Skip to content
OpenAdvisories

Archive

17 July 2019

Vulnerabilities first published on this day (UTC), newest first.

← June 2019 2019 / July /17 August 2019 →
  1. 160
  2. 268
  3. 397
  4. 448
  5. 561
  6. 619
  7. 74
  8. 833
  9. 937
  10. 1090
  11. 1184
  12. 1211
  13. 132
  14. 146
  15. 1585
  16. 1636
  17. 1768
  18. 1860
  19. 1950
  20. 20 
  21. 2113
  22. 2236
  23. 23244
  24. 2422
  25. 2569
  26. 2636
  27. 2720
  28. 2820
  29. 2987
  30. 3095
  31. 3162
All Critical High Medium Low Exploited only Public exploit

68 results · Feed

  • Unscored —
    CVE-2019-13614

    CMD_SET_CONFIG_COUNTRY in the TP-Link Device Debug protocol in TP-Link Archer C1200 1.0.0 Build 20180502 rel.45702 and …

  • Unscored —
    CVE-2019-13613

    CMD_FTEST_CONFIG in the TP-Link Device Debug protocol in TP-Link Wireless Router Archer Router version 1.0.0 Build 2018…

  • Unscored —
    CVE-2019-12175

    In Zeek Network Security Monitor (formerly known as Bro) before 2.6.2, a NULL pointer dereference in the Kerberos (aka …

    bro Ubuntu
  • Medium —
    CVE-2019-1010091

    XSS in TinyMCE

    tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media eleme…

    tinymce tinymce tinymce tinymce Ubuntu npm
  • Unscored —
    CVE-2019-13346 Public exploit

    In MyT 1.5.1, the User[username] parameter has XSS.

  • Unscored —
    CVE-2019-12475 Public exploit

    In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation.

  • Unscored —
    CVE-2019-13403 Public exploit

    Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit2.aspx, lead…

  • Unscored —
    CVE-2019-13573

    A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPre…

  • High 7.5
    CVE-2019-10353

    Cross-Site Request Forgery in Jenkins

    CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.

    Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  • Medium 4.3
    CVE-2019-10354

    Missing Authorization in Jenkins

    A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.

    Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core org.kohsuke.stapler:stapler-parent Web / CMS Maven
  • Medium 6.5
    CVE-2019-10352 EPSS 10%

    Improper Limitation of a Pathname to a Restricted Directory in Jenkins

    A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter with a file name outside the intended di…

    Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  • Unscored —
    CVE-2019-13453

    Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a…

    flightcrew zipios++ zipios++ Debian Ubuntu
  • Medium 4.3
    CVE-2019-4430

    IBM Maximo Asset Management 7.6 could allow a remote attacker to traverse directories on the system. An attacker could …

    IBM Maximo Asset Management
  • Medium 5.4
    CVE-2018-1921

    IBM Campaign 9.1.0, 9.1.2, 10.1, and 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to emb…

    IBM Campaign
  • Medium 6.1
    CVE-2018-2021

    IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J…

    IBM QRadar SIEM
  • Medium 5.3
    CVE-2018-2022

    IBM QRadar SIEM 7.2 and 7.3 discloses sensitive information to unauthorized users. The information can be used to mount…

    IBM QRadar SIEM
  • Medium 5.4
    CVE-2019-4211

    IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J…

    IBM QRadar SIEM
  • Medium 4.0
    CVE-2019-4054

    IBM QRadar SIEM 7.2 and 7.3 could allow a local user to obtain sensitive information when exporting content that could …

    IBM QRadar SIEM
  • Medium 5.3
    CVE-2019-4194

    IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 is missing function level access control that could allow a…

    IBM Jazz for Service Management
  • High 7.5
    CVE-2019-1010083

    Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory usage

    The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.

    The Pallets Project Flask flask flask Debian PyPI
  • Unscored —
    CVE-2019-1010084

    Dancer::Plugin::SimpleCRUD 1.14 and earlier is affected by: Incorrect Access Control. The impact is: Potential for unat…

    Dancer::Plugin::SimpleCRUD Dancer::Plugin::SimpleCRUD
  • High 7.8
    CVE-2019-13272 Exploited Public exploit EPSS 52%

    In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proc…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
    KEV Dec 10, 2021
  • Unscored —
    CVE-2019-9849 Public exploit

    LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote…

    Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-9848 EPSS 29%

    LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document ev…

    Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-13625

    NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a pr…

  • Unscored —
    CVE-2019-13624

    In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characte…

  • Unscored —
    CVE-2019-13623 Public exploit

    In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive…

  • Unscored —
    CVE-2019-13626

    SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a heap-based buffer over-read in Fill_IMA_ADPCM_block, caused by a…

    libsdl2 libsdl2 Debian Ubuntu