2019 CVEs (page 92)
Page 92 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-8013 | High | 8.8 | 2019-08-20 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-8012 | High | 7.5 | 2019-08-20 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-8011 | High | 7.5 | 2019-08-20 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-8010 | High | 7.5 | 2019-08-20 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-8009 | Critical | 9.8 | 2019-08-20 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-8008 | High | 8.8 | 2019-08-20 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-8007 | High | 7.5 | 2019-08-20 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-8006 | Critical | 9.8 | 2019-08-20 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-8005 | High | 7.5 | 2019-08-20 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-8004 | High | 7.5 | 2019-08-20 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-8003 | Critical | 9.8 | 2019-08-20 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-8002 | High | 7.5 | 2019-08-20 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-7965 | Critical | 9.8 | 2019-08-20 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.3049… |
CVE-2019-4482 | Medium | 5.4 | 2019-08-20 | IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2019-4437 | Medium | 5.3 | 2019-08-20 | IBM API Connect 2018.1 through 2018.4.1.6 may inadvertently leak sensitive details about internal servers and network via API swagger. IBM X-force ID: 162947. |
CVE-2019-4424 | High | 8.2 | 2019-08-20 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when proce… |
CVE-2019-4340 | High | 8.2 | 2019-08-20 | IBM Security Guardium Big Data Intelligence 4.0 (SonarG) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote atta… |
CVE-2019-4338 | High | 7.5 | 2019-08-20 | IBM Security Guardium Big Data Intelligence 4.0 (SonarG) does not properly restrict the size or amount of resources that are requested or influenced by an acto… |
CVE-2019-4167 | Medium | 6.5 | 2019-08-20 | IBM StoredIQ 7.6.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a u… |
CVE-2019-4120 | Medium | 5.4 | 2019-08-20 | IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2019-2137 | Medium | 5.5 | 2019-08-20 | In the endCall() function of TelecomManager.java, there is a possible Denial of Service due to a missing permission check. This could lead to local denial of a… |
CVE-2019-2136 | Medium | 5.5 | 2019-08-20 | In Status::readFromParcel of Status.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosu… |
CVE-2019-2135 | Medium | 5.5 | 2019-08-20 | In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information discl… |
CVE-2019-2134 | High | 7.8 | 2019-08-20 | In phFriNfc_ExtnsTransceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalatio… |
CVE-2019-2133 | High | 7.8 | 2019-08-20 | In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of pr… |
CVE-2019-2132 | High | 7.8 | 2019-08-20 | It is possible to overlay the VPN dialog by a malicious application. This could lead to local escalation of privilege with no additional execution privileges n… |
CVE-2019-2131 | High | 7.8 | 2019-08-20 | An application with overlay permission can display overlays on top of settings UI. This could lead to local escalation of privilege with no additional executio… |
CVE-2019-2130 | Critical | 9.8 | 2019-08-20 | In CompilationJob::FinalizeJob of compiler.cc, there is a possible remote code execution due to type confusion. This could lead to escalation of privilege from… |
CVE-2019-2129 | Medium | 6.5 | 2019-08-20 | In extract3GPPGlobalDescriptions of TextDescriptions.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote infor… |
CVE-2019-2128 | High | 7.8 | 2019-08-20 | In ACELP_4t64_fx of c4t64fx.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no… |
CVE-2019-2127 | High | 7.8 | 2019-08-20 | In AudioInputDescriptor::setClientActive of AudioInputDescriptor.cpp, there is possible memory corruption due to a use after free. This could lead to local esc… |
CVE-2019-2126 | High | 8.8 | 2019-08-20 | In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code executi… |
CVE-2019-2125 | High | 7.3 | 2019-08-20 | In ChangeDefaultDialerDialog.java, there is a possible escalation of privilege due to an overlay attack. This could lead to local escalation of privilege, gran… |
CVE-2019-2122 | High | 7.3 | 2019-08-20 | In LockTaskController.lockKeyguardIfNeeded of the LockTaskController.java, there was a difference in the handling of the default case between the WindowManager… |
CVE-2019-2121 | High | 7.0 | 2019-08-20 | In ActivityManagerService.attachApplication of ActivityManagerService, there is a possible race condition. This could lead to local escalation of privilege wit… |
CVE-2019-2120 | High | 7.8 | 2019-08-20 | In OatFileAssistant::GenerateOatFile of oat_file_assistant.cc, there is a possible file corruption issue due to an insecure default value. This could lead to l… |
CVE-2019-13520 | High | 7.8 | 2019-08-20 | Multiple buffer overflow issues have been identified in Alpha5 Smart Loader: All versions prior to 4.2. An attacker could use specially crafted project files t… |
CVE-2019-11924 | High | 7.5 | 2019-08-20 | A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resulting in memory exha… |
CVE-2019-7594 | Medium | 6.8 | 2019-08-20 | Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management P… |
CVE-2019-7593 | Medium | 6.8 | 2019-08-20 | Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management… |
CVE-2019-4485 | Medium | 4.3 | 2019-08-20 | IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an… |
CVE-2019-4484 | Medium | 4.3 | 2019-08-20 | IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an… |
CVE-2019-4483 | Critical | 9.8 | 2019-08-20 | IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could sen… |
CVE-2019-4481 | Critical | 9.8 | 2019-08-20 | IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could sen… |
CVE-2019-4460 | High | 7.5 | 2019-08-20 | IBM API Connect 5.0.0.0 through 5.0.8.6 developer portal could allow a remote attacker to traverse directories on the system. An attacker could send a speciall… |
CVE-2019-4433 | High | 8.2 | 2019-08-20 | IBM InfoSphere Global Name Management 5.0 and 6.0 and IBM InfoSphere Identity Insight 8.1 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attac… |
CVE-2019-4425 | Medium | 5.7 | 2019-08-20 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive information from another user by inserting link… |
CVE-2019-4420 | Medium | 6.2 | 2019-08-20 | IBM Intelligent Operations Center V5.1.0 through V5.2.0 could disclose detailed error messages, revealing sensitive information that could aid in further attac… |
CVE-2019-4419 | High | 8.2 | 2019-08-20 | IBM Intelligent Operations Center V5.1.0 through V5.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attac… |
CVE-2019-4402 | High | 7.5 | 2019-08-20 | IBM API Connect 2018.1 through 2018.4.1.6 developer portal could allow an unauthorized user to cause a denial of service via an unprotected API. IBM X-Force ID… |
CVE-2019-4310 | High | 7.5 | 2019-08-20 | IBM Security Guardium Big Data Intelligence 4.0 (SonarG) uses an inadequate account lockout setting that could allow a remote attacker to brute force account c… |
CVE-2019-4308 | Medium | 4.3 | 2019-08-20 | IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow a… |
CVE-2019-4294 | High | 7.8 | 2019-08-20 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through 9.1.0.2, and 9.1.1… |
CVE-2019-4253 | High | 7.8 | 2019-08-20 | IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local privileged Informix user to load a malicious shared library and gain root access privil… |
CVE-2019-4117 | High | 8.8 | 2019-08-20 | IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions trans… |
CVE-2019-4049 | Medium | 5.5 | 2019-08-20 | IBM MQ 9.1.0.0, 9.1.0.1, 9.1.1, and 9.1.0.2 is vulnerable to a denial of service due to a local user being able to fill up the disk space of the underlying fil… |
CVE-2019-3968 | High | 8.8 | 2019-08-20 | In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new f… |
CVE-2019-3753 | Medium | 6.5 | 2019-08-20 | Dell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a plain-text password storage vulnerabili… |
CVE-2019-10745 | High | 7.5 | 2019-08-20 | assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying… |
CVE-2019-3967 | Medium | 6.5 | 2019-08-20 | In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary… |
CVE-2019-3966 | Medium | 6.1 | 2019-08-20 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to execute arbitr… |
CVE-2019-3965 | Medium | 6.1 | 2019-08-20 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to execute arbit… |
CVE-2019-3964 | Medium | 6.1 | 2019-08-20 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary… |
CVE-2019-3963 | Medium | 6.1 | 2019-08-20 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitr… |
CVE-2019-11209 | High | 8.8 | 2019-08-20 | The realm configuration component of TIBCO Software Inc.'s TIBCO FTL Community Edition, TIBCO FTL Developer Edition, TIBCO FTL Enterprise Edition contains a vu… |
CVE-2019-15238 | High | 8.8 | 2019-08-20 | The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field. |
CVE-2019-15291 | Medium | 4.6 | 2019-08-20 | An issue was discovered in the Linux kernel through 5.2.9. There is a NULL pointer dereference caused by a malicious USB device in the flexcop_usb_probe functi… |
CVE-2019-15233 | Medium | 6.1 | 2019-08-20 | The Live:Text Box macro in the Old Street Live Input Macros app before 2.11 for Confluence has XSS, leading to theft of the Administrator Session Cookie. |
CVE-2019-15082 | Medium | 6.1 | 2019-08-20 | The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS. |
CVE-2019-14687 | High | 7.8 | 2019-08-20 | A DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited, would allow an attacker to load an arbitrary unsigned DLL into… |
CVE-2019-14684 | High | 7.8 | 2019-08-20 | A DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited, would allow an attacker to load an arbitrary unsigned DLL into… |
CVE-2019-14430 | Medium | 5.3 | 2019-08-20 | plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection. |
CVE-2019-11806 | Low | 3.3 | 2019-08-20 | OX App Suite 7.10.1 and earlier has Insecure Permissions. |
CVE-2019-11522 | Medium | 5.4 | 2019-08-20 | OX App Suite 7.10.0 to 7.10.2 allows XSS. |
CVE-2019-11521 | High | 8.1 | 2019-08-20 | OX App Suite 7.10.1 allows Content Spoofing. |
CVE-2019-12889 | High | 7.0 | 2019-08-20 | An unauthenticated privilege escalation exists in SailPoint Desktop Password Reset 7.2. A user with local access to only the Windows logon screen can escalate… |
CVE-2019-15239 | High | 7.8 | 2019-08-20 | In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12, was incorrectly backported to the earlier longterm k… |
CVE-2019-15227 | Medium | 6.1 | 2019-08-20 | FlightPath 4.8.3 has XSS in the Content, Edit urgent message, and Users sections of the Admin Console. This could lead to cookie stealing and other malicious a… |
CVE-2019-15237 | High | 7.4 | 2019-08-20 | Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks. |
CVE-2019-15232 | Critical | 9.8 | 2019-08-20 | Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession… |
CVE-2019-15229 | High | 8.8 | 2019-08-20 | FUEL CMS 1.4.4 has CSRF in the blocks/create/ Create Blocks section of the Admin console. This could lead to an attacker tricking the administrator into execut… |
CVE-2019-15228 | Medium | 5.4 | 2019-08-20 | FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability ca… |
CVE-2019-15225 | High | 7.5 | 2019-08-19 | In Envoy through 1.11.1, users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. A remote attacker may… |
CVE-2019-15224 | Critical | 9.8 | 2019-08-19 | The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1… |
CVE-2019-15223 | Medium | 4.6 | 2019-08-19 | An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/driver.c… |
CVE-2019-15222 | Medium | 4.6 | 2019-08-19 | An issue was discovered in the Linux kernel before 5.2.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/helper.c (motu_… |
CVE-2019-15221 | Medium | 4.6 | 2019-08-19 | An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/pcm.c dr… |
CVE-2019-15220 | Medium | 4.6 | 2019-08-19 | An issue was discovered in the Linux kernel before 5.2.1. There is a use-after-free caused by a malicious USB device in the drivers/net/wireless/intersil/p54/p… |
CVE-2019-15219 | Medium | 4.6 | 2019-08-19 | An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/sisusbvg… |
CVE-2019-15218 | Medium | 4.6 | 2019-08-19 | An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/siano/s… |
CVE-2019-15217 | Medium | 4.6 | 2019-08-19 | An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx… |
CVE-2019-15216 | Medium | 4.6 | 2019-08-19 | An issue was discovered in the Linux kernel before 5.0.14. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/yurex.c… |
CVE-2019-15215 | Medium | 4.6 | 2019-08-19 | An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/cpia2/cpia2_usb.c… |
CVE-2019-15214 | Medium | 6.4 | 2019-08-19 | An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because card disconnection causes certain data stru… |
CVE-2019-15213 | Medium | 4.6 | 2019-08-19 | An issue was discovered in the Linux kernel before 5.2.3. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/dvb-usb/dvb-usb-i… |
CVE-2019-15212 | Medium | 4.6 | 2019-08-19 | An issue was discovered in the Linux kernel before 5.1.8. There is a double-free caused by a malicious USB device in the drivers/usb/misc/rio500.c driver. |
CVE-2019-15211 | Medium | 4.6 | 2019-08-19 | An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/v4l2-core/v4l2-dev.c… |
CVE-2019-11163 | High | 7.8 | 2019-08-19 | Insufficient access control in a hardware abstraction driver for Intel(R) Processor Identification Utility for Windows before version 6.1.0731 may allow an aut… |
CVE-2019-11162 | High | 7.8 | 2019-08-19 | Insufficient access control in hardware abstraction in SEMA driver for Intel(R) Computing Improvement Program before version 2.4.0.04733 may allow an authentic… |
CVE-2019-11148 | High | 7.8 | 2019-08-19 | Improper permissions in the installer for Intel(R) Remote Displays SDK before version 2.0.1 R2 may allow an authenticated user to potentially enable escalation… |