2019 CVEs (page 94)
Page 94 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-14800 | Medium | 5.3 | 2019-08-15 | The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-… |
CVE-2019-14795 | Medium | 4.8 | 2019-08-15 | The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked… |
CVE-2019-14790 | Medium | 6.1 | 2019-08-15 | The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter, |
CVE-2019-14755 | High | 8.8 | 2019-08-15 | The profile photo upload feature in Leaf Admin 61.9.0212.10 f allows Unrestricted Upload of a File with a Dangerous Type. |
CVE-2019-15062 | High | 8.0 | 2019-08-14 | An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings pag… |
CVE-2019-14427 | Medium | 6.1 | 2019-08-14 | XSS exists in WEB STUDIO Ultimate Loan Manager 2.0 by adding a branch under the Branches button that sets the notes parameter with crafted JavaScript code. |
CVE-2019-9585 | Critical | 9.8 | 2019-08-14 | eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.***Metadata related operations, resulting in… |
CVE-2019-9584 | Critical | 9.8 | 2019-08-14 | eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details, shutting down the… |
CVE-2019-1258 | High | 8.8 | 2019-08-14 | An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens. This v… |
CVE-2019-1229 | High | 8.8 | 2019-08-14 | An elevation of privilege vulnerability exists in Dynamics On-Premise v9. An attacker who successfully exploited the vulnerability could leverage a customizer… |
CVE-2019-1228 | Medium | 5.5 | 2019-08-14 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulner… |
CVE-2019-1227 | Medium | 5.5 | 2019-08-14 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulner… |
CVE-2019-1226 | Critical | 9.8 | 2019-08-14 | A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to th… |
CVE-2019-1225 | High | 7.5 | 2019-08-14 | An information disclosure vulnerability exists when the Windows RDP server improperly discloses the contents of its memory. An attacker who successfully exploi… |
CVE-2019-1224 | High | 7.5 | 2019-08-14 | An information disclosure vulnerability exists when the Windows RDP server improperly discloses the contents of its memory. An attacker who successfully exploi… |
CVE-2019-1223 | High | 7.5 | 2019-08-14 | A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted… |
CVE-2019-1222 | Critical | 9.8 | 2019-08-14 | A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to th… |
CVE-2019-1218 | Medium | 5.4 | 2019-08-14 | A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An authenticated attacker could exploit t… |
CVE-2019-1213 | Critical | 9.8 | 2019-08-14 | A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP server. An attacker who… |
CVE-2019-1212 | Critical | 9.8 | 2019-08-14 | A memory corruption vulnerability exists in the Windows Server DHCP service when processing specially crafted packets. An attacker who successfully exploited t… |
CVE-2019-1211 | High | 7.3 | 2019-08-14 | An elevation of privilege vulnerability exists in Git for Visual Studio when it improperly parses configuration files. An attacker who successfully exploited t… |
CVE-2019-1206 | High | 7.5 | 2019-08-14 | A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP failover server. An atta… |
CVE-2019-1205 | Critical | 9.8 | 2019-08-14 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploi… |
CVE-2019-1204 | Medium | 4.3 | 2019-08-14 | An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting… |
CVE-2019-1203 | Medium | 5.4 | 2019-08-14 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2019-1202 | Medium | 4.4 | 2019-08-14 | An information disclosure vulnerability exists in the way Microsoft SharePoint handles session objects. An authenticated attacker who successfully exploited th… |
CVE-2019-1201 | High | 7.8 | 2019-08-14 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who successfully exploi… |
CVE-2019-1200 | High | 7.8 | 2019-08-14 | A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory. An attacker who successfully exp… |
CVE-2019-1199 | High | 7.8 | 2019-08-14 | A remote code execution vulnerability exists in Microsoft Outlook when the software fails to properly handle objects in memory. An attacker who successfully ex… |
CVE-2019-1198 | Medium | 6.5 | 2019-08-14 | An elevation of privilege exists in SyncController.dll. An attacker who successfully exploited the vulnerability could run arbitrary code with elevated privile… |
CVE-2019-1197 | Medium | 4.2 | 2019-08-14 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |
CVE-2019-1196 | Medium | 4.2 | 2019-08-14 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |
CVE-2019-1195 | Medium | 4.2 | 2019-08-14 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |
CVE-2019-1194 | High | 7.5 | 2019-08-14 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corru… |
CVE-2019-1193 | Medium | 6.4 | 2019-08-14 | A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that… |
CVE-2019-1192 | Medium | 4.3 | 2019-08-14 | A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins. The vulnerability allows Microsoft brow… |
CVE-2019-1190 | High | 7.8 | 2019-08-14 | An elevation of privilege vulnerability exists in the way that the Windows kernel image handles objects in memory. An attacker who successfully exploited the v… |
CVE-2019-1188 | High | 7.5 | 2019-08-14 | A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed. An attacker who successfu… |
CVE-2019-1187 | Medium | 5.5 | 2019-08-14 | A denial of service vulnerability exists when the XmlLite runtime (XmlLite.dll) improperly parses XML input. An attacker who successfully exploited this vulner… |
CVE-2019-1186 | High | 7.0 | 2019-08-14 | An elevation of privilege vulnerability exists in the way that the wcmsvc.dll handles objects in memory. An attacker who successfully exploited the vulnerabili… |
CVE-2019-1185 | High | 7.3 | 2019-08-14 | An elevation of privilege vulnerability exists due to a stack corruption in Windows Subsystem for Linux. An attacker who successfully exploited the vulnerabili… |
CVE-2019-1184 | Medium | 6.7 | 2019-08-14 | An elevation of privilege vulnerability exists when Windows Core Shell COM Server Registrar improperly handles COM calls. An attacker who successfully exploite… |
CVE-2019-1183 | High | 8.8 | 2019-08-14 | This information is being revised to indicate that this CVE (CVE-2019-1183) is fully mitigated by the security updates for the vulnerability discussed in CVE-2… |
CVE-2019-1182 | Critical | 9.8 | 2019-08-14 | A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to th… |
CVE-2019-1181 | Critical | 9.8 | 2019-08-14 | A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to th… |
CVE-2019-1180 | High | 7.0 | 2019-08-14 | An elevation of privilege vulnerability exists in the way that the wcmsvc.dll handles objects in memory. An attacker who successfully exploited the vulnerabili… |
CVE-2019-1179 | High | 7.0 | 2019-08-14 | An elevation of privilege vulnerability exists in the way that the unistore.dll handles objects in memory. An attacker who successfully exploited the vulnerabi… |
CVE-2019-1178 | High | 7.0 | 2019-08-14 | An elevation of privilege vulnerability exists in the way that the ssdpsrv.dll handles objects in memory. An attacker who successfully exploited the vulnerabil… |
CVE-2019-1177 | High | 7.0 | 2019-08-14 | An elevation of privilege vulnerability exists in the way that the rpcss.dll handles objects in memory. An attacker who successfully exploited the vulnerabilit… |
CVE-2019-1176 | High | 7.0 | 2019-08-14 | An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited this vulnerability cou… |
CVE-2019-1175 | High | 7.0 | 2019-08-14 | An elevation of privilege vulnerability exists in the way that the psmsrv.dll handles objects in memory. An attacker who successfully exploited the vulnerabili… |
CVE-2019-1174 | High | 7.0 | 2019-08-14 | An elevation of privilege vulnerability exists in the way that the PsmServiceExtHost.dll handles objects in memory. An attacker who successfully exploited the… |
CVE-2019-1173 | High | 7.0 | 2019-08-14 | An elevation of privilege vulnerability exists in the way that the PsmServiceExtHost.dll handles objects in memory. An attacker who successfully exploited the… |
CVE-2019-1172 | Medium | 4.3 | 2019-08-14 | An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An attacker who succes… |
CVE-2019-1171 | Medium | 5.6 | 2019-08-14 | An information disclosure vulnerability exists in SymCrypt during the OAEP decryption stage. An attacker who successfully exploited this vulnerability could ob… |
CVE-2019-1170 | High | 7.9 | 2019-08-14 | An elevation of privilege vulnerability exists when reparse points are created by sandboxed processes allowing sandbox escape. An attacker who successfully exp… |
CVE-2019-1169 | High | 7.8 | 2019-08-14 | An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who succe… |
CVE-2019-1168 | High | 7.8 | 2019-08-14 | An elevation of privilege exists in the p2pimsvc service where an attacker who successfully exploited the vulnerability could run arbitrary code with elevated… |
CVE-2019-1164 | High | 7.8 | 2019-08-14 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this… |
CVE-2019-1163 | Medium | 5.5 | 2019-08-14 | A security feature bypass exists when Windows incorrectly validates CAB file signatures. An attacker who successfully exploited this vulnerability could inject… |
CVE-2019-1162 | High | 7.8 | 2019-08-14 | An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC). An attacker who successfully expl… |
CVE-2019-1161 | High | 7.1 | 2019-08-14 | An elevation of privilege vulnerability exists when the MpSigStub.exe for Defender allows file deletion in arbitrary locations. To exploit the vulnerability, a… |
CVE-2019-1159 | High | 7.8 | 2019-08-14 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this… |
CVE-2019-1158 | Medium | 5.5 | 2019-08-14 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1157 | High | 7.8 | 2019-08-14 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited… |
CVE-2019-1156 | High | 7.8 | 2019-08-14 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited… |
CVE-2019-1155 | High | 7.8 | 2019-08-14 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited… |
CVE-2019-1154 | Medium | 5.5 | 2019-08-14 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1153 | Medium | 5.5 | 2019-08-14 | An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory. An attacker who successfully… |
CVE-2019-1152 | High | 8.8 | 2019-08-14 | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully ex… |
CVE-2019-1151 | High | 8.8 | 2019-08-14 | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully ex… |
CVE-2019-1150 | High | 8.8 | 2019-08-14 | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully ex… |
CVE-2019-1149 | High | 8.8 | 2019-08-14 | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully ex… |
CVE-2019-1148 | Medium | 5.5 | 2019-08-14 | An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory. An attacker who successfully… |
CVE-2019-1147 | High | 7.8 | 2019-08-14 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited… |
CVE-2019-1146 | High | 7.8 | 2019-08-14 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited… |
CVE-2019-1145 | High | 8.8 | 2019-08-14 | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully ex… |
CVE-2019-1144 | High | 8.8 | 2019-08-14 | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully ex… |
CVE-2019-1143 | Medium | 5.5 | 2019-08-14 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exp… |
CVE-2019-1141 | Medium | 4.2 | 2019-08-14 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |
CVE-2019-1140 | High | 8.8 | 2019-08-14 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |
CVE-2019-1139 | Medium | 4.2 | 2019-08-14 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |
CVE-2019-1133 | High | 7.5 | 2019-08-14 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corru… |
CVE-2019-1131 | Medium | 4.2 | 2019-08-14 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerab… |
CVE-2019-1078 | Medium | 5.5 | 2019-08-14 | An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory. An attacker who successfully exploited… |
CVE-2019-1057 | High | 7.5 | 2019-08-14 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input. An attacker who successfully exploited the… |
CVE-2019-1030 | Medium | 4.3 | 2019-08-14 | An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory. An attacker who successfully exploi… |
CVE-2019-15058 | Critical | 9.1 | 2019-08-14 | stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information Disclosure or Denial of Service. |
CVE-2019-14527 | Critical | 9.8 | 2019-08-14 | An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. System commands can be executed, via the web interface, after authentication. |
CVE-2019-14526 | High | 8.1 | 2019-08-14 | An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically… |
CVE-2019-14216 | High | 8.8 | 2019-08-14 | An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-custom-set mi… |
CVE-2019-13030 | High | 8.2 | 2019-08-14 | eQ-3 Homematic CCU3 AddOn 'Mediola NEO Server for Homematic CCU3' prior to 2.4.5 allows uncontrolled admin access to start or stop the Node.js process, resulti… |
CVE-2019-12104 | High | 8.8 | 2019-08-14 | The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by several post-authentication command injection vulnerab… |
CVE-2019-12103 | Critical | 9.8 | 2019-08-14 | The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by a pre-authentication command injection vulnerability. |
CVE-2019-0965 | High | 7.6 | 2019-08-14 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2019-0736 | Critical | 9.8 | 2019-08-14 | A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client. An attacker who succes… |
CVE-2019-0723 | Medium | 5.8 | 2019-08-14 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2019-0720 | High | 8.0 | 2019-08-14 | A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user o… |
CVE-2019-0718 | Medium | 5.8 | 2019-08-14 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2019-0717 | Medium | 5.8 | 2019-08-14 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |