CVE Vulnerability Database
Search and browse 394,627 CVE records with CVSS scores, EPSS exploit predictions, CISA KEV status and whether the Vulnix engine has a detection for them.
17,305 records from 2019Clear filters
- CVE-2019-10774Critical 9.8Dec 30, 2019php-shellcommand versions before 1.6.1 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.
- CVE-2019-4655Medium 4.3Dec 30, 2019IBM MQ 9.1.0.0, 9.1.0.1, 9.1.0.2, 9.1.0.3, 9.1.1, 9.1.2, and 9.1.3 is vulnerable to a denial of service attack that would allow an authenticated user to reset client connections due to an error within the Data Conversion routine. IBM X-Force ID: 170966.
- CVE-2019-4623Medium 5.4Dec 30, 2019IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168924.
- CVE-2019-4343Medium 6.5Dec 30, 2019IBM Cognos Analytics 11.0 and 11.1 allows overly permissive cross-origin resource sharing which could allow an attacker to transfer private information. An attacker could exploit this vulnerability to access content that should be restricted. IBM X-Force ID: 161422.
- CVE-2019-4335Medium 5.5Dec 30, 2019IBM Watson Studio Local 1.2.3 stores key files in the user's home directory which could be obtained by another local user. IBM X-Force ID: 161413.
- CVE-2018-1682Medium 5.3Dec 30, 2019IBM Watson Studio Local 1.2.3 could disclose sensitive information over the network that an attacked could use in further attacks against the system. IBM X-Force ID: 145238.
- CVE-2019-20139Medium 5.4Dec 30, 2019In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user.
- CVE-2019-16535Critical 9.8Dec 30, 2019In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol.
- CVE-2019-15024Medium 6.5Dec 30, 2019In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse replica and register it in ZooKeeper. When another replica will fetch data part from the malicious replica, it can force clickhouse-server to write to arbitrary path on filesystem.
- CVE-2019-20138High 7.5Dec 30, 2019The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's crypto_pwhash_str is not used.
- CVE-2019-20096Medium 5.5Dec 30, 2019In the Linux kernel before 5.1, there is a memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause denial of service, aka CID-1d3ff0950e2b.
- CVE-2019-20095Medium 5.5Dec 30, 2019mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handling cases that did not free allocated hostcmd memory, aka CID-003b686ace82. This will cause a memory leak and denial of service.
- CVE-2019-20094High 8.8Dec 30, 2019An issue was discovered in libsixel 1.8.4. There is a heap-based buffer overflow in the function gif_init_frame at fromgif.c.
- CVE-2019-20093Medium 5.5Dec 30, 2019The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file, because of ImageExtractor.cpp.
- CVE-2019-20092Medium 5.5Dec 30, 2019An issue was discovered in Bento4 1.5.1.0. There is a NULL pointer dereference in AP4_Descriptor::GetTag in mp42ts when called from AP4_EsDescriptor::GetDecoderConfigDescriptor in Ap4EsDescriptor.cpp.
- CVE-2019-20091Medium 5.5Dec 30, 2019An issue was discovered in Bento4 1.5.1.0. There is a NULL pointer dereference in AP4_Descriptor::GetTag in mp42ts when called from AP4_DecoderConfigDescriptor::GetDecoderSpecificInfoDescriptor in Ap4DecoderConfigDescriptor.cpp.
- CVE-2019-20090High 7.8Dec 30, 2019An issue was discovered in Bento4 1.5.1.0. There is a use-after-free in AP4_Sample::GetOffset in Core/Ap4Sample.h when called from Ap4LinearReader.cpp.
- CVE-2019-20089High 7.8Dec 30, 2019GoPro GPMF-parser 1.2.3 has an heap-based buffer over-read in GPMF_SeekToSamples in GPMF_parse.c for the size calculation.
- CVE-2019-20088High 7.8Dec 30, 2019GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GetPayload in GPMF_mp4reader.c.
- CVE-2019-20087High 8.8Dec 30, 2019GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_seekToSamples in GPMF-parse.c for the "matching tags" feature.
- CVE-2019-20086High 8.8Dec 30, 2019GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_Next in GPMF_parser.c.
- CVE-2019-20085High 7.5KEVDec 30, 2019TVT NVMS-1000 devices allow GET /.. Directory Traversal
- CVE-2019-20079High 7.8Dec 30, 2019The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory.
- CVE-2019-20076Medium 6.1Dec 30, 2019On Netis DL4323 devices, XSS exists via the form2Ddns.cgi username parameter (DynDns settings of the Dynamic DNS Configuration).
- CVE-2019-20075Medium 6.1Dec 30, 2019On Netis DL4323 devices, pingrtt_v6.html has XSS (Ping6 Diagnostic).