium | 6.1 | 2019-08-23 | Bolt before 3.6.10 has XSS via an image's alt or title field. |
CVE-2019-15483 | Medium | 6.1 | 2019-08-23 | Bolt before 3.6.10 has XSS via a title that is mishandled in the system log. |
CVE-2019-15482 | Medium | 6.1 | 2019-08-23 | selectize-plugin-a11y before 1.1.0 has XSS via the msg field. |
CVE-2019-15481 | Medium | 6.1 | 2019-08-23 | Kimai v2 before 1.1 has XSS via a timesheet description. |
CVE-2019-15480 | Medium | 5.4 | 2019-08-23 | Domoticz 4.10717 has XSS via item.Name. |
CVE-2019-15477 | Medium | 6.1 | 2019-08-23 | Jooby before 1.6.4 has XSS via the default error handler. |
CVE-2019-15476 | Medium | 6.1 | 2019-08-23 | Former before 4.2.1 has XSS via a checkbox value. |
CVE-2019-15513 | High | 7.5 | 2019-08-23 | An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) before 15.05.1 as used on Motorola CX2L MWR04L 1.01 and C1 MWR0… |
CVE-2019-15508 | Medium | 6.5 | 2019-08-23 | In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstan… |
CVE-2019-15507 | Medium | 6.5 | 2019-08-23 | In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-characters circumsta… |
CVE-2019-15505 | Critical | 9.8 | 2019-08-23 | drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB device traffic (which may be remote via… |
CVE-2019-15504 | Critical | 9.8 | 2019-08-23 | drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traffic (which may be remote via usbip or usb… |
CVE-2019-15499 | Medium | 6.1 | 2019-08-23 | CodiMD 1.3.1, when Safari is used, allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute, in conjunction with a data: URL. |
CVE-2019-15498 | High | 8.8 | 2019-08-23 | cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injectio… |
CVE-2019-15329 | High | 8.8 | 2019-08-22 | The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF. |
CVE-2019-15328 | Medium | 6.1 | 2019-08-22 | The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS. |
CVE-2019-15327 | Medium | 6.1 | 2019-08-22 | The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data. |
CVE-2019-15326 | High | 7.5 | 2019-08-22 | The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal. |
CVE-2019-15325 | High | 7.5 | 2019-08-22 | In GalliumOS 3.0, CONFIG_SECURITY_YAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/ptrace_scope to 1, which might increase… |
CVE-2019-13139 | High | 8.4 | 2019-08-22 | In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command e… |
CVE-2019-15331 | Medium | 6.1 | 2019-08-22 | The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection. |
CVE-2019-15330 | High | 7.5 | 2019-08-22 | The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading. |
CVE-2019-15060 | High | 8.8 | 2019-08-22 | The traceroute function on the TP-Link TL-WR840N v4 router with firmware through 0.9.1 3.16 is vulnerable to remote code execution via a crafted payload in an… |
CVE-2019-12386 | Medium | 5.4 | 2019-08-22 | An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" functionality. The injected code is reflect… |
CVE-2019-12385 | High | 8.8 | 2019-08-22 | An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/search.class.php sear… |
CVE-2019-14469 | Medium | 5.4 | 2019-08-22 | In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS. |
CVE-2019-7617 | High | 7.2 | 2019-08-22 | When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the pr… |
CVE-2019-9155 | Medium | 5.9 | 2019-08-22 | A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages… |
CVE-2019-9154 | High | 7.5 | 2019-08-22 | Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed. |
CVE-2019-9153 | High | 7.5 | 2019-08-22 | Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standa… |
CVE-2019-14751 | High | 7.5 | 2019-08-22 | NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (… |
CVE-2019-11031 | Critical | 9.8 | 2019-08-22 | Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the auto-update feature of IDVRUpdateService2 in DVRServer.exe. An attacker can upload files with a… |
CVE-2019-11030 | Critical | 9.8 | 2019-08-22 | Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailService in SMServer.ex… |
CVE-2019-11029 | High | 7.5 | 2019-08-22 | Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, leading to Directory Traversal. An attac… |
CVE-2019-11013 | Medium | 6.5 | 2019-08-22 | Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the file syste… |
CVE-2019-5635 | High | 7.5 | 2019-08-22 | A cleartext transmission of sensitive information vulnerability is present in Hickory Smart Ethernet Bridge from Belwith Products, LLC. Captured data reveals t… |
CVE-2019-5634 | Medium | 6.5 | 2019-08-22 | An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communicati… |
CVE-2019-5633 | Medium | 5.5 | 2019-08-22 | An insecure storage of sensitive information vulnerability is present in Hickory Smart for iOS mobile devices from Belwith Products, LLC. The application's dat… |
CVE-2019-5632 | Medium | 5.5 | 2019-08-22 | An insecure storage of sensitive information vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. The application's… |
CVE-2019-15324 | High | 8.8 | 2019-08-22 | The ad-inserter plugin before 2.4.22 for WordPress has remote code execution. |
CVE-2019-15323 | High | 7.5 | 2019-08-22 | The ad-inserter plugin before 2.4.20 for WordPress has path traversal. |
CVE-2019-15322 | Critical | 9.8 | 2019-08-22 | The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion. |
CVE-2019-15321 | Critical | 9.8 | 2019-08-22 | The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled. |
CVE-2019-15320 | Critical | 9.8 | 2019-08-22 | The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled. |
CVE-2019-15319 | Critical | 9.8 | 2019-08-22 | The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce. |
CVE-2019-15318 | Critical | 9.8 | 2019-08-22 | The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field. |
CVE-2019-15317 | Medium | 5.4 | 2019-08-22 | The give plugin before 2.4.7 for WordPress has XSS via a donor name. |
CVE-2019-15314 | Medium | 5.4 | 2019-08-22 | tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download_file.php?display&f… |
CVE-2019-14511 | High | 7.5 | 2019-08-22 | Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or r… |
CVE-2019-6177 | Critical | 9.8 | 2019-08-21 | A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to non-standard locatio… |
CVE-2019-5638 | High | 8.7 | 2019-08-21 | Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, lo… |
CVE-2019-15316 | High | 7.0 | 2019-08-21 | Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of Crea… |
CVE-2019-15315 | High | 7.8 | 2019-08-21 | Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local users can replace the current versions of… |
CVE-2019-14686 | High | 7.8 | 2019-08-21 | A DLL hijacking vulnerability exists in the Trend Micro Security's 2019 consumer family of products (v15) Folder Shield component and the standalone Trend Micr… |
CVE-2019-14685 | High | 7.8 | 2019-08-21 | A local privilege escalation vulnerability exists in Trend Micro Security 2019 (v15.0) in which, if exploited, would allow an attacker to manipulate a specific… |
CVE-2019-13476 | Medium | 5.4 | 2019-08-21 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list… |
CVE-2019-11603 | High | 7.5 | 2019-08-21 | A HTTP Traversal Attack in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.0.2 allows remote attackers to read files outside the h… |
CVE-2019-11602 | Medium | 5.3 | 2019-08-21 | Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote… |
CVE-2019-11601 | High | 7.5 | 2019-08-21 | A directory traversal vulnerability in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 al… |
CVE-2019-10687 | Critical | 9.8 | 2019-08-21 | KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entry_id[0] parameter, the admin/index.php?module=log id parameter, or an index.php… |
CVE-2019-1984 | Medium | 6.5 | 2019-08-21 | A vulnerability in Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with adminis… |
CVE-2019-1974 | Critical | 9.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Ex… |
CVE-2019-1948 | Medium | 5.9 | 2019-08-21 | A vulnerability in Cisco Webex Meetings Mobile (iOS) could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data by usin… |
CVE-2019-1938 | Critical | 9.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote… |
CVE-2019-1937 | Critical | 9.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Ex… |
CVE-2019-1936 | High | 7.2 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Ex… |
CVE-2019-1935 | Critical | 9.8 | 2019-08-21 | A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unau… |
CVE-2019-1908 | High | 7.5 | 2019-08-21 | A vulnerability in the Intelligent Platform Management Interface (IPMI) implementation of Cisco Integrated Management Controller (IMC) could allow an unauthent… |
CVE-2019-1907 | High | 8.8 | 2019-08-21 | A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to set sensitive configuration… |
CVE-2019-1900 | High | 7.5 | 2019-08-21 | A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to cause the web server proce… |
CVE-2019-1896 | High | 7.2 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject a… |
CVE-2019-1885 | High | 7.2 | 2019-08-21 | A vulnerability in the Redfish protocol of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject and execute arb… |
CVE-2019-1883 | High | 7.8 | 2019-08-21 | A vulnerability in the command-line interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker with read-only crede… |
CVE-2019-1871 | High | 7.2 | 2019-08-21 | A vulnerability in the Import Cisco IMC configuration utility of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to… |
CVE-2019-1865 | High | 8.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to… |
CVE-2019-1864 | High | 8.8 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to… |
CVE-2019-1863 | High | 8.1 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to… |
CVE-2019-1850 | High | 7.2 | 2019-08-21 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to… |
CVE-2019-1839 | Medium | 6.7 | 2019-08-21 | A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affect… |
CVE-2019-1634 | High | 7.2 | 2019-08-21 | A vulnerability in the Intelligent Platform Management Interface (IPMI) of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote at… |
CVE-2019-15127 | Medium | 5.4 | 2019-08-21 | REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file. |
CVE-2019-15074 | Critical | 9.6 | 2019-08-21 | The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code… |
CVE-2019-15045 | Medium | 5.3 | 2019-08-21 | AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality |
CVE-2019-14258 | High | 7.5 | 2019-08-21 | The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988. |
CVE-2019-14257 | High | 7.8 | 2019-08-21 | pyraw in Zenoss 2.5.3 allows local privilege escalation by modifying environment variables to redirect execution before privileges are dropped, aka ZEN-31765. |