2019 CVEs (page 96)
Page 96 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-14949 | Medium | 6.1 | 2019-08-12 | The wp-database-backup plugin before 5.1.2 for WordPress has XSS. |
CVE-2019-14948 | Medium | 5.4 | 2019-08-12 | The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure. |
CVE-2019-14932 | High | 7.5 | 2019-08-12 | The Recruitment module in Humanica Humatrix 7 1.0.0.681 and 1.0.0.203 allows remote attackers to access all candidates' information on the website via a modifi… |
CVE-2019-14940 | Medium | 6.5 | 2019-08-12 | In Storage Performance Development Kit (SPDK) before 19.07, a user of a vhost can cause a crash if the target is sent invalid input. |
CVE-2019-14939 | Medium | 5.5 | 2019-08-12 | An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default. |
CVE-2019-14935 | High | 7.8 | 2019-08-12 | 3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation directory, allowing Full Control access for… |
CVE-2019-14934 | High | 7.8 | 2019-08-11 | An issue was discovered in PDFResurrect before 0.18. pdf_load_pages_kids in pdf.c doesn't validate a certain size value, which leads to a malloc failure and ou… |
CVE-2019-14933 | High | 8.8 | 2019-08-11 | Bagisto 0.1.5 allows CSRF under /admin URIs. |
CVE-2019-14924 | High | 7.5 | 2019-08-10 | An issue was discovered in GCDWebServer before 3.5.3. The method moveItem in the GCDWebUploader class checks the FileExtension of newAbsolutePath but not oldAb… |
CVE-2019-14357 | Low | 2.4 | 2019-08-10 | On Mooltipass Mini devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the numbe… |
CVE-2019-14355 | Low | 2.4 | 2019-08-10 | On ShapeShift KeepKey devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the nu… |
CVE-2019-14354 | Low | 2.4 | 2019-08-10 | On Ledger Nano S and Nano X devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on… |
CVE-2019-14807 | Medium | 6.1 | 2019-08-09 | In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/specials/MobileSpecialPageFeed.php. |
CVE-2019-12261 | Critical | 9.8 | 2019-08-09 | Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). This is an IPNET security vulnerability: TCP Urgent Pointe… |
CVE-2019-12260 | Critical | 9.8 | 2019-08-09 | Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state con… |
CVE-2019-12258 | High | 7.5 | 2019-08-09 | Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP o… |
CVE-2019-12255 | Critical | 9.8 | 2019-08-09 | Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an i… |
CVE-2019-11581 | Critical | 9.8 | 2019-08-09 | There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker… |
CVE-2019-11274 | Medium | 6.1 | 2019-08-09 | Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM… |
CVE-2019-11042 | High | 7.1 | 2019-08-09 | When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 a… |
CVE-2019-11041 | High | 7.1 | 2019-08-09 | When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 a… |
CVE-2019-3744 | High | 7.8 | 2019-08-09 | Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a Un… |
CVE-2019-3742 | High | 7.8 | 2019-08-09 | Dell/Alienware Digital Delivery versions prior to 3.5.2013 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a… |
CVE-2019-14433 | Medium | 6.5 | 2019-08-09 | An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fa… |
CVE-2019-12265 | Medium | 5.3 | 2019-08-09 | Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IPNET security vulnerability: IGMP Informa… |
CVE-2019-12263 | High | 8.1 | 2019-08-09 | Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). There is an IPNET security vulnerability: TCP Urgent Pointer state… |
CVE-2019-12259 | High | 7.5 | 2019-08-09 | Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and vx7 has an array index error in the IGMPv3 client component. There is an IPNET security vulnerability: DoS via NULL d… |
CVE-2019-11776 | Medium | 6.1 | 2019-08-09 | In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context. |
CVE-2019-5498 | Medium | 6.5 | 2019-08-09 | OnCommand Insight versions through 7.3.6 may disclose sensitive account information to an authenticated user. |
CVE-2019-5408 | Medium | 6.5 | 2019-08-09 | Command View Advanced Edition (CVAE) products contain a vulnerability that could expose configuration information of hosts and storage systems that are managed… |
CVE-2019-5407 | Medium | 6.3 | 2019-08-09 | A remote information disclosure vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1. |
CVE-2019-5406 | High | 7.2 | 2019-08-09 | A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1. |
CVE-2019-5405 | High | 7.3 | 2019-08-09 | A remote authorization bypass vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1. |
CVE-2019-5404 | High | 8.8 | 2019-08-09 | A remote script injection vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1. |
CVE-2019-5403 | Medium | 4.8 | 2019-08-09 | A remote multiple cross-site scripting vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1. |
CVE-2019-5402 | Critical | 9.4 | 2019-08-09 | A remote authorization bypass vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1. |
CVE-2019-5400 | Medium | 6.3 | 2019-08-09 | A remote session reuse vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. |
CVE-2019-5399 | Critical | 9.4 | 2019-08-09 | A remote gain authorized access vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. |
CVE-2019-5398 | Medium | 5.4 | 2019-08-09 | A remote multiple multiple cross-site vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. |
CVE-2019-5397 | Critical | 9.4 | 2019-08-09 | A remote bypass of security restrictions vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. |
CVE-2019-12257 | High | 8.8 | 2019-08-09 | Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overflow in DHCP Offer/AC… |
CVE-2019-12256 | Critical | 9.8 | 2019-08-09 | Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: Stack overflow in the parsing of IPv4 pac… |
CVE-2019-5396 | Critical | 9.4 | 2019-08-09 | A remote authentication bypass vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. |
CVE-2019-5395 | High | 8.8 | 2019-08-09 | A remote arbitrary file upload vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. |
CVE-2019-12805 | High | 8.8 | 2019-08-09 | NCSOFT Game Launcher, NC Launcher2 2.4.1.691 and earlier versions have a vulnerability in the custom protocol handler that could allow remote attacker to execu… |
CVE-2019-14806 | High | 7.5 | 2019-08-09 | Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id. |
CVE-2019-14805 | Medium | 4.8 | 2019-08-09 | studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing. |
CVE-2019-14804 | Medium | 4.8 | 2019-08-09 | studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing. |
CVE-2019-14801 | Critical | 9.8 | 2019-08-09 | The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection. |
CVE-2019-14798 | Medium | 4.9 | 2019-08-09 | The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action… |
CVE-2019-14797 | Medium | 5.4 | 2019-08-09 | The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS. |
CVE-2019-14796 | Medium | 5.4 | 2019-08-09 | The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?acti… |
CVE-2019-14794 | High | 7.5 | 2019-08-09 | The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders. |
CVE-2019-14791 | Medium | 6.1 | 2019-08-09 | The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter. |
CVE-2019-14799 | Medium | 6.1 | 2019-08-09 | The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS. |
CVE-2019-14793 | Medium | 6.5 | 2019-08-09 | The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter. |
CVE-2019-14792 | Medium | 5.4 | 2019-08-09 | The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter. |
CVE-2019-14787 | Medium | 5.4 | 2019-08-09 | The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea paramete… |
CVE-2019-14785 | Medium | 5.4 | 2019-08-09 | The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.ph… |
CVE-2019-14312 | Medium | 6.5 | 2019-08-09 | Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This vulnerability allows a remote attacker t… |
CVE-2019-14234 | Critical | 9.8 | 2019-08-09 | An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and in… |
CVE-2019-14783 | Medium | 5.5 | 2019-08-08 | On Samsung mobile devices with N(7.x), and O(8.x), P(9.0) software, FotaAgent allows a malicious application to create privileged files. The Samsung ID is SVE-… |
CVE-2019-14774 | Medium | 6.1 | 2019-08-08 | The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatch… |
CVE-2019-14773 | High | 7.5 | 2019-08-08 | admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deleti… |
CVE-2019-14683 | Medium | 5.7 | 2019-08-08 | The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF. |
CVE-2019-14682 | Medium | 4.3 | 2019-08-08 | The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF. |
CVE-2019-14681 | High | 8.8 | 2019-08-08 | The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF. |
CVE-2019-14680 | Medium | 5.7 | 2019-08-08 | The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF. |
CVE-2019-14679 | Medium | 6.5 | 2019-08-08 | core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF. |
CVE-2019-14353 | Medium | 4.2 | 2019-08-08 | On Trezor One devices before 1.8.2, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on t… |
CVE-2019-14693 | High | 8.5 | 2019-08-08 | Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing license XML data. A remote attacker could… |
CVE-2019-12994 | Critical | 9.1 | 2019-08-08 | Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL. |
CVE-2019-12959 | High | 8.8 | 2019-08-08 | Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter. |
CVE-2019-12397 | Medium | 6.1 | 2019-08-08 | Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger w… |
CVE-2019-5301 | Low | 3.3 | 2019-08-08 | Huawei smart phones Honor V20 with the versions before 9.0.1.161(C00E161R2P2) have an information leak vulnerability. An attacker may trick a user into install… |
CVE-2019-5239 | Medium | 5.5 | 2019-08-08 | Huawei PCManager with the versions before 9.0.1.66 (Oversea) and versions before 9.0.1.70 (China) have an information leak vulnerability. Successful exploitati… |
CVE-2019-5238 | High | 7.8 | 2019-08-08 | Huawei PCManager with the versions before 9.0.1.66 (Oversea) and versions before 9.0.1.70 (China) have a code execution vulnerability. Successful exploitation… |
CVE-2019-5237 | High | 7.8 | 2019-08-08 | Huawei PCManager with the versions before 9.0.1.66 (Oversea) and versions before 9.0.1.70 (China) have a code execution vulnerability. Successful exploitation… |
CVE-2019-5236 | Medium | 6.3 | 2019-08-08 | Huawei smart phones Emily-L29C with versions of 8.1.0.132a(C432), 8.1.0.135(C782), 8.1.0.154(C10), 8.1.0.154(C461), 8.1.0.154(C635), 8.1.0.156(C185), 8.1.0.156… |
CVE-2019-11208 | Critical | 9.9 | 2019-08-08 | The authorization component of TIBCO Software Inc.'s TIBCO API Exchange Gateway, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a… |
CVE-2019-14335 | Medium | 5.5 | 2019-08-08 | An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated denial of service leading to the reboot of… |
CVE-2019-13176 | High | 7.5 | 2019-08-08 | An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2. The Content.MainForm.wgx component is affected by XX… |
CVE-2019-14772 | Medium | 6.1 | 2019-08-08 | verdaccio before 3.12.0 allows XSS. |
CVE-2019-14754 | Critical | 9.8 | 2019-08-08 | Open-School 3.0, and Community Edition 2.3, allows SQL Injection via the index.php?r=students/students/document id parameter. |
CVE-2019-14255 | Critical | 9.8 | 2019-08-08 | A Server Side Request Forgery (SSRF) vulnerability in go-camo up to version 1.1.4 allows a remote attacker to perform HTTP requests to internal endpoints. |
CVE-2019-14221 | Medium | 5.4 | 2019-08-08 | 1CRM On-Premise Software 8.5.7 allows XSS via a payload that is mishandled during a Run Report operation. |
CVE-2019-13101 | Critical | 9.8 | 2019-08-08 | An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, which can lead to discl… |
CVE-2019-1973 | Medium | 4.8 | 2019-08-08 | A vulnerability in the web portal framework of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a… |
CVE-2019-1972 | Medium | 6.7 | 2019-08-08 | A vulnerability the Cisco Enterprise NFV Infrastructure Software (NFVIS) restricted CLI could allow an authenticated, local attacker with valid administrator-l… |
CVE-2019-1971 | Critical | 9.8 | 2019-08-08 | A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to perform a command… |
CVE-2019-1970 | Medium | 5.8 | 2019-08-08 | A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) protocol inspection engine of Cisco Firepower Threat Defense (FTD) Software co… |
CVE-2019-1961 | Medium | 4.9 | 2019-08-08 | A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read arbitrary files on the underlying… |
CVE-2019-1960 | Medium | 4.4 | 2019-08-08 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the un… |
CVE-2019-1959 | Medium | 4.4 | 2019-08-08 | Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the un… |
CVE-2019-1958 | High | 8.8 | 2019-08-08 | A vulnerability in the web-based management interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to conduct a cross-site reque… |
CVE-2019-1957 | High | 7.5 | 2019-08-08 | A vulnerability in the web interface of Cisco IoT Field Network Director could allow an unauthenticated, remote attacker to trigger high CPU usage, resulting i… |
CVE-2019-1956 | Medium | 4.8 | 2019-08-08 | A vulnerability in the web-based interface of the Cisco SPA112 2-Port Phone Adapter could allow an authenticated, remote attacker to conduct a cross-site scrip… |
CVE-2019-1955 | High | 7.5 | 2019-08-08 | A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthent… |
CVE-2019-1954 | Medium | 6.1 | 2019-08-08 | A vulnerability in the web-based management interface of Cisco Webex Meetings Server Software could allow an unauthenticated, remote attacker to redirect a use… |
CVE-2019-1953 | Medium | 6.5 | 2019-08-08 | A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to view a password in c… |