2019 CVEs (page 98)
Page 98 of 161 — CVEs published in 2019, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-14691 | High | 8.8 | 2019-08-06 | AdPlug 2.3.1 has a heap-based buffer overflow in CdtmLoader::load() in dtm.cpp. |
CVE-2019-14690 | High | 8.8 | 2019-08-06 | AdPlug 2.3.1 has a heap-based buffer overflow in CxadbmfPlayer::__bmf_convert_stream() in bmf.cpp. |
CVE-2019-14672 | Medium | 5.4 | 2019-08-05 | Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is execut… |
CVE-2019-14671 | Low | 3.3 | 2019-08-05 | Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as fo… |
CVE-2019-14670 | Medium | 5.4 | 2019-08-05 | Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed du… |
CVE-2019-14669 | Medium | 5.4 | 2019-08-05 | Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed… |
CVE-2019-14668 | Medium | 5.4 | 2019-08-05 | Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code… |
CVE-2019-14667 | Medium | 6.1 | 2019-08-05 | Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and t… |
CVE-2019-14664 | Medium | 6.5 | 2019-08-05 | In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can… |
CVE-2019-14475 | High | 7.5 | 2019-08-05 | eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks. An attacker can obtain a ses… |
CVE-2019-5502 | Critical | 9.1 | 2019-08-05 | SMB in Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 has weak cryptography which when exploited could lead to information disclosure or addition or… |
CVE-2019-14665 | Medium | 5.5 | 2019-08-05 | Brandy 1.20.1 has a heap-based buffer overflow in define_array in variables.c via crafted BASIC source code. |
CVE-2019-14550 | Medium | 5.4 | 2019-08-05 | An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacke… |
CVE-2019-14549 | Medium | 5.4 | 2019-08-05 | An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A… |
CVE-2019-14548 | Medium | 5.4 | 2019-08-05 | An issue was discovered in EspoCRM before 5.6.9. Stored XSS in the body of an Article was executed when a victim opens articles received through mail. This Art… |
CVE-2019-14547 | Medium | 5.4 | 2019-08-05 | An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a attacker sends an attachment to admin with malicious JavaScript in the filename… |
CVE-2019-14546 | Medium | 5.4 | 2019-08-05 | An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed on the Preference page as well as while sending an email when a malicious payload was… |
CVE-2019-10994 | Low | 3.3 | 2019-08-05 | Processing a specially crafted project file in LAquis SCADA 4.3.1.71 may trigger an out-of-bounds read, which may allow an attacker to obtain sensitive informa… |
CVE-2019-10980 | High | 7.8 | 2019-08-05 | A type confusion vulnerability may be exploited when LAquis SCADA 4.3.1.71 processes a specially crafted project file. This may allow an attacker to execute re… |
CVE-2019-12264 | High | 7.1 | 2019-08-05 | Wind River VxWorks 6.6, 6.7, 6.8, 6.9.3, 6.9.4, and Vx7 has Incorrect Access Control in IPv4 assignment by the ipdhcpc DHCP client component. |
CVE-2019-11198 | Medium | 6.1 | 2019-08-05 | Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1)… |
CVE-2019-3800 | Medium | 6.3 | 2019-08-05 | CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-cred… |
CVE-2019-3717 | Medium | 6.8 | 2019-08-05 | Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability. An unauthenticated attacker with physical access to the system c… |
CVE-2019-11270 | High | 7.5 | 2019-08-05 | Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the r… |
CVE-2019-14348 | Critical | 9.8 | 2019-08-05 | The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?acti… |
CVE-2019-4473 | High | 7.8 | 2019-08-05 | Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and pr… |
CVE-2019-4284 | Medium | 4.4 | 2019-08-05 | IBM Cloud Private 2.1.0 , 3.1.0, 3.1.1, and 3.1.2 could allow a local privileged user to obtain sensitive OIDC token that is printed to log files, which could… |
CVE-2019-4261 | Medium | 6.5 | 2019-08-05 | IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulnerable to a denial of service attack caused by specially cra… |
CVE-2019-14663 | Medium | 5.5 | 2019-08-05 | Brandy 1.20.1 has a stack-based buffer overflow in fileio_openin in fileio.c via crafted BASIC source code. |
CVE-2019-14662 | Medium | 5.5 | 2019-08-05 | Brandy 1.20.1 has a stack-based buffer overflow in fileio_openout in fileio.c via crafted BASIC source code. |
CVE-2019-14525 | Medium | 4.9 | 2019-08-05 | In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to view sensitive valu… |
CVE-2019-14521 | High | 7.5 | 2019-08-05 | The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location on the server via pa… |
CVE-2019-14654 | High | 8.8 | 2019-08-05 | In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated… |
CVE-2019-14653 | Medium | 6.1 | 2019-08-03 | pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element. |
CVE-2019-14551 | Critical | 9.8 | 2019-08-03 | Das Q before 2019-08-02 allows web sites to execute arbitrary code on client machines, as demonstrated by a cross-origin /install request with an attacker-cont… |
CVE-2019-7951 | High | 7.5 | 2019-08-02 | An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A SOAP web service endpoint… |
CVE-2019-7950 | High | 7.5 | 2019-08-02 | An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An unauthenticated user c… |
CVE-2019-7947 | Medium | 6.5 | 2019-08-02 | A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and Magento Commerce prior t… |
CVE-2019-7945 | Medium | 5.4 | 2019-08-02 | A stored cross-cite scripting vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18… |
CVE-2019-7944 | Medium | 5.4 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4… |
CVE-2019-7942 | High | 7.2 | 2019-08-02 | A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with… |
CVE-2019-7940 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento… |
CVE-2019-7939 | Medium | 6.1 | 2019-08-02 | A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2… |
CVE-2019-7938 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento… |
CVE-2019-7937 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. T… |
CVE-2019-7936 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. T… |
CVE-2019-7935 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento… |
CVE-2019-7934 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento… |
CVE-2019-7932 | High | 7.2 | 2019-08-02 | A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Mage… |
CVE-2019-7930 | High | 7.2 | 2019-08-02 | A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admi… |
CVE-2019-7929 | Medium | 4.9 | 2019-08-02 | An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with… |
CVE-2019-7928 | High | 7.5 | 2019-08-02 | A denial-of-service (DoS) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. By abusing insufficient… |
CVE-2019-7927 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. T… |
CVE-2019-7926 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. T… |
CVE-2019-7925 | Medium | 4.9 | 2019-08-02 | An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This ca… |
CVE-2019-7923 | High | 7.2 | 2019-08-02 | A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be e… |
CVE-2019-7921 | Medium | 5.4 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the product catalog form of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to… |
CVE-2019-7915 | High | 7.5 | 2019-08-02 | A denial-of-service vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Under certain conditions, an u… |
CVE-2019-7913 | High | 7.2 | 2019-08-02 | A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be e… |
CVE-2019-7912 | High | 7.2 | 2019-08-02 | A file upload filter bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenti… |
CVE-2019-7911 | High | 7.2 | 2019-08-02 | A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to… |
CVE-2019-7909 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento… |
CVE-2019-7908 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. T… |
CVE-2019-7904 | Medium | 6.5 | 2019-08-02 | Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could enable a low-priv… |
CVE-2019-7903 | High | 7.2 | 2019-08-02 | A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with… |
CVE-2019-7899 | Medium | 5.3 | 2019-08-02 | Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Comm… |
CVE-2019-7898 | Medium | 5.3 | 2019-08-02 | Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to… |
CVE-2019-7897 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento… |
CVE-2019-7896 | High | 7.2 | 2019-08-02 | A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with… |
CVE-2019-7895 | High | 7.2 | 2019-08-02 | A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with… |
CVE-2019-7892 | High | 7.2 | 2019-08-02 | A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with… |
CVE-2019-7890 | High | 7.3 | 2019-08-02 | An Insecure Direct Object Reference (IDOR) vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Ma… |
CVE-2019-7889 | Medium | 6.5 | 2019-08-02 | An injection vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 pri… |
CVE-2019-7888 | Medium | 6.5 | 2019-08-02 | An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user wi… |
CVE-2019-7887 | Medium | 4.8 | 2019-08-02 | A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magen… |
CVE-2019-7886 | High | 7.5 | 2019-08-02 | A cryptograhic flaw exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A weak cryptograhic mechanism is used to gen… |
CVE-2019-7885 | High | 8.8 | 2019-08-02 | Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2… |
CVE-2019-7882 | Medium | 5.4 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magen… |
CVE-2019-7881 | Medium | 5.4 | 2019-08-02 | A cross-site scripting mitigation bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited… |
CVE-2019-7880 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. T… |
CVE-2019-7877 | Medium | 6.1 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A… |
CVE-2019-7876 | High | 8.8 | 2019-08-02 | A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with… |
CVE-2019-7875 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento… |
CVE-2019-7874 | Medium | 6.5 | 2019-08-02 | A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in un… |
CVE-2019-7873 | Medium | 4.3 | 2019-08-02 | A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in un… |
CVE-2019-7872 | Medium | 6.5 | 2019-08-02 | An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to i… |
CVE-2019-7871 | High | 8.8 | 2019-08-02 | A security bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 that could be abused to execute arbitrary PHP c… |
CVE-2019-7869 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. T… |
CVE-2019-7868 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. T… |
CVE-2019-7867 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. T… |
CVE-2019-7866 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. T… |
CVE-2019-7865 | High | 8.8 | 2019-08-02 | A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prio… |
CVE-2019-7864 | Medium | 5.3 | 2019-08-02 | An insecure direct object reference (IDOR) vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior… |
CVE-2019-7863 | Medium | 4.8 | 2019-08-02 | A stored cross-site scripting vulnerability exists in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2… |
CVE-2019-7862 | Medium | 4.8 | 2019-08-02 | A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2… |
CVE-2019-7861 | High | 7.5 | 2019-08-02 | Insufficient server-side validation of user input could allow an attacker to bypass file upload restrictions in Magento 2.1 prior to 2.1.18, Magento 2.2 prior… |
CVE-2019-7860 | High | 7.5 | 2019-08-02 | A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2… |
CVE-2019-7859 | High | 7.5 | 2019-08-02 | A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in un… |
CVE-2019-7858 | High | 7.5 | 2019-08-02 | A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2 resulted in storage of sensitive information wit… |
CVE-2019-7857 | Medium | 4.3 | 2019-08-02 | A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can cause unwanted items to b… |