2019 CVEs (page 97)
Page 97 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-1952 | Medium | 6.7 | 2019-08-08 | A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to overwrite or read arbitrary… |
CVE-2019-1951 | Medium | 5.8 | 2019-08-08 | A vulnerability in the packet filtering features of Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass L3 and L4 traffic filters… |
CVE-2019-1949 | Medium | 4.8 | 2019-08-08 | A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-sit… |
CVE-2019-1946 | Medium | 6.5 | 2019-08-08 | A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker t… |
CVE-2019-14771 | Critical | 9.8 | 2019-08-08 | Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line… |
CVE-2019-14770 | Medium | 6.1 | 2019-08-08 | In Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3, some menu links within the administration bar may be crafted to execute JavaScript when the admi… |
CVE-2019-14769 | Medium | 6.1 | 2019-08-08 | Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created by administrators. A… |
CVE-2019-1945 | Medium | 6.7 | 2019-08-07 | Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local attacker to elevate p… |
CVE-2019-1944 | High | 7.3 | 2019-08-07 | Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local attacker to elevate p… |
CVE-2019-1934 | High | 8.8 | 2019-08-07 | A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to elev… |
CVE-2019-1929 | High | 7.8 | 2019-08-07 | Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to… |
CVE-2019-1928 | High | 7.8 | 2019-08-07 | Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to… |
CVE-2019-1927 | High | 7.8 | 2019-08-07 | Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to… |
CVE-2019-1926 | High | 7.8 | 2019-08-07 | Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to… |
CVE-2019-1924 | High | 7.8 | 2019-08-07 | Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to… |
CVE-2019-1918 | High | 7.4 | 2019-08-07 | A vulnerability in the implementation of Intermediate System–to–Intermediate System (IS–IS) routing protocol functionality in Cisco IOS XR So… |
CVE-2019-14763 | Medium | 5.5 | 2019-08-07 | In the Linux kernel before 4.16.4, a double-locking error in drivers/usb/dwc3/gadget.c may potentially cause a deadlock with f_hid. |
CVE-2019-1925 | High | 7.8 | 2019-08-07 | Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to… |
CVE-2019-1910 | High | 7.4 | 2019-08-07 | A vulnerability in the implementation of the Intermediate System–to–Intermediate System (IS–IS) routing protocol functionality in Cisco IOS X… |
CVE-2019-1895 | Critical | 9.8 | 2019-08-07 | A vulnerability in the Virtual Network Computing (VNC) console implementation of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenti… |
CVE-2019-14474 | High | 7.5 | 2019-08-07 | eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic process, resulting in the ability to start a Denial… |
CVE-2019-5476 | Critical | 9.8 | 2019-08-07 | An SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (running on https://lookup.nextcloud.com) caused unauthenticated users to be able to execute arbitrary… |
CVE-2019-14750 | Medium | 6.1 | 2019-08-07 | An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization… |
CVE-2019-14749 | High | 8.8 | 2019-08-07 | An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the export spreadsheets functionality. These… |
CVE-2019-14748 | Medium | 5.4 | 2019-08-07 | An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was fo… |
CVE-2019-14537 | Critical | 9.8 | 2019-08-07 | YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass. |
CVE-2019-11653 | Medium | 5.4 | 2019-08-07 | Remote Access Control Bypass in Micro Focus Content Manager. versions 9.1, 9.2, 9.3. The vulnerability could be exploited to manipulate data stored during anot… |
CVE-2019-10099 | High | 7.5 | 2019-08-07 | Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cach… |
CVE-2019-14747 | Medium | 6.1 | 2019-08-07 | DWSurvey through 2019-07-22 has stored XSS via the design/my-survey-design!copySurvey.action surveyName parameter. |
CVE-2019-14746 | Critical | 9.8 | 2019-08-07 | A issue was discovered in KuaiFanCMS 5.0. It allows eval injection by placing PHP code in the install.php db_name parameter and then making a config.php reques… |
CVE-2019-14745 | High | 7.8 | 2019-08-07 | In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to ex… |
CVE-2019-14744 | High | 7.8 | 2019-08-07 | In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to… |
CVE-2019-14743 | Medium | 6.6 | 2019-08-07 | In Valve Steam Client for Windows through 2019-08-07, HKLM\SOFTWARE\Wow6432Node\Valve\Steam has explicit "Full control" for the Users group, which allows local… |
CVE-2019-14432 | High | 8.8 | 2019-08-07 | Incorrect authentication of application WebSocket connections in Loom Desktop for Mac up to 0.16.0 allows remote code execution from either malicious JavaScrip… |
CVE-2019-10389 | Medium | 4.3 | 2019-08-07 | A missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate an HTTP connecti… |
CVE-2019-10388 | Medium | 4.3 | 2019-08-07 | A cross-site request forgery vulnerability in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate… |
CVE-2019-10387 | Medium | 6.5 | 2019-08-07 | A missing permission check in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users with Overall/Read acces… |
CVE-2019-10386 | High | 8.8 | 2019-08-07 | A cross-site request forgery vulnerability in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users with Ov… |
CVE-2019-10385 | Medium | 6.5 | 2019-08-07 | Jenkins eggPlant Plugin 2.2 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Ext… |
CVE-2019-10382 | Medium | 6.5 | 2019-08-07 | Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM. |
CVE-2019-10381 | High | 7.5 | 2019-08-07 | Jenkins Codefresh Integration Plugin 1.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM. |
CVE-2019-10380 | High | 8.8 | 2019-08-07 | Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execut… |
CVE-2019-10379 | Medium | 6.5 | 2019-08-07 | Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where… |
CVE-2019-10378 | Medium | 5.3 | 2019-08-07 | Jenkins TestLink Plugin 3.16 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by user… |
CVE-2019-10377 | Medium | 4.3 | 2019-08-07 | A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any user of Jenkins. |
CVE-2019-10376 | Medium | 6.1 | 2019-08-07 | A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML and JavaScript into… |
CVE-2019-10375 | Medium | 6.5 | 2019-08-07 | An arbitrary file read vulnerability in Jenkins File System SCM Plugin 2.1 and earlier allows attackers able to configure jobs in Jenkins to obtain the content… |
CVE-2019-10374 | Medium | 5.4 | 2019-08-07 | A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields ren… |
CVE-2019-10373 | Medium | 5.4 | 2019-08-07 | A stored cross-site scripting vulnerability in Jenkins Build Pipeline Plugin 1.5.8 and earlier allows attackers able to edit the build pipeline description to… |
CVE-2019-10372 | Medium | 6.1 | 2019-08-07 | An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redirect users to a URL… |
CVE-2019-10371 | High | 7.5 | 2019-08-07 | A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized attackers to impersona… |
CVE-2019-10370 | Medium | 6.5 | 2019-08-07 | Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, potentially resulting… |
CVE-2019-10369 | Medium | 6.5 | 2019-08-07 | A missing permission check in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.DescriptorImpl#doTes… |
CVE-2019-10368 | High | 8.8 | 2019-08-07 | A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.Desc… |
CVE-2019-10367 | Medium | 5.5 | 2019-08-07 | Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some values expected to be… |
CVE-2019-1914 | High | 7.2 | 2019-08-07 | A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an authenticated, remote attacker to perform a co… |
CVE-2019-1913 | Critical | 9.8 | 2019-08-07 | Multiple vulnerabilities in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to o… |
CVE-2019-1912 | Critical | 9.1 | 2019-08-07 | A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an unauthenticated, remote attacker to upload arb… |
CVE-2019-14734 | High | 8.8 | 2019-08-07 | AdPlug 2.3.1 has multiple heap-based buffer overflows in CmtkLoader::load() in mtk.cpp. |
CVE-2019-14733 | High | 8.8 | 2019-08-07 | AdPlug 2.3.1 has multiple heap-based buffer overflows in CradLoader::load() in rad.cpp. |
CVE-2019-14732 | High | 8.8 | 2019-08-07 | AdPlug 2.3.1 has multiple heap-based buffer overflows in Ca2mLoader::load() in a2m.cpp. |
CVE-2019-14731 | Medium | 5.4 | 2019-08-07 | An issue was discovered in ZenTao 11.5.1. There is an XSS (stored) vulnerability that leads to the capture of other people's cookies via the Rich Text Box. |
CVE-2019-14709 | Critical | 9.8 | 2019-08-06 | A cleartext password storage issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The file in question is /usr/local/ipsca/m… |
CVE-2019-14708 | Critical | 9.8 | 2019-08-06 | An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. A buffer overflow in the action parameter leads to remote code execu… |
CVE-2019-14707 | High | 7.2 | 2019-08-06 | An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The firmware update process is insecure, leading to remote code exec… |
CVE-2019-14706 | High | 7.5 | 2019-08-06 | A denial of service issue in HTTPD was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker without authorization can uplo… |
CVE-2019-14705 | High | 7.2 | 2019-08-06 | An Incorrect Access Control issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5 because any valid cookie can be used to make… |
CVE-2019-14704 | Critical | 9.8 | 2019-08-06 | An SSRF issue was discovered in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 via FTP commands following a newline character in the u… |
CVE-2019-14703 | High | 8.8 | 2019-08-06 | A CSRF issue was discovered in webparam?user&action=set¶m=add in HTTPD on MicroDigital N-series cameras with firmware through 6400.0.8.5 to create an admin… |
CVE-2019-14702 | Critical | 9.8 | 2019-08-06 | An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. SQL injection vulnerabilities exist in 13 forms that are reachable t… |
CVE-2019-14701 | High | 7.5 | 2019-08-06 | An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker can trigger read operations on an arbitrary file via Pat… |
CVE-2019-14700 | High | 7.5 | 2019-08-06 | An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. There is disclosure of the existence of arbitrary files via Path Tra… |
CVE-2019-14699 | Critical | 9.8 | 2019-08-06 | An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker can exploit OS Command Injection in the filename paramet… |
CVE-2019-14698 | Critical | 9.8 | 2019-08-06 | An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. In a CGI program running under the HTTPD web server, a buffer overfl… |
CVE-2019-5687 | High | 7.1 | 2019-08-06 | NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which an incorre… |
CVE-2019-5686 | Medium | 5.5 | 2019-08-06 | NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the softwa… |
CVE-2019-5685 | Critical | 9.8 | 2019-08-06 | NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in DirectX drivers, in which a specially crafted shader can cause an out of bounds ac… |
CVE-2019-5684 | Critical | 10.0 | 2019-08-06 | NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in DirectX drivers, in which a specially crafted shader can cause an out of bounds ac… |
CVE-2019-5683 | High | 7.8 | 2019-08-06 | NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in the user mode video driver trace logger component. When an attacker has access to… |
CVE-2019-5682 | High | 7.8 | 2019-08-06 | NVIDIA Shield TV Experience prior to v8.0, contains a vulnerability in the NVIDIA Games App where it improperly exports an Activity but does not properly restr… |
CVE-2019-5679 | High | 7.8 | 2019-08-06 | NVIDIA Shield TV Experience prior to v8.0, NVIDIA Tegra bootloader contains a vulnerability in nvtboot where the Trusted OS image is improperly authenticated… |
CVE-2019-13106 | High | 7.8 | 2019-08-06 | Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow an… |
CVE-2019-13105 | High | 7.8 | 2019-08-06 | Das U-Boot versions 2019.07-rc1 through 2019.07-rc4 can double-free a cached block of data when listing files in a crafted ext4 filesystem. |
CVE-2019-6001 | Medium | 6.8 | 2019-08-06 | Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1… |
CVE-2019-6000 | High | 8.8 | 2019-08-06 | Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1… |
CVE-2019-5999 | High | 8.8 | 2019-08-06 | Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1… |
CVE-2019-5998 | High | 8.8 | 2019-08-06 | Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1… |
CVE-2019-5995 | Medium | 6.5 | 2019-08-06 | Missing authorization vulnerability exists in EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1.1.6 and… |
CVE-2019-5994 | High | 8.8 | 2019-08-06 | Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1… |
CVE-2019-2386 | High | 7.1 | 2019-08-06 | After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflate… |
CVE-2019-14473 | High | 8.8 | 2019-08-06 | eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks. Consequently, a valid guest level or user level account can crea… |
CVE-2019-13104 | High | 7.8 | 2019-08-06 | In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy() to overwrite a very large amount of data (including the whole stack) wh… |
CVE-2019-13143 | Critical | 9.8 | 2019-08-06 | An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID, user name, and the… |
CVE-2019-14347 | High | 8.8 | 2019-08-06 | Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users (editor or developer) to create an administrator account via admin/user/add… |
CVE-2019-12950 | Medium | 5.4 | 2019-08-06 | An issue was discovered in TeamPass 2.1.27.35. From the sources/items.queries.php "Import items" feature, it is possible to load a crafted CSV file with an XSS… |
CVE-2019-14697 | Critical | 9.8 | 2019-08-06 | musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could in… |
CVE-2019-14696 | Medium | 6.1 | 2019-08-06 | Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter. |
CVE-2019-14346 | High | 8.8 | 2019-08-06 | Internal/Views/config.php in Schben Adive 2.0.7 allows admin/config CSRF to change a user password. |
CVE-2019-14695 | Critical | 9.8 | 2019-08-06 | A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitation of this vulnerability would allow a… |
CVE-2019-14692 | High | 8.8 | 2019-08-06 | AdPlug 2.3.1 has a heap-based buffer overflow in CmkjPlayer::load() in mkj.cpp. |