2019 CVEs (page 95)
Page 95 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-0716 | Medium | 5.8 | 2019-08-14 | A denial of service vulnerability exists when Windows improperly handles objects in memory. An attacker who successfully exploited the vulnerability could caus… |
CVE-2019-0715 | Medium | 5.8 | 2019-08-14 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2019-0714 | Medium | 5.8 | 2019-08-14 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2019-9583 | High | 8.2 | 2019-08-14 | eQ-3 Homematic CCU2 and CCU3 obtain session IDs without login. This allows a Denial of Service and is a starting point for other attacks. Affected versions for… |
CVE-2019-9582 | High | 7.5 | 2019-08-14 | eQ-3 Homematic CCU2 outdated base software packages allows Denial of Service. CCU2 affected versions: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10… |
CVE-2019-15052 | Critical | 9.8 | 2019-08-14 | The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle… |
CVE-2019-12262 | Critical | 9.8 | 2019-08-14 | Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component. IPNET security vulnerability: Handling of unsolicited Re… |
CVE-2019-9506 | High | 8.1 | 2019-08-14 | The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influen… |
CVE-2019-3639 | High | 7.1 | 2019-08-14 | Clickjack vulnerability in Adminstrator web console in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows remote attackers to conduct clickjacking attac… |
CVE-2019-3637 | Medium | 6.7 | 2019-08-14 | Privilege Escalation vulnerability in McAfee FRP 5.x prior to 5.1.0.209 allows local users to gain elevated privileges via running McAfee Tray with elevated pr… |
CVE-2019-3635 | Medium | 6.5 | 2019-08-14 | Exfiltration of Data in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows attackers to obtain sensitive data via crafting a complex webpage that will t… |
CVE-2019-15053 | Medium | 6.8 | 2019-08-14 | The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors… |
CVE-2019-10201 | High | 8.1 | 2019-08-14 | It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and remove… |
CVE-2019-10199 | High | 8.8 | 2019-08-14 | It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an… |
CVE-2019-15050 | High | 8.8 | 2019-08-14 | An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_AvccAtom class at Core/Ap4AvccAtom.cpp. |
CVE-2019-15049 | High | 8.8 | 2019-08-14 | An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_Dec3Atom class at Core/Ap4Dec3Atom.cpp. |
CVE-2019-15048 | High | 8.8 | 2019-08-14 | An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer overflow in the AP4_RtpAtom class at Core/Ap4RtpAtom.cpp. |
CVE-2019-15047 | High | 8.8 | 2019-08-14 | An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the function AP4_BitReader::SkipBits at Core/Ap4Utils.cpp. |
CVE-2019-14974 | Medium | 6.1 | 2019-08-14 | SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS. |
CVE-2019-11652 | Critical | 9.8 | 2019-08-14 | A potential authorization bypass issue was found in Micro Focus Self Service Password Reset (SSPR) versions prior to: 4.4.0.3, 4.3.0.6, and 4.2.0.6. Upgrade to… |
CVE-2019-8062 | High | 7.8 | 2019-08-14 | Adobe After Effects versions 16 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitrary cod… |
CVE-2019-7961 | High | 7.8 | 2019-08-14 | Adobe Prelude CC versions 8.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2019-7931 | High | 7.8 | 2019-08-14 | Adobe Premiere Pro CC versions 13.1.2 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitra… |
CVE-2019-7870 | High | 7.8 | 2019-08-14 | Adobe Character Animator versions 2.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitra… |
CVE-2019-15046 | High | 7.5 | 2019-08-14 | Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over Service (FOS) replication, aka SD-7998… |
CVE-2019-15025 | Critical | 9.8 | 2019-08-14 | The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page. |
CVE-2019-0349 | High | 7.2 | 2019-08-14 | SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.4… |
CVE-2019-0351 | High | 8.8 | 2019-08-14 | A remote code execution vulnerability exists in the SAP NetWeaver UDDI Server (Services Registry), versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50. Because of this… |
CVE-2019-0348 | Medium | 6.5 | 2019-08-14 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.1, 4.2, can access database with unencrypted connection, even if the quality… |
CVE-2019-0346 | Medium | 6.5 | 2019-08-14 | Unencrypted communication error in SAP Business Objects Business Intelligence Platform (Central Management Console), version 4.2, leads to disclosure of list o… |
CVE-2019-0345 | Critical | 9.8 | 2019-08-14 | A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview), versions 7.30, 7.31, 7… |
CVE-2019-0344 | Critical | 9.8 | 2019-08-14 | Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbi… |
CVE-2019-0343 | High | 8.8 | 2019-08-14 | SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that… |
CVE-2019-0341 | High | 8.8 | 2019-08-14 | The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script code in the context of the application… |
CVE-2019-0340 | Medium | 5.4 | 2019-08-14 | The XML parser, which is being used by SAP Enable Now, before version 1902, has not been hardened correctly, leading to Missing XML Validation vulnerability. T… |
CVE-2019-0338 | Medium | 5.3 | 2019-08-14 | During an OData V2/V4 request in SAP Gateway, versions 750, 751, 752, 753, the HTTP Header attributes cache-control and pragma were not properly set, allowing… |
CVE-2019-0337 | Medium | 6.1 | 2019-08-14 | Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and a… |
CVE-2019-0335 | Medium | 6.1 | 2019-08-14 | Under certain conditions SAP BusinessObjects Business Intelligence Platform (Central Management Console), versions 4.1, 4.2, 4.3, allows an attacker to store a… |
CVE-2019-0334 | Medium | 5.4 | 2019-08-14 | When creating a module in SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, it is possible to store a malicious script… |
CVE-2019-0333 | Medium | 6.5 | 2019-08-14 | In some situations, when a client cancels a query in SAP BusinessObjects Business Intelligence Platform (Web Intelligence), versions 4.2, 4.3, the attacker can… |
CVE-2019-0332 | Medium | 6.1 | 2019-08-14 | SAP BusinessObjects Business Intelligence Platform (Info View), versions 4.1, 4.2, 4.3, allows an attacker to give some payload for keyword in the search and i… |
CVE-2019-0331 | Medium | 5.3 | 2019-08-14 | Under certain conditions, SAP BusinessObjects Business Intelligence Platform (BI Workspace), versions 4.1, 4.2, 4.3, allows an attacker to access sensitive dat… |
CVE-2019-15027 | Critical | 9.8 | 2019-08-14 | The MediaTek Embedded Multimedia Card (eMMC) subsystem for Android on MT65xx, MT66xx, and MT8163 SoC devices allows attackers to execute arbitrary commands as… |
CVE-2019-14975 | High | 7.1 | 2019-08-14 | Artifex MuPDF before 1.16.0 has a heap-based buffer over-read in fz_chartorune in fitz/string.c because pdf/pdf-op-filter.c does not check for a missing string. |
CVE-2019-14973 | Medium | 6.5 | 2019-08-14 | _TIFFCheckMalloc and _TIFFCheckRealloc in tif_aux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because they rely on compiler behavior that is… |
CVE-2019-15028 | Medium | 5.3 | 2019-08-14 | In Joomla! before 3.9.11, inadequate checks in com_contact could allow mail submission in disabled forms. |
CVE-2019-9518 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with a… |
CVE-2019-9517 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 w… |
CVE-2019-9516 | Medium | 6.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length… |
CVE-2019-9515 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to t… |
CVE-2019-9514 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an in… |
CVE-2019-9513 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and con… |
CVE-2019-9512 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, ca… |
CVE-2019-9511 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The… |
CVE-2019-5299 | High | 7.8 | 2019-08-13 | Huawei mobile phones Hima-AL00Bhave with Versions earlier than HMA-AL00C00B175 have a signature verification bypass vulnerability. Attackers can induce users t… |
CVE-2019-5280 | Medium | 6.5 | 2019-08-13 | The SIP TLS module of Huawei CloudLink Phone 7900 with V600R019C10 has a TLS certificate verification vulnerability. Due to insufficient verification of specif… |
CVE-2019-5223 | High | 7.8 | 2019-08-13 | PCManager 9.1.3.1 has an improper authentication vulnerability. The certain driver interface of the software does not perform a validation of user-mode data pr… |
CVE-2019-14809 | Critical | 9.8 | 2019-08-13 | net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is rela… |
CVE-2019-12479 | Critical | 9.1 | 2019-08-13 | An issue was discovered in 20|20 Storage 2.11.0. A Path Traversal vulnerability in the TwentyTwenty.Storage library in the LocalStorageProvider allows creating… |
CVE-2019-11207 | High | 8.8 | 2019-08-13 | The web server component of TIBCO Software Inc.'s TIBCO LogLogic Enterprise Virtual Appliance, and TIBCO LogLogic Log Management Intelligence contains multiple… |
CVE-2019-14986 | High | 8.1 | 2019-08-13 | eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web int… |
CVE-2019-14985 | Critical | 9.8 | 2019-08-13 | eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because t… |
CVE-2019-14984 | High | 8.1 | 2019-08-13 | eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web int… |
CVE-2019-12808 | High | 7.8 | 2019-08-13 | ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. An attacker can overwrite an e… |
CVE-2019-12807 | High | 7.8 | 2019-08-13 | Alzip 10.83 and earlier version contains a stack-based buffer overflow vulnerability, caused by improper bounds checking during the parsing of crafted ISO arch… |
CVE-2019-12806 | High | 8.8 | 2019-08-13 | UniSign 2.0.4.0 and earlier version contains a stack-based buffer overflow vulnerability which can overwrite the stack with arbitrary data, due to a buffer ove… |
CVE-2019-13416 | Medium | 6.5 | 2019-08-13 | Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster igno… |
CVE-2019-13415 | Medium | 6.5 | 2019-08-13 | Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data they are not autho… |
CVE-2019-10943 | High | 7.5 | 2019-08-13 | A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (… |
CVE-2019-10942 | High | 8.6 | 2019-08-13 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl… |
CVE-2019-10929 | Medium | 5.9 | 2019-08-13 | A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), S… |
CVE-2019-10928 | Medium | 6.6 | 2019-08-13 | A vulnerability has been identified in SCALANCE SC-600 (V2.0). An authenticated attacker with access to port 22/tcp as well as physical access to an affected d… |
CVE-2019-10927 | Medium | 6.5 | 2019-08-13 | A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200 (V4.1)… |
CVE-2019-14993 | High | 7.5 | 2019-08-13 | Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService… |
CVE-2019-8448 | Medium | 5.3 | 2019-08-13 | The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attackers to enumerate usernames via an informa… |
CVE-2019-5681 | High | 7.8 | 2019-08-13 | NVIDIA Shield TV Experience prior to v8.0, contains a vulnerability in the custom NVIDIA API used in the mount system service where user data could be overridd… |
CVE-2019-13420 | Medium | 5.9 | 2019-08-13 | Search Guard versions before 21.0 had an timing side channel issue when using the internal user database. |
CVE-2019-13419 | High | 7.5 | 2019-08-13 | Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked. |
CVE-2019-14530 | High | 8.8 | 2019-08-13 | An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by… |
CVE-2019-14516 | High | 7.4 | 2019-08-13 | The mAadhaar application 1.2.7 for Android lacks SSL Certificate Validation, leading to man-in-the-middle attacks against requests for FAQs or Help. |
CVE-2019-14987 | Medium | 4.8 | 2019-08-13 | Adive Framework through 2.0.7 is affected by XSS in the Create New Table and Create New Navigation Link functions. |
CVE-2019-14982 | Medium | 6.5 | 2019-08-12 | In Exiv2 before v0.27.2, there is an integer overflow vulnerability in the WebPImage::getHeaderOffset function in webpimage.cpp. It can lead to a buffer overfl… |
CVE-2019-14981 | Medium | 6.5 | 2019-08-12 | In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to c… |
CVE-2019-14980 | Medium | 6.5 | 2019-08-12 | In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause… |
CVE-2019-14359 | Low | 2.4 | 2019-08-12 | On BC Vault devices, a side channel for the row-based SSD1309 OLED display was found. The power consumption of each row-based display cycle depends on the numb… |
CVE-2019-14976 | Medium | 6.1 | 2019-08-12 | iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter. |
CVE-2019-13418 | High | 7.5 | 2019-08-12 | Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized. |
CVE-2019-13417 | Medium | 5.3 | 2019-08-12 | Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user… |
CVE-2019-14969 | High | 7.8 | 2019-08-12 | Netwrix Auditor before 9.8 has insecure permissions on %PROGRAMDATA%\Netwrix Auditor\Logs\ActiveDirectory\ and sub-folders. In addition, the service Netwrix.AD… |
CVE-2019-14968 | Critical | 9.8 | 2019-08-12 | An issue was discovered in imcat 4.9. There is SQL Injection via the index.php order parameter in a mod=faqs action. |
CVE-2019-14967 | Medium | 6.1 | 2019-08-12 | An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. There exists an XSS vulnerability. |
CVE-2019-14966 | High | 8.8 | 2019-08-12 | An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. There exists an authenticated SQL injection. |
CVE-2019-14965 | Critical | 9.8 | 2019-08-12 | An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection (SSTI) issue exists. |
CVE-2019-13462 | Critical | 9.1 | 2019-08-12 | Lansweeper before 7.1.117.4 allows unauthenticated SQL injection. |
CVE-2019-12618 | Critical | 9.8 | 2019-08-12 | HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver. |
CVE-2019-14951 | High | 7.5 | 2019-08-12 | The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the au… |
CVE-2019-14947 | Medium | 5.4 | 2019-08-12 | The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade. |
CVE-2019-14946 | Medium | 5.4 | 2019-08-12 | The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations. |
CVE-2019-14945 | Medium | 5.4 | 2019-08-12 | The ultimate-member plugin before 2.0.54 for WordPress has XSS. |
CVE-2019-14950 | Medium | 6.1 | 2019-08-12 | The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page. |