Original release date: May 27, 2019
The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.
The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:
-
High – Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 – 10.0
-
Medium – Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 – 6.9
-
Low – Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 – 3.9
Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.
The NCCIC Weekly Vulnerability Summary Bulletin is created using information from the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD). In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.
High Vulnerabilities
| Primary Vendor — Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | 10.0 | CVE-2019-7027 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-23 | 10.0 | CVE-2019-7088 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-23 | 9.3 | CVE-2019-7111 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-23 | 10.0 | CVE-2019-7112 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-23 | 10.0 | CVE-2019-7113 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-23 | 10.0 | CVE-2019-7117 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-23 | 10.0 | CVE-2019-7118 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-23 | 10.0 | CVE-2019-7119 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-23 | 10.0 | CVE-2019-7120 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-23 | 10.0 | CVE-2019-7124 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-23 | 9.3 | CVE-2019-7125 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-23 | 10.0 | CVE-2019-7128 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7759 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7760 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7761 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7762 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7763 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier version, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7764 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7765 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7766 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7767 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7768 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7772 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7779 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7781 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7782 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7783 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a double free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7784 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7786 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7788 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7791 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7792 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7796 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier version, 2017.011.30138 and earlier version, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7797 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7800 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier version, 2017.011.30138 and earlier version, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-22 | 10.0 | CVE-2019-7804 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7805 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7806 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7807 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7808 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 7.1 | CVE-2019-7809 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7814 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7817 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7818 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7820 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 7.1 | CVE-2019-7821 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7822 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier version, 2017.011.30138 and earlier version, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 7.1 | CVE-2019-7823 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a buffer error vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7824 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7825 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7827 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7828 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7829 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7830 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7831 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7832 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7833 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7834 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier version, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 10.0 | CVE-2019-7835 BID CONFIRM |
| adobe — bridge_cc | Adobe Bridge CC versions 9.0.2 have a heap overflow vulnerability. Successful exploitation could lead to remote code execution. | 2019-05-23 | 10.0 | CVE-2019-7130 CONFIRM |
| adobe — bridge_cc | Adobe Bridge CC versions 9.0.2 have an out-of-bounds write vulnerability. Successful exploitation could lead to remote code execution. | 2019-05-23 | 9.3 | CVE-2019-7132 CONFIRM MISC |
| adobe — flash_player | Adobe Flash Player versions 32.0.0.171 and earlier, 32.0.0.171 and earlier, and 32.0.0.171 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 9.3 | CVE-2019-7837 BID REDHAT CONFIRM MISC |
| adobe — indesign | Adobe InDesign versions 14.0.1 and below have an unsafe hyperlink processing vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-23 | 10.0 | CVE-2019-7107 CONFIRM |
| adobe — shockwave_player | Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-23 | 10.0 | CVE-2019-7104 CONFIRM |
| adobe — xd | Adobe XD versions 16.0 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-23 | 10.0 | CVE-2019-7105 CONFIRM |
| adobe — xd | Adobe XD versions 16.0 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-23 | 10.0 | CVE-2019-7106 CONFIRM |
| atutor — atutor | ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PHP files to be written to the web root, and for code to execute on the remote server. | 2019-05-17 | 9.0 | CVE-2019-12170 MISC MISC |
| blogifier — blogifier | Blogifier 2.3 before 2019-05-11 does not properly restrict APIs, as demonstrated by missing checks for .. in a pathname. | 2019-05-22 | 7.5 | CVE-2019-12277 MISC |
| bmc — patrol_agent | By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials sent over the network to managed PATROL Agent services. If an attacker were able to capture this network traffic, they could decrypt these credentials and use them to execute code or escalate privileges on the network. | 2019-05-20 | 7.5 | CVE-2019-8352 MISC |
| carts.guru — carts_guru | The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php. | 2019-05-20 | 7.5 | CVE-2019-12241 MISC |
| citrix — receiver | Citrix Workspace App before 1904 for Windows has Incorrect Access Control. | 2019-05-22 | 7.5 | CVE-2019-11634 CONFIRM MISC |
| computrols — computrols_building_automation_software | Computrols CBAS 18.0.0 has Default Credentials. | 2019-05-23 | 10.0 | CVE-2019-10850 MISC MISC |
| computrols — computrols_building_automation_software | Computrols CBAS 18.0.0 allows Authenticated Command Injection. | 2019-05-23 | 9.0 | CVE-2019-10854 MISC MISC |
| elabftw — elabftw | eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote command execution. An attacker can use a user account to fully compromise the system using a POST request. This will allow for PHP files to be written to the web root, and for code to execute on the remote server. | 2019-05-19 | 9.0 | CVE-2019-12185 MISC MISC |
| exponentcms — exponent_cms | Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/help/controllers/helpController.php. | 2019-05-23 | 7.5 | CVE-2016-8897 MISC MISC |
| exponentcms — exponent_cms | Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expCatController.php related to change_cats. | 2019-05-23 | 7.5 | CVE-2016-8899 MISC MISC |
| falco — falco | An issue was discovered in Falco through 0.14.0. A missing indicator for insufficient resources allows local users to bypass the detection engine. | 2019-05-17 | 7.2 | CVE-2019-8339 CONFIRM CONFIRM CONFIRM MISC |
| four-faith — f3x24_firmware | Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administration > Commands) screen. | 2019-05-17 | 9.0 | CVE-2019-12168 MISC |
| fujitsu — paperstream_ip_(twain) | In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messages received over the FjtwMkic_Fjicube_32 named pipe. One of these message processing functions attempts to dynamically load the UninOldIS.dll library and executes an exported function named ChangeUninstallString. The default install does not contain this library and therefore if any DLL with that name exists in any directory listed in the PATH variable, it can be used to escalate to SYSTEM level privilege. | 2019-05-17 | 7.2 | CVE-2018-16156 MISC |
| gnu — wget | Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors. | 2019-05-17 | 7.5 | CVE-2019-5953 MISC MISC |
| gohttp_project — gohttp | GoHTTP through 2017-07-25 has a GetExtension heap-based buffer overflow via a long extension. | 2019-05-17 | 7.5 | CVE-2019-12158 MISC |
| gohttp_project — gohttp | GoHTTP through 2017-07-25 has a sendHeader use-after-free. | 2019-05-17 | 7.5 | CVE-2019-12160 MISC |
| ibm — websphere_application_server | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445. | 2019-05-17 | 10.0 | CVE-2019-4279 BID XF CONFIRM |
| ibm — websphere_mq | IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privileged user to execute code as an administrator due to incorrect permissions set on MQ installation directories. IBM X-Force ID: 157190. | 2019-05-23 | 7.2 | CVE-2019-4078 XF CONFIRM |
| intel — converged_security_management_engine_firmware | Logic bug vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) TXE before 3.1.65, 4.0.15 may allow an unauthenticated user to potentially enable escalation of privilege via physical access. | 2019-05-17 | 7.2 | CVE-2019-0098 MISC |
| intel — converged_security_management_engine_firmware | Buffer overflow in subsystem in Intel(R) CSME before version 12.0.35 may allow an unauthenticated user to potentially enable escalation of privilege via network access. | 2019-05-17 | 7.5 | CVE-2019-0153 MISC |
| intel — hns2400lp_firmware | Buffer overflow vulnerability in system firmware for Intel(R) Xeon(R) Processor D Family, Intel(R) Xeon(R) Scalable Processor, Intel(R) Server Board, Intel(R) Server System and Intel(R) Compute Module may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access. | 2019-05-17 | 7.2 | CVE-2019-0119 MISC |
| intel — unite | A logic issue in Intel Unite(R) Client for Android prior to version 4.0 may allow a remote attacker to potentially enable escalation of privilege via network access. | 2019-05-17 | 7.5 | CVE-2019-0172 MISC |
| intel — xeon_bronze_processors_firmware | Insufficient access control in silicon reference firmware for Intel(R) Xeon(R) Scalable Processor, Intel(R) Xeon(R) Processor D Family may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access. | 2019-05-17 | 7.2 | CVE-2019-0126 MISC |
| kalkitech — sync3000_firmware | Kalki Kalkitech SYNC3000 Substation DCU GPC v2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, and 3.6.1, when WebHMI is not installed, allows an attacker to inject client-side commands or scripts to be executed on the device with privileged access, aka CYB/2019/19561. The attack requires network connectivity to the device and exploits the webserver interface, typically through a browser. | 2019-05-22 | 10.0 | CVE-2019-11536 MISC MISC |
| lemonldap-ng — lemonldap:: | LemonLDAP::NG -2.0.3 has Incorrect Access Control. | 2019-05-22 | 7.5 | CVE-2019-12046 MISC MISC MISC MISC MISC CONFIRM CONFIRM MISC |
| motorola — cx2_firmware | An issue was discovered in scopd on Motorola routers CX2 1.01 and M2 1.01. There is a Use of an Externally Controlled Format String, reachable via TCP port 8010 or UDP port 8080. | 2019-05-23 | 7.5 | CVE-2019-12297 MISC |
| nagios — nagios_xi | Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). | 2019-05-22 | 7.5 | CVE-2019-12279 MISC BID MISC |
| nginx — njs | njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in nxt_utf8_encode in nxt_utf8.c. | 2019-05-20 | 7.5 | CVE-2019-12206 MISC |
| nginx — njs | njs through 0.3.1, used in NGINX, has a heap-based buffer over-read in nxt_utf8_decode in nxt/nxt_utf8.c. | 2019-05-20 | 7.5 | CVE-2019-12207 MISC |
| nginx — njs | njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in njs_function_native_call in njs/njs_function.c. | 2019-05-20 | 7.5 | CVE-2019-12208 MISC |
| open-emr — openemr | An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface/forms/eye_mag/php/taskman_functions.php via /interface/forms/eye_mag/taskman.php. | 2019-05-17 | 7.5 | CVE-2018-17179 MISC MISC |
| open-emr — openemr | An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php. | 2019-05-17 | 7.5 | CVE-2018-17181 MISC MISC |
| open-xchange — open-xchange_appsuite | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Insecure Permissions. | 2019-05-23 | 7.5 | CVE-2017-17060 MISC CONFIRM |
| open-xchange — open-xchange_appsuite | Open-Xchange GmbH OX App Suite 7.8.3 is affected by: Incorrect Access Control. | 2019-05-23 | 7.5 | CVE-2017-5212 MISC MISC CONFIRM |
| open-xchange — open-xchange_appsuite | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. | 2019-05-22 | 7.5 | CVE-2017-5863 MISC MISC CONFIRM |
| openwrt — luci | In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command injection vulnerability. | 2019-05-23 | 7.5 | CVE-2019-12272 MISC MISC |
| percona — percona_server | The Percona Server 5.6.44-85.0-1 packages for Debian and Ubuntu suffered an issue where the server would reset the root password to a blank value upon an upgrade. This was fixed in 5.6.44-85.0-2. | 2019-05-23 | 10.0 | CVE-2019-12301 MISC MISC |
| schneider-electric — modicon_m340_firmware | A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause an elevation of privilege by conducting a brute force attack on Modbus parameters sent to the controller. | 2019-05-22 | 7.5 | CVE-2018-7842 MISC |
| schneider-electric — modicon_m340_firmware | A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service or potential code execution by overwriting configuration settings of the controller over Modbus. | 2019-05-22 | 7.5 | CVE-2018-7847 MISC |
| schneider-electric — modicon_premium_firmware | A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a remote code execution by overwriting configuration settings of the controller over Modbus. | 2019-05-22 | 7.5 | CVE-2019-6808 MISC |
| schneider-electric — u.motion_builder | A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered. | 2019-05-22 | 7.5 | CVE-2018-7841 MISC FULLDISC CONFIRM |
| sensiolabs — symfony | Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator. | 2019-05-23 | 7.5 | CVE-2017-11365 MISC MISC |
| simplybook — simplybook | SimplyBook.me through 2019-05-11 does not properly restrict File Upload which could allow remote code execution. | 2019-05-17 | 7.5 | CVE-2019-11887 CONFIRM |
| virim_project — virim | The Virim plugin 0.4 for WordPress allows Insecure Deserialization via s_values, t_values, or c_values in graph.php. | 2019-05-20 | 7.5 | CVE-2019-12240 MISC |
| wolfssl — wolfssl | wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tls13.c when a current identity size is greater than a client identity size. An attacker sends a crafted hello client packet over the network to a TLSv1.3 wolfSSL server. The length fields of the packet: record length, client hello length, total extensions length, PSK extension length, total identity length, and identity length contain their maximum value which is 2^16. The identity data field of the PSK extension of the packet contains the attack data, to be stored in the undefined memory (RAM) of the server. The size of the data is about 65 kB. Possibly the attacker can perform a remote code execution attack. | 2019-05-23 | 7.5 | CVE-2019-11873 MISC MISC |
Medium Vulnerabilities
| Primary Vendor — Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-23 | 5.0 | CVE-2019-7061 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-23 | 4.3 | CVE-2019-7109 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-23 | 4.3 | CVE-2019-7110 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-23 | 5.0 | CVE-2019-7114 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-23 | 5.0 | CVE-2019-7115 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-23 | 5.0 | CVE-2019-7116 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-23 | 5.0 | CVE-2019-7121 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-23 | 5.0 | CVE-2019-7122 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-23 | 5.0 | CVE-2019-7123 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-23 | 4.3 | CVE-2019-7127 CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-22 | 4.3 | CVE-2019-7140 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-22 | 4.3 | CVE-2019-7141 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-22 | 5.0 | CVE-2019-7142 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-22 | 6.8 | CVE-2019-7143 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-22 | 4.3 | CVE-2019-7144 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 4.3 | CVE-2019-7145 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier version, 2017.011.30138 and earlier version, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-22 | 4.3 | CVE-2019-7758 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-22 | 5.0 | CVE-2019-7769 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 5.0 | CVE-2019-7770 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 5.0 | CVE-2019-7771 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 5.0 | CVE-2019-7773 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 5.0 | CVE-2019-7774 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 5.0 | CVE-2019-7775 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 5.0 | CVE-2019-7776 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 5.0 | CVE-2019-7777 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 5.0 | CVE-2019-7778 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier version, 2017.011.30138 and earlier version, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-22 | 5.0 | CVE-2019-7780 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-22 | 4.3 | CVE-2019-7785 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier version, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 4.3 | CVE-2019-7787 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 5.0 | CVE-2019-7789 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 5.0 | CVE-2019-7790 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 5.0 | CVE-2019-7793 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 4.3 | CVE-2019-7794 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 5.0 | CVE-2019-7795 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 6.8 | CVE-2019-7798 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier version, 2017.011.30138 and earlier version, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 4.3 | CVE-2019-7799 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 4.3 | CVE-2019-7801 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 4.3 | CVE-2019-7802 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 4.3 | CVE-2019-7803 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-22 | 4.3 | CVE-2019-7810 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 5.0 | CVE-2019-7811 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 5.0 | CVE-2019-7812 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 5.0 | CVE-2019-7813 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 6.8 | CVE-2019-7826 BID CONFIRM MISC |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 5.0 | CVE-2019-7836 BID CONFIRM |
| adobe — acrobat | Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 5.0 | CVE-2019-7841 BID CONFIRM |
| adobe — bridge_cc | Adobe Bridge CC versions 9.0.2 have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-23 | 4.3 | CVE-2019-7133 CONFIRM |
| adobe — bridge_cc | Adobe Bridge CC versions 9.0.2 have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-23 | 4.3 | CVE-2019-7134 CONFIRM MISC |
| adobe — bridge_cc | Adobe Bridge CC versions 9.0.2 have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-23 | 4.3 | CVE-2019-7135 CONFIRM MISC |
| adobe — bridge_cc | Adobe Bridge CC versions 9.0.2 have an use after free vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-23 | 4.3 | CVE-2019-7136 CONFIRM MISC |
| adobe — bridge_cc | Adobe Bridge CC versions 9.0.2 have a memory corruption vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-23 | 4.3 | CVE-2019-7137 CONFIRM MISC |
| adobe — bridge_cc | Adobe Bridge CC versions 9.0.2 have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-23 | 4.3 | CVE-2019-7138 CONFIRM MISC |
| adobe — dreamweaver | Adobe Dreamweaver versions 19.0 and earlier have an insecure protocol implementation vulnerability. Successful exploitation could lead to sensitive data disclosure if smb request is subject to a relay attack. | 2019-05-23 | 5.0 | CVE-2019-7097 CONFIRM |
| adobe — media_encoder | Adobe Media Encoder version 13.0.2 has a use-after-free vulnerability. Successful exploitation could lead to remote code execution. | 2019-05-22 | 6.8 | CVE-2019-7842 BID CONFIRM MISC |
| adobe — media_encoder | Adobe Media Encoder version 13.0.2 has an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-22 | 4.3 | CVE-2019-7844 BID CONFIRM MISC |
| apache — jspwiki | A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. | 2019-05-20 | 4.3 | CVE-2019-10076 MLIST BID CONFIRM MLIST |
| apache — jspwiki | A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. | 2019-05-20 | 4.3 | CVE-2019-10077 MLIST BID CONFIRM MLIST |
| apache — jspwiki | A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable. | 2019-05-20 | 4.3 | CVE-2019-10078 MLIST BID CONFIRM MLIST MLIST MLIST |
| apache — zookeeper | An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper?s getACL() command doesn?t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users. | 2019-05-23 | 4.3 | CVE-2019-0201 BID MISC MLIST CONFIRM |
| artifex — ghostscript | Artifex Ghostscript 9.22 is affected by: Obtain Information. The impact is: obtain sensitive information. The component is: affected source code file, affected function, affected executable, affected libga (imagemagick used that). The attack vector is: Someone must open a postscript file though ghostscript. Because of imagemagick also use libga, so it was affected as well. | 2019-05-23 | 4.3 | CVE-2017-15652 CONFIRM BID MISC |
| atlassian — jira | The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check. | 2019-05-22 | 5.0 | CVE-2019-3401 MISC |
| atlassian — jira | The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter. | 2019-05-22 | 4.3 | CVE-2019-3402 MISC |
| atlassian — jira | The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check. | 2019-05-22 | 5.0 | CVE-2019-3403 MISC |
| atlassian — jira | The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access check. | 2019-05-22 | 5.0 | CVE-2019-8442 BID MISC |
| atlassian — jira | The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have obtained access to administrator’s session to access the ViewUpgrades administrative resource without needing to re-authenticate to pass “WebSudo” through an improper access control vulnerability. | 2019-05-22 | 6.8 | CVE-2019-8443 BID MISC |
| buildbot — buildbot | Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a token allowing them to read the user details of a victim, they can login as the victim. | 2019-05-23 | 5.0 | CVE-2019-12300 MISC |
| citrix — netscaler_application_delivery_controller_firmware | A Buffer Overflow exists in Citrix NetScaler Gateway 10.5.x before 10.5.70.x, 11.1.x before 11.1.59.10, 12.0.x before 12.0.59.8, and 12.1.x before 12.1.49.23 and Citrix Application Delivery Controller 10.5.x before 10.5.70.x, 11.1.x before 11.1.59.10, 12.0.x before 12.0.59.8, and 12.1.x before 12.1.49.23. | 2019-05-22 | 5.0 | CVE-2019-12044 CONFIRM MISC |
| commsy — commsy | CommSy through 8.6.5 has SQL Injection via the cid parameter. This is fixed in 9.2. | 2019-05-22 | 5.0 | CVE-2019-11880 MISC MISC |
| computrols — computrols_building_automation_software | Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and password reset page via the username GET parameter. | 2019-05-23 | 4.3 | CVE-2019-10846 MISC MISC |
| computrols — computrols_building_automation_software | Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure. | 2019-05-23 | 5.0 | CVE-2019-10849 MISC MISC |
| computrols — computrols_building_automation_software | Computrols CBAS 18.0.0 has hard-coded encryption keys. | 2019-05-23 | 4.0 | CVE-2019-10851 MISC MISC |
| computrols — computrols_building_automation_software | Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=start_pulling&id= substring. | 2019-05-23 | 6.5 | CVE-2019-10852 MISC MISC |
| computrols — computrols_building_automation_software | Computrols CBAS 18.0.0 mishandles password hashes. The approach is MD5 with a pw prefix, e.g., if the password is admin, it will calculate the MD5 hash of pwadmin and store it in a MySQL database. | 2019-05-23 | 5.0 | CVE-2019-10855 MISC MISC |
| create-sd — create_sd | CREATE SD official App for Android version 1.0.2 and earlier allows remote attackers to bypass access restriction to lead a user to access an arbitrary website via vulnerable application and conduct phishing attacks. | 2019-05-17 | 5.8 | CVE-2019-5955 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.0.0 to 4.6.3 allows remote attackers to bypass access restriction to browse unauthorized pages via the application ‘Management of Basic System’. | 2019-05-17 | 4.0 | CVE-2019-5930 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.0.0 to 4.6.3 allows authenticated attackers to alter the information with privileges invoking the installer via unspecified vectors. | 2019-05-17 | 5.5 | CVE-2019-5931 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.0.0 to 4.10.0 allows remote authenticated attackers to bypass access restriction to view the Bulletin Board without view privileges via the application ‘Bulletin’. | 2019-05-17 | 4.0 | CVE-2019-5933 MISC MISC |
| cybozu — garoon | SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.0 allows attacker with administrator rights to execute arbitrary SQL commands via the Log Search function of application ‘logging’. | 2019-05-17 | 6.5 | CVE-2019-5934 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to change user information without access privileges via the Item function of User Information. | 2019-05-17 | 4.0 | CVE-2019-5935 MISC MISC |
| cybozu — garoon | Directory traversal vulnerability in Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to obtain files without access privileges via the application ‘Work Flow’. | 2019-05-17 | 5.5 | CVE-2019-5936 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the Report without access privileges via the application ‘Multi Report’. | 2019-05-17 | 4.0 | CVE-2019-5941 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to obtain files without access privileges via the Multiple Files Download function of application ‘Cabinet’. | 2019-05-17 | 4.0 | CVE-2019-5942 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to view the information without view privileges via the application ‘Bulletin’ and the application ‘Cabinet’. | 2019-05-17 | 4.0 | CVE-2019-5943 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the contents of application ‘Address’ without modify privileges via the application ‘Address’. | 2019-05-17 | 4.0 | CVE-2019-5944 MISC MISC |
| cybozu — garoon | Cybozu Garoon 4.2.4 to 4.10.1 allow remote attackers to obtain the users’ credential information via the authentication of Cybozu Garoon. | 2019-05-17 | 5.0 | CVE-2019-5945 MISC MISC |
| cybozu — garoon | Open redirect vulnerability in Cybozu Garoon 4.2.4 to 4.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the Login Screen. | 2019-05-17 | 5.8 | CVE-2019-5946 MISC MISC |
| digium — asterisk | asterisk 13.10.0 is affected by: denial of service issues in asterisk. The impact is: cause a denial of service (remote). | 2019-05-23 | 5.0 | CVE-2016-7550 MISC |
| dotcms — dotcms | dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files. The vulnerability is caused by the insecure extraction of a ZIP archive. | 2019-05-23 | 4.0 | CVE-2019-12309 MISC MISC |
| eaton — halo_home | The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the user logs out of the application and reboots the device. This vulnerability can allow an attacker to impersonate the legitimate user by reusing the stored OAuth token, thus allowing them to view and change the user’s personal information stored in the backend cloud service. The attacker would first need to gain physical control of the Android device or compromise it with a malicious app. | 2019-05-22 | 4.3 | CVE-2019-5625 MISC MISC |
| emerson — liebert_challenger_firmware | httpGetSet/httpGet.htm on Emerson Network Power Liebert Challenger 5.1E0.5 devices allows XSS via the statusstr parameter. | 2019-05-22 | 4.3 | CVE-2019-12167 BID MISC MISC |
| enigmail — enigmail | Enigmail before 2.0.11 allows PGP signature spoofing: for an inline PGP message, an attacker can cause the product to display a “correctly signed” message indication, but display different unauthenticated text. | 2019-05-21 | 5.0 | CVE-2019-12269 MISC MISC |
| f-secure — psb_workstation_security | In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, F-Secure Client Security Standard and Premium before 14.10, F-Secure PSB Workstation Security before 12.01, and F-Secure Computer Protection Standard and Premium before 19.3, a local user can escalate their privileges through a DLL hijacking attack against the installer. The installer writes the file rm.exe to C:\Windows\Temp and then executes it. The rm.exe process then attempts to load several DLLs from its current directory. Non-admin users are able to write to this folder, so an attacker can create a malicious C:\Windows\Temp\OLEACC.dll file. When an admin runs the installer, rm.exe will execute the attacker’s DLL in an elevated security context. | 2019-05-17 | 6.8 | CVE-2019-11644 CONFIRM |
| fasterxml — jackson-databind | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation. | 2019-05-17 | 5.0 | CVE-2019-12086 MISC MISC CONFIRM MLIST MLIST MISC DEBIAN |
| freedesktop — poppler | In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths. | 2019-05-23 | 6.8 | CVE-2019-12293 BID MISC |
| freedesktop — systemd | systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled. | 2019-05-17 | 5.0 | CVE-2018-20839 BID MISC MISC MISC |
| freeimage_project — freeimage | When FreeImage 3.18.0 reads a tiff file, it will be handed to the Load function of the PluginTIFF.cpp file, but a memcpy occurs in which the destination address and the size of the copied data are not considered, resulting in a heap overflow. | 2019-05-20 | 5.0 | CVE-2019-12211 MISC |
| freeimage_project — freeimage | When FreeImage 3.18.0 reads a special JXR file, the StreamCalcIFDSize function of JXRMeta.c repeatedly calls itself due to improper processing of the file, eventually causing stack exhaustion. An attacker can achieve a remote denial of service attack by sending a specially constructed file. | 2019-05-20 | 5.0 | CVE-2019-12212 MISC |
| freeimage_project — freeimage | When FreeImage 3.18.0 reads a special TIFF file, the TIFFReadDirectory function in PluginTIFF.cpp always returns 1, leading to stack exhaustion. | 2019-05-20 | 4.3 | CVE-2019-12213 MISC |
| freeimage_project — freeimage | In FreeImage 3.18.0, an out-of-bounds access occurs because of mishandling of the OpenJPEG j2k_read_ppm_v3 function in j2k.c. The value of l_N_ppm comes from the file read in, and the code does not consider that l_N_ppm may be greater than the size of p_header_data. | 2019-05-20 | 5.0 | CVE-2019-12214 MISC |
| gatship — web_module | GAT-Ship Web Module through 1.30 allows remote attackers to obtain potentially sensitive information via {} in a ws/gatshipWs.asmx/SqlVersion request. | 2019-05-17 | 5.0 | CVE-2019-12163 MISC FULLDISC MISC |
| get-simple — getsimple_cms | An issue was discovered in GetSimple CMS through 3.3.15. insufficient input sanitation in the theme-edit.php file allows upload of files with arbitrary content (PHP code, for example). This vulnerability is triggered by an authenticated user; however, authentication can be bypassed. According to the official documentation for installation step 10, an admin is required to upload all the files, including the .htaccess files, and run a health check. However, what is overlooked is that the Apache HTTP Server by default no longer enables the AllowOverride directive, leading to data/users/admin.xml password exposure. The passwords are hashed but this can be bypassed by starting with the data/other/authorization.xml API key. This allows one to target the session state, since they decided to roll their own implementation. The cookie_name is crafted information that can be leaked from the frontend (site name and version). If a someone leaks the API key and the admin username, then they can bypass authentication. To do so, they need to supply a cookie based on an SHA-1 computation of this known information. The vulnerability exists in the admin/theme-edit.php file. This file checks for forms submissions via POST requests, and for the csrf nonce. If the nonce sent is correct, then the file provided by the user is uploaded. There is a path traversal allowing write access outside the jailed themes directory root. Exploiting the traversal is not necessary because the .htaccess file is ignored. A contributing factor is that there isn’t another check on the extension before saving the file, with the assumption that the parameter content is safe. This allows the creation of web accessible and executable files with arbitrary content. | 2019-05-22 | 5.0 | CVE-2019-11231 MISC MISC |
| gitlab — gitlab | GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol. | 2019-05-17 | 5.0 | CVE-2018-19585 MISC MISC |
| gitlab — gitlab | An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. The runner registration token in the CI/CD settings could not be reset. This was a security risk if one of the maintainers leaves the group and they know the token. | 2019-05-17 | 5.0 | CVE-2018-20500 MISC MISC |
| gitlab — gitlab | An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. The issue comments feature could allow a user to comment on an issue which they shouldn’t be allowed to. | 2019-05-17 | 6.4 | CVE-2019-5883 MISC |
| gitlab — gitlab | An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It was possible to use the profile name to inject a potentially malicious link into notification emails. | 2019-05-17 | 5.0 | CVE-2019-6781 MISC MISC |
| gitlab — gitlab | An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The GitLab API allowed project Maintainers and Owners to view the trigger tokens of other project users. | 2019-05-17 | 4.0 | CVE-2019-6787 MISC MISC |
| gitlab — gitlab | An Incorrect Access Control (issue 2 of 3) issue was discovered in GitLab Community and Enterprise Edition 8.14 and later but before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. Guest users were able to view the list of a group’s merge requests. | 2019-05-17 | 4.0 | CVE-2019-6790 MISC MISC |
| gitlab — gitlab | An information disclosure issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The GitHub token used in CI/CD for External Repos was being leaked to project maintainers in the UI. | 2019-05-17 | 5.0 | CVE-2019-6797 MISC MISC |
| gitlab — gitlab | An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects. | 2019-05-17 | 6.4 | CVE-2019-7353 MISC MISC |
| gnu — gcc | stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against. | 2019-05-22 | 6.8 | CVE-2018-12886 CONFIRM MISC |
| gohttp_project — gohttp | GoHTTP through 2017-07-25 has a stack-based buffer over-read in the scan function (when called from getRequestType) via a long URL. | 2019-05-17 | 5.0 | CVE-2019-12159 MISC |
| gohttp_project — gohttp | In GoHttp through 2017-07-25, there is a stack-based buffer over-read via a long User-Agent header. | 2019-05-20 | 5.0 | CVE-2019-12198 MISC |
| golang — crypto | A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message can contain one or more optional “Hash” Armor Headers. The “Hash” Armor Header specifies the message digest algorithm(s) used for the signature. However, the Go clearsign package ignores the value of this header, which allows an attacker to spoof it. Consequently, an attacker can lead a victim to believe the signature was generated using a different message digest algorithm than what was actually used. Moreover, since the library skips Armor Header parsing in general, an attacker can not only embed arbitrary Armor Headers, but also prepend arbitrary text to cleartext messages without invalidating the signatures. | 2019-05-22 | 4.3 | CVE-2019-11841 MISC MISC MISC MISC |
| google — chrome | Incorrect inheritance of a new document’s policy in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page. | 2019-05-23 | 4.3 | CVE-2019-5799 MISC MISC |
| google — chrome | Insufficient policy enforcement in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page. | 2019-05-23 | 4.3 | CVE-2019-5800 MISC MISC |
| google — chrome | Incorrect eliding of URLs in Omnibox in Google Chrome on iOS prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page. | 2019-05-23 | 4.3 | CVE-2019-5801 MISC MISC |
| google — chrome | Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page. | 2019-05-23 | 4.3 | CVE-2019-5803 MISC MISC |
| ibm — api_connect | IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could provide critical information as to the underlying software stack in CMC UI headers. IBM X-Force ID: 154284. | 2019-05-22 | 4.0 | CVE-2018-1991 XF CONFIRM |
| ibm — bigfix_platform | IBM BigFix Platform 9.2 and 9.5 could allow a low-privilege user to manipulate the UI into exposing interface elements and information normally restricted to administrators. IBM X-Force ID: 156570. | 2019-05-20 | 4.0 | CVE-2019-4058 XF CONFIRM |
| ibm — cloud_private | IBM Cloud Private Kubernetes API server 2.1.0, 3.1.0, 3.1.1, and 3.1.2 can be used as an HTTP proxy to not only cluster internal but also external target IP addresses. IBM X-Force ID: 158145. | 2019-05-17 | 5.0 | CVE-2019-4119 CONFIRM XF |
| identityserver — identityserver4 | IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorContext method, which can be triggered by viewing a log. | 2019-05-21 | 4.3 | CVE-2019-12250 MISC |
| intel — active_management_technology | Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an unauthenticated user to potentially enable escalation of privilege via physical access. | 2019-05-17 | 4.6 | CVE-2019-0092 MISC |
| intel — active_management_technology | Out of bound write vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an authenticated user to potentially enable escalation of privilege via adjacent network access. | 2019-05-17 | 5.2 | CVE-2019-0096 MISC |
| intel — acu_wizard | Improper directory permissions in Intel(R) ACU Wizard version 12.0.0.129 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access. | 2019-05-17 | 4.6 | CVE-2019-0138 MISC |
| intel — converged_security_management_engine_firmware | Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access. | 2019-05-17 | 4.6 | CVE-2019-0086 MISC |
| intel — converged_security_management_engine_firmware | Buffer overflow in subsystem in Intel(R) DAL before version 12.0.35 may allow a privileged user to potentially enable escalation of privilege via local access. | 2019-05-17 | 4.6 | CVE-2019-0170 MISC |
| intel — nuc_kit_firmware | Insufficient input validation in system firmware for Intel (R) NUC Kit may allow an authenticated user to potentially enable escalation of privilege, denial of service, and/or information disclosure via local access. | 2019-05-17 | 4.6 | CVE-2019-11094 MISC |
| intel — proset/wireless_wifi | Improper directory permissions in the installer for Intel(R) PROSet/Wireless WiFi Software version 20.100 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access. | 2019-05-17 | 4.6 | CVE-2018-3701 BID CONFIRM MISC |
| intel — scs_discovery_utility | Unquoted service path in the installer for the Intel(R) SCS Discovery Utility version 12.0.0.129 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access. | 2019-05-17 | 4.6 | CVE-2019-11093 MISC |
| intel — unite | Data Corruption in Intel Unite(R) Client before version 3.3.176.13 may allow an unauthenticated user to potentially cause a denial of service via network access. | 2019-05-17 | 5.0 | CVE-2019-0132 BID MISC |
| jenkins — credentials | Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate. | 2019-05-21 | 4.0 | CVE-2019-10320 FULLDISC MLIST MISC |
| jenkins — pluggable_authentication_module | A missing permission check in Jenkins PAM Authentication Plugin 1.5 and earlier, except 1.4.1 in PamSecurityRealm.DescriptorImpl#doTest allowed users with Overall/Read permission to obtain limited information about the file /etc/shadow and the user Jenkins is running as. | 2019-05-21 | 4.0 | CVE-2019-10319 MLIST MISC |
| joomla — joomla! | An issue was discovered in Joomla! before 3.9.6. The debug views of com_users do not properly escape user supplied data, which leads to a potential XSS attack vector. | 2019-05-20 | 4.3 | CVE-2019-11809 MISC |
| jreast — jr_east_japan | JR East Japan train operation information push notification App for Android version 1.2.4 and earlier allows remote attackers to bypass access restriction to obtain or alter the user’s registered information via unspecified vectors. | 2019-05-17 | 6.4 | CVE-2019-5954 MISC MISC |
| kentico — kentico | Kentico 11 through 12 lets attackers upload and explore files without authentication via the cmsmodules/medialibrary/formcontrols/liveselectors/insertimageormedia/tabs_media.aspx URI. | 2019-05-22 | 6.4 | CVE-2019-12102 MISC MISC MISC |
| leanify_project — leanify | Leanify 0.4.3 allows remote attackers to trigger an out-of-bounds write (1024 bytes) via a modified input file. | 2019-05-23 | 4.3 | CVE-2019-12298 MISC |
| libav — libav | In libavcodec in Libav 9.21, ff_h264_execute_ref_pic_marking() has a heap-based buffer over-read. | 2019-05-22 | 4.3 | CVE-2017-5984 MISC MISC |
| libsdl — sdl2_image | An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a heap-based buffer overflow in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c. | 2019-05-20 | 4.3 | CVE-2019-12216 MISC |
| libsdl — sdl2_image | An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL stdio_read function in file/SDL_rwops.c. | 2019-05-20 | 4.3 | CVE-2019-12217 MISC |
| libsdl — sdl2_image | An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c. | 2019-05-20 | 4.3 | CVE-2019-12218 MISC |
| libsdl — sdl2_image | An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an invalid free error in the SDL function SDL_SetError_REAL at SDL_error.c. | 2019-05-20 | 6.8 | CVE-2019-12219 MISC |
| libsdl — sdl2_image | An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an out-of-bounds read in the SDL function SDL_FreePalette_REAL at video/SDL_pixels.c. | 2019-05-20 | 4.3 | CVE-2019-12220 MISC |
| libsdl — sdl2_image | An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a SEGV in the SDL function SDL_free_REAL at stdlib/SDL_malloc.c. | 2019-05-20 | 4.3 | CVE-2019-12221 MISC |
| libsdl — simple_directmedia_layer | An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9. There is an out-of-bounds read in the function SDL_InvalidateMap at video/SDL_pixels.c. | 2019-05-20 | 4.3 | CVE-2019-12222 MISC |
| linux — linux_kernel | In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to CVE-2013-4343. | 2019-05-17 | 4.9 | CVE-2018-7191 BID MISC MISC MISC MISC MISC MISC MISC |
| macdown_project — macdown | MacDown 0.7.1 (870) allows remote code execution via a file:\\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138. | 2019-05-17 | 6.8 | CVE-2019-12173 MISC |
| matomo — matomo | ** DISPUTED ** A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this issue, stating “avoid reporting path disclosures, as we don’t consider them as security vulnerabilities.” | 2019-05-20 | 4.0 | CVE-2019-12215 MISC |
| mylittleforum — my_little_forum | my little forum before 2.4.20 allows CSRF to delete posts, as demonstrated by mode=posting&delete_posting. | 2019-05-21 | 5.8 | CVE-2019-12253 MISC MISC |
| odoo — odoo | Odoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection. The impact is: obtain sensitive information (remote). | 2019-05-22 | 5.8 | CVE-2017-5871 MISC MISC |
| open-emr — openemr | An issue was discovered in OpenEMR before 5.0.1 Patch 7. Directory Traversal exists via docid=../ to /portal/lib/download_template.php. | 2019-05-17 | 5.0 | CVE-2018-17180 MISC MISC |
| open-xchange — open-xchange_appsuite | Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF. | 2019-05-23 | 4.0 | CVE-2017-15029 MISC MISC CONFIRM |
| open-xchange — open-xchange_appsuite | Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). | 2019-05-23 | 4.3 | CVE-2017-15030 MISC MISC CONFIRM |
| open-xchange — open-xchange_appsuite | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Information Exposure. | 2019-05-23 | 5.0 | CVE-2017-5210 MISC MISC CONFIRM |
| open-xchange — open-xchange_appsuite | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing. | 2019-05-23 | 5.0 | CVE-2017-5211 MISC MISC CONFIRM |
| open-xchange — open-xchange_appsuite | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS). | 2019-05-23 | 4.3 | CVE-2017-5213 MISC MISC CONFIRM |
| open-xchange — open-xchange_appsuite | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS). | 2019-05-22 | 4.3 | CVE-2017-5864 MISC MISC CONFIRM |
| open-xchange — open-xchange_appsuite | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. | 2019-05-22 | 6.5 | CVE-2017-6912 MISC MISC CONFIRM |
| open-xchange — open-xchange_appsuite | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control. | 2019-05-22 | 6.5 | CVE-2017-8340 MISC MISC CONFIRM |
| open-xchange — open-xchange_appsuite | Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing. | 2019-05-22 | 5.0 | CVE-2017-8341 MISC MISC CONFIRM |
| open-xchange — open-xchange_appsuite | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). | 2019-05-22 | 4.3 | CVE-2017-9808 MISC CONFIRM |
| open-xchange — open-xchange_appsuite | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure. | 2019-05-22 | 5.0 | CVE-2017-9809 MISC CONFIRM |
| open-xchange — ox_cloud | Open-Xchange GmbH OX Cloud Plugins 1.4.0 and earlier is affected by: Missing Authorization. | 2019-05-22 | 6.5 | CVE-2017-8777 MISC CONFIRM |
| otrs — otrs | An issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of arbitrary files on the OTRS filesystem. | 2019-05-21 | 4.0 | CVE-2019-9892 CONFIRM MISC |
| pfsense — pfsense | Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted request. | 2019-05-20 | 6.5 | CVE-2019-11816 CONFIRM CONFIRM |
| projectsend — projectsend | CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel. | 2019-05-22 | 6.8 | CVE-2018-7201 MISC |
| projectsend — projectsend | An issue was discovered in ProjectSend before r1053. XSS exists in the “Name” field on the My Account page. | 2019-05-22 | 4.3 | CVE-2018-7202 MISC |
| qemu — qemu | interface_release_resource in hw/display/qxl.c in QEMU 4.0.0 has a NULL pointer dereference. | 2019-05-24 | 5.0 | CVE-2019-12155 CONFIRM MISC |
| qemu — qemu | QEMU 3.0.0 has an Integer Overflow because the qga/commands*.c files do not check the length of the argument list or the number of environment variables. | 2019-05-22 | 5.0 | CVE-2019-12247 BID MISC MISC |
| redhat — libvirt | A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons. | 2019-05-22 | 6.5 | CVE-2019-10132 REDHAT REDHAT CONFIRM FEDORA MISC |
| schneider-electric — 140cra312xxx_firmware | CWE-119: Buffer errors vulnerability exists in Modicon M580 with firmware prior to V2.50, Modicon M340 with firmware prior to V3.01, BMxCRA312xx with firmware prior to V2.40, All firmware versions of Modicon Premium and 140CRA312xxx when sending a specially crafted Modbus packet, which could cause a denial of service to the device that would force a restart to restore availability. | 2019-05-22 | 6.8 | CVE-2018-7851 MISC |
| schneider-electric — atv_imc_drive_controller_firmware | A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a specific Ethernet frame is received in all versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC drive controller, Modicon M241, Modicon M251, Modicon M258, Modicon LMC058, Modicon LMC078, PacDrive Eco ,PacDrive Pro, PacDrive Pro2 | 2019-05-22 | 6.4 | CVE-2019-6820 MISC |
| schneider-electric — bmx-nor-0200h_firmware | A CWE-798 use of hardcoded credentials vulnerability exists in BMX-NOR-0200H with firmware versions prior to V1.7 IR 19 which could cause a confidentiality issue when using FTP protocol. | 2019-05-22 | 4.0 | CVE-2019-6812 MISC |
| schneider-electric — modicon_m340_firmware | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading memory blocks with an invalid data size or with an invalid data offset in the controller over Modbus. | 2019-05-22 | 5.0 | CVE-2018-7843 MISC |
| schneider-electric — modicon_m340_firmware | A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading memory blocks from the controller over Modbus. | 2019-05-22 | 5.0 | CVE-2018-7844 MISC |
| schneider-electric — modicon_m340_firmware | A CWE-125: Out-of-bounds Read vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of unexpected data from the controller when reading specific memory blocks in the controller over Modbus. | 2019-05-22 | 5.0 | CVE-2018-7845 MISC |
| schneider-electric — modicon_m340_firmware | A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause unauthorized access by conducting a brute force attack on Modbus protocol to the controller. | 2019-05-22 | 5.0 | CVE-2018-7846 MISC |
| schneider-electric — modicon_m340_firmware | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause a possible Denial of Service due to improper data integrity check when sending files the controller over Modbus. | 2019-05-22 | 5.0 | CVE-2018-7849 MISC |
| schneider-electric — modicon_m340_firmware | A CWE-807: Reliance on Untrusted Inputs in a Security Decision vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause invalid information displayed in Unity Pro software. | 2019-05-22 | 5.0 | CVE-2018-7850 MISC |
| schneider-electric — modicon_m340_firmware | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when an invalid private command parameter is sent to the controller over Modbus. | 2019-05-22 | 5.0 | CVE-2018-7852 MISC |
| schneider-electric — modicon_m340_firmware | CWE-330: Use of Insufficiently Random Values vulnerability, which could cause the hijacking of the TCP connection when using Ethernet communication in Modicon M580 firmware versions prior to V2.30, and all firmware versions of Modicon M340, Modicon Premium, Modicon Quantum. | 2019-05-22 | 5.0 | CVE-2019-6821 MISC |
| schneider-electric — modicon_premium_firmware | A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading files from the controller over Modbus | 2019-05-22 | 5.0 | CVE-2018-7848 MISC |
| schneider-electric — modicon_premium_firmware | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading invalid physical memory blocks in the controller over Modbus | 2019-05-22 | 5.0 | CVE-2018-7853 MISC |
| schneider-electric — modicon_premium_firmware | A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a denial of Service when sending invalid debug parameters to the controller over Modbus. | 2019-05-22 | 5.0 | CVE-2018-7854 MISC |
| schneider-electric — modicon_premium_firmware | A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a Denial of Service when sending invalid breakpoint parameters to the controller over Modbus | 2019-05-22 | 5.0 | CVE-2018-7855 MISC |
| schneider-electric — modicon_premium_firmware | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of Service when writing invalid memory blocks to the controller over Modbus. | 2019-05-22 | 5.0 | CVE-2018-7856 MISC |
| schneider-electric — modicon_premium_firmware | A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading variables in the controller using Modbus. | 2019-05-22 | 5.0 | CVE-2019-6806 MISC |
| schneider-electric — modicon_premium_firmware | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of service when writing sensitive application variables to the controller over Modbus. | 2019-05-22 | 5.0 | CVE-2019-6807 MISC |
| schneider-electric — modicon_premium_firmware | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 – firmware versions prior to V3.01, Modicon M580 – firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium. | 2019-05-22 | 5.0 | CVE-2019-6819 MISC |
| schneider-electric — modicon_quantum_firmware | In Modicon Quantum all firmware versions, CWE-264: Permissions, Privileges, and Access Control vulnerabilities could cause a denial of service or unauthorized modifications of the PLC configuration when using Ethernet/IP protocol. | 2019-05-22 | 6.4 | CVE-2019-6815 MISC |
| schneider-electric — modicon_quantum_firmware | In Modicon Quantum all firmware versions, a CWE-94: Code Injection vulnerability could cause an unauthorized firmware modification with possible Denial of Service when using Modbus protocol. | 2019-05-22 | 6.4 | CVE-2019-6816 MISC |
| schneider-electric — somachine_basic | An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause cycle time impact when flooding the M221 ethernet interface while the Ethernet/IP adapter is activated. | 2019-05-22 | 5.0 | CVE-2018-7821 MISC |
| schneider-electric — somachine_basic | A Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause remote launch of SoMachine Basic when sending crafted ethernet message. | 2019-05-22 | 5.0 | CVE-2018-7823 MISC |
| schneider-electric — triconex_tristation_emulator | A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex TriStation Emulator V1.2.0, which could cause the emulator to crash when sending a specially crafted packet. The emulator is used infrequently for application logic testing. It is susceptible to an attack only while running in off-line mode. This vulnerability does not exist in Triconex hardware products and therefore has no effect on the operating safety functions in a plant. | 2019-05-22 | 4.3 | CVE-2018-7803 MISC |
| schneider-electric — tsxetg100_firmware | A CWE-79 Cross-Site Scripting vulnerability exists in all versions of the TSXETG100 allowing an attacker to send a specially crafted URL with an embedded script to a user that would then be executed within the context of that user. | 2019-05-22 | 4.3 | CVE-2018-7834 MISC |
| soumu — electronic_reception_and_examination_of_application_for_radio_licenses | Untrusted search path vulnerability in Installer of Electronic reception and examination of application for radio licenses Online 1.0.9.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | 2019-05-17 | 6.8 | CVE-2019-5957 MISC MISC |
| soumu — electronic_reception_and_examination_of_application_for_radio_licenses | Untrusted search path vulnerability in Electronic reception and examination of application for radio licenses Offline 1.0.9.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | 2019-05-17 | 6.8 | CVE-2019-5958 MISC MISC |
| typora — typora | Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137. | 2019-05-17 | 6.8 | CVE-2019-12172 MISC |
| ucms_project — ucms | sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadmin_ceditpost cvalue parameter. | 2019-05-21 | 6.5 | CVE-2019-12251 MISC |
| valvesoftware — steam | In Valve Steam 1528829181 BETA, it is possible to perform a homograph / homoglyph attack to create fake URLs in the client, which may trick users into visiting unintended web sites. | 2019-05-20 | 5.8 | CVE-2018-12270 MISC |
| vtiger — vtiger_crm | SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands. | 2019-05-17 | 6.5 | CVE-2019-11057 MLIST MISC |
| webpagetest — webpagetest | WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250 as a replacement for 192.168). | 2019-05-17 | 4.0 | CVE-2019-12161 MISC |
| westermo — dr-250_firmware | XSS exists in the /cmdexec/cmdexe?cmd= function in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers. | 2019-05-23 | 4.3 | CVE-2018-19614 MISC MISC |
| wireshark — wireshark | In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and consequently limiting recursion. | 2019-05-23 | 5.0 | CVE-2019-12295 MISC MISC MISC |
| wordpress — wordpress | WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request, related to the “author_name”:” substring. | 2019-05-22 | 5.0 | CVE-2017-6514 BID MISC MISC |
| wpbookingsystem — wp_booking_system | The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access. | 2019-05-20 | 6.5 | CVE-2019-12239 MISC MISC |
| wso2 — api_manager | An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extension to an allowed one. | 2019-05-21 | 5.5 | CVE-2019-6513 MISC MISC |
| zohocorp — manageengine_applications_manager | An issue was discovered in ZOHO ManageEngine Applications Manager 12.3. It is possible for an unauthenticated user to view the list of domain names and usernames used in a company’s network environment via a userconfiguration.do?method=editUser request. | 2019-05-23 | 5.0 | CVE-2017-11557 MISC MISC MISC MISC |
| zohocorp — manageengine_applications_manager | In Zoho ManageEngine Application Manager 13.1 Build 13100, the ‘haid’ parameter of the ‘/auditLogAction.do’ module is vulnerable to a Time-based Blind SQL Injection attack. | 2019-05-23 | 6.8 | CVE-2017-11738 MISC MISC MISC |
| zohocorp — manageengine_applications_manager | In Zoho ManageEngine Application Manager 13.1 Build 13100, an authenticated user, with administrative privileges, has the ability to add a widget on any dashboard. This widget can be a “Utility Widget” with a “Custom HTML or Text” field. Once this widget is created, it will be loaded on the dashboard where it was added. An attacker can abuse this functionality by creating a “Utility Widget” that contains malicious JavaScript code, aka XSS. | 2019-05-23 | 4.3 | CVE-2017-11739 MISC MISC |
| zohocorp — manageengine_applications_manager | In Zoho ManageEngine Application Manager 13.1 Build 13100, the administrative user has the ability to upload files/binaries that can be executed upon the occurrence of an alarm. An attacker can abuse this functionality by uploading a malicious script that can be executed on the remote system. | 2019-05-23 | 6.8 | CVE-2017-11740 MISC MISC |
| zohocorp — manageengine_opmanager | An issue was discovered in ZOHO ManageEngine OpManager 12.2. The ‘apiKey’ parameter of “/api/json/admin/getmailserversettings” and “/api/json/dashboard/gotoverviewlist” is vulnerable to a Blind SQL Injection attack. | 2019-05-23 | 5.0 | CVE-2017-11559 MISC MISC MISC |
| zohocorp — manageengine_opmanager | An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the “Group Chat” or “Alarm” section. This functionality can be abused by a malicious user by uploading a web shell. | 2019-05-23 | 4.0 | CVE-2017-11561 MISC MISC MISC |
| zohocorp — manageengine_servicedesk_plus | An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field. | 2019-05-21 | 4.3 | CVE-2019-12189 MISC MISC MISC |
| zohocorp — manageengine_servicedesk_plus | In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the SDNotify.do?notifyModule=Solution&mode=E-Mail¬ifyTo=SOLFORWARD&id= substring. | 2019-05-21 | 4.0 | CVE-2019-12252 MISC BID MISC MISC |
Low Vulnerabilities
| Primary Vendor — Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| boostio — boostnote | There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart, as demonstrated by a crafted SRC attribute of an IFRAME element, a different vulnerability than CVE-2019-12136. | 2019-05-19 | 3.5 | CVE-2019-12184 MISC |
| centos-webpanel — centos_web_panel | XSS was discovered in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.747 via the testacc/fileManager2.php fm_current_dir or filename parameter. | 2019-05-21 | 3.5 | CVE-2019-12190 MISC |
| ibm — bigfix_platform | IBM BigFix Platform 9.2 and 9.5 stores potentially sensitive information in process memory that could be read by a local attacker with elevated permissions. IBM X-Force ID: 155007 | 2019-05-20 | 2.1 | CVE-2018-2005 XF CONFIRM |
| ibm — bigfix_platform | IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155885. | 2019-05-20 | 3.5 | CVE-2019-4011 XF CONFIRM |
| ibm — websphere_mq | IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local attacker to cause a denial of service within the error log reporting system. IBM X-Force ID: 156163. | 2019-05-23 | 2.1 | CVE-2019-4039 XF CONFIRM |
| intel — active_management_technology | Insufficient input validation vulnerability in subsystem for Intel(R) AMT before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 may allow an unauthenticated user to potentially enable denial of service via adjacent network access. | 2019-05-17 | 3.3 | CVE-2019-0094 MISC |
| intel — atom_230_firmware | Insufficient key protection vulnerability in silicon reference firmware for Intel(R) Pentium(R) Processor J Series, Intel(R) Pentium(R) Processor N Series, Intel(R) Celeron(R) J Series, Intel(R) Celeron(R) N Series, Intel(R) Atom(R) Processor A Series, Intel(R) Atom(R) Processor E3900 Series, Intel(R) Pentium(R) Processor Silver Series may allow a privileged user to potentially enable denial of service via local access. | 2019-05-17 | 2.1 | CVE-2019-0120 MISC |
| intel — driver_&_support_assistant | Insufficient access control in Intel(R) Driver & Support Assistant version 19.3.12.3 and before may allow a privileged user to potentially enable information disclosure via local access. | 2019-05-17 | 2.1 | CVE-2019-11095 CONFIRM MISC |
| intel — driver_&_support_assistant | Insufficient input validation in Intel(R) Driver & Support Assistant version 19.3.12.3 and before may allow a privileged user to potentially enable denial of service via local access. | 2019-05-17 | 2.1 | CVE-2019-11114 MISC |
| intel — graphics_driver | Insufficient bounds checking in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable a denial of service via local access. | 2019-05-17 | 2.1 | CVE-2019-0113 BID MISC |
| intel — graphics_driver | A race condition in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable a denial of service via local access. | 2019-05-17 | 1.9 | CVE-2019-0114 BID MISC |
| intel — graphics_driver | Insufficient input validation in KMD module for Intel(R) Graphics Driver before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable denial of service via local access. | 2019-05-17 | 2.1 | CVE-2019-0115 BID MISC |
| intel — graphics_driver | An out of bound read in KMD module for Intel(R) Graphics Driver before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow a privileged user to potentially enable denial of service via local access. | 2019-05-17 | 2.1 | CVE-2019-0116 BID MISC |
| open-xchange — open-xchange_appsuite | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). | 2019-05-23 | 3.5 | CVE-2017-13668 MISC CONFIRM |
| open-xchange — open-xchange_appsuite | OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). | 2019-05-23 | 3.5 | CVE-2017-17061 MISC CONFIRM |
| otrs — otrs | An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6, Community Edition 6.0.x through 6.0.17, and OTRSAppointmentCalendar 5.0.x through 5.0.12. An attacker who is logged into OTRS as an agent with appropriate permissions may create a carefully crafted calendar appointment in order to cause execution of JavaScript in the context of OTRS. | 2019-05-21 | 3.5 | CVE-2019-10066 CONFIRM |
| otrs — otrs | An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17. An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context of OTRS. | 2019-05-21 | 3.5 | CVE-2019-10067 CONFIRM |
| ovirt — cockpit-ovirt | During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-setup/cockpit/ansibleVarFileXXXXXX.var` which contains the admin and the appliance passwords as plain-text. At the of the deployment procedure, these files are deleted. | 2019-05-17 | 2.1 | CVE-2019-10139 BID CONFIRM |
| schneider-electric — somachine_basic | An Incorrect Default Permissions (CWE-276) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause unauthorized access to SoMachine Basic resource files when logged on the system hosting SoMachine Basic. | 2019-05-22 | 2.1 | CVE-2018-7822 MISC |
| zohocorp — manageengine_opmanager | An issue was discovered in ZOHO ManageEngine OpManager 12.2. By adding a Google Map to the application, an authenticated user can upload an HTML file. This HTML file is then rendered in various locations of the application. JavaScript inside the uploaded HTML is also interpreted by the application. Thus, an attacker can inject a malicious JavaScript payload inside the HTML file and upload it to the application. | 2019-05-23 | 3.5 | CVE-2017-11560 MISC MISC MISC |
Severity Not Yet Assigned
| Primary Vendor — Product |
Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7023 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7046 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7029 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7047 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7048 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7049 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7050 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7051 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7052 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7053 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7054 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7056 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7044 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7057 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7024 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a buffer errors vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7085 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7062 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an integer overflow vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7030 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7031 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7064 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7065 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7066 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7045 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7043 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7068 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7019 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7022 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7021 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a buffer errors vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7020 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7063 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7025 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7026 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7028 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7060 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7059 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a data leakage (sensitive) vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7089 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7084 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7042 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7034 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7035 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7036 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7037 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7038 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7039 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7040 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a security bypass vulnerability. Successful exploitation could lead to privilege escalation. | 2019-05-24 | not yet calculated | CVE-2019-7041 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7067 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7058 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7083 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7086 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7055 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7033 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7032 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7082 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7081 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a double free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7080 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7079 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7075 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7077 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7087 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7078 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7076 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7074 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7073 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7072 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7071 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7070 CONFIRM |
| adobe — acrobat_and_reader | Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7069 CONFIRM |
| adobe — acrobat_and_reader |
Adobe Acrobat and Reader versions 2019.010.20091 and earlier, 2019.010.20091 and earlier, 2017.011.30120 and earlier version, and 2015.006.30475 and earlier have a data leakage (sensitive) vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7815 CONFIRM |
| adobe — acrobat_and_reader |
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution . | 2019-05-24 | not yet calculated | CVE-2019-7018 CONFIRM |
| adobe — coldfusion | ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a cross site scripting vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-24 | not yet calculated | CVE-2019-7092 CONFIRM |
| adobe — coldfusion |
ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-24 | not yet calculated | CVE-2019-7091 CONFIRM |
| adobe — coldfusion |
ColdFusion versions Update 2 and earlier, Update 9 and earlier, and Update 17 and earlier have a file upload restriction bypass vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-24 | not yet calculated | CVE-2019-7816 CONFIRM |
| adobe — creative_cloud_desktop_application |
Creative Cloud Desktop Application (installer) versions 4.7.0.400 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege escalation. | 2019-05-24 | not yet calculated | CVE-2019-7093 CONFIRM |
| adobe — digital_editions |
Adobe Digital Editions versions 4.5.10.185749 and below have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-24 | not yet calculated | CVE-2019-7095 CONFIRM |
| adobe — flash_player | Flash Player Desktop Runtime versions 32.0.0.114 and earlier, Flash Player for Google Chrome versions 32.0.0.114 and earlier, and Flash Player for Microsoft Edge and Internet Explorer 11 versions 32.0.0.114 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. | 2019-05-24 | not yet calculated | CVE-2019-7090 CONFIRM |
| adobe — flash_player |
Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure . | 2019-05-23 | not yet calculated | CVE-2019-7108 CONFIRM |
| adobe — flash_player |
Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-23 | not yet calculated | CVE-2019-7096 CONFIRM |
| adobe — photoshop_cc |
Adobe Photoshop CC 19.1.7 and earlier, and 20.0.2 and earlier have a heap corruption vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-24 | not yet calculated | CVE-2019-7094 CONFIRM |
| adobe — shockwave_player | Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-23 | not yet calculated | CVE-2019-7101 CONFIRM |
| adobe — shockwave_player | Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-23 | not yet calculated | CVE-2019-7102 CONFIRM |
| adobe — shockwave_player | Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-23 | not yet calculated | CVE-2019-7103 CONFIRM |
| adobe — shockwave_player | Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-23 | not yet calculated | CVE-2019-7100 CONFIRM |
| adobe — shockwave_player | Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-23 | not yet calculated | CVE-2019-7098 CONFIRM |
| adobe — shockwave_player | Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. | 2019-05-23 | not yet calculated | CVE-2019-7099 CONFIRM |
| ampache — ampache | Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php. | 2019-05-24 | not yet calculated | CVE-2017-18375 MISC |
| b2evolution — b2evolution | b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/call_plugin.php. | 2019-05-23 | not yet calculated | CVE-2016-8901 MISC MISC MISC |
| belavier_commerce — abantecart |
AbanteCart 1.2.8 allows SQL Injection via the source_language parameter to admin/controller/pages/localisation/language.php and core/lib/language_manager.php, or via POST data to admin/controller/pages/tool/backup.php and admin/model/tool/backup.php. | 2019-05-24 | not yet calculated | CVE-2016-10755 MISC MISC |
| bitdefender — bitdefender_engines | An issue was discovered in Bitdefender Engines before 7.76675. A vulnerability has been discovered in the rar.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. Paired with other vulnerabilities, this can result in denial-of-service. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. | 2019-05-24 | not yet calculated | CVE-2018-18059 MISC MISC |
| bitdefender — bitdefender_engines | An issue was discovered in Bitdefender Engines before 7.76808. A vulnerability has been discovered in the dalvik.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. Paired with other vulnerabilities, this can result in denial-of-service. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. | 2019-05-24 | not yet calculated | CVE-2018-18060 MISC MISC |
| bitdefender — bitdefender_engines | An issue was discovered in Bitdefender Engines before 7.76662. A vulnerability has been discovered in the iso.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a division-by-zero circumstance. Paired with other vulnerabilities, this can result in denial-of-service. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. | 2019-05-24 | not yet calculated | CVE-2018-18058 MISC MISC |
| blue_prism — robotic_process_automation |
In AutomateAppCore.dll in Blue Prism Robotic Process Automation 6.4.0.8445, a vulnerability in access control can be exploited to escalate privileges. The vulnerability allows for abusing the application for fraud or unauthorized access to certain information. The attack requires a valid user account to connect to the Blue Prism server, but the roles associated to this account are not required to have any permissions. First of all, the application files are modified to grant full permissions on the client side. In a test environment (or his own instance of the software) an attacker is able to grant himself full privileges also on the server side. He can then, for instance, create a process with malicious behavior and export it to disk. With the modified client, it is possible to import the exported file as a release and overwrite any existing process in the database. Eventually, the bots execute the malicious process. The server does not check the user’s permissions for the aforementioned actions, such that a modification of the client software enables this kind of attack. Possible scenarios may involve changing bank accounts or setting passwords. | 2019-05-24 | not yet calculated | CVE-2019-11875 MISC MISC |
| bluecats — bluecats_reveal_for_ios | The iOS mobile application BlueCats Reveal before 5.14 stores the username and password in the app cache as base64 encoded strings, i.e. clear text. These persist in the cache even if the user logs out. This can allow an attacker to compromise the affected BlueCats network implementation. The attacker would first need to gain physical control of the iOS device or compromise it with a malicious app. | 2019-05-22 | not yet calculated | CVE-2019-5627 MISC MISC |
| bluecats — bluecats_reveal |
The Android mobile application BlueCats Reveal before 3.0.19 stores the username and password in a clear text file. This file persists until the user logs out or the session times out from non-usage (30 days of no user activity). This can allow an attacker to compromise the affected BlueCats network implementation. The attacker would first need to gain physical control of the Android device or compromise it with a malicious app. | 2019-05-22 | not yet calculated | CVE-2019-5626 MISC MISC |
| cloudera — cloudera_manager |
An issue was discovered in Cloudera Manager before 5.13.4, 5.14.x before 5.14.4, and 5.15.x before 5.15.1. A read-only user can access sensitive cluster information. | 2019-05-24 | not yet calculated | CVE-2018-10815 MISC CONFIRM |
| computrols — computrols_building_automation_software | Computrols CBAS 18.0.0 allows Authentication Bypass. | 2019-05-23 | not yet calculated | CVE-2019-10853 MISC MISC |
| computrols — computrols_building_automation_software | Computrols CBAS 18.0.0 allows Username Enumeration. | 2019-05-24 | not yet calculated | CVE-2019-10848 MISC MISC |
| computrols — computrols_building_automation_software | Computrols CBAS 18.0.0 allows Cross-Site Request Forgery. | 2019-05-24 | not yet calculated | CVE-2019-10847 MISC MISC |
| comsenz — discuz! |
The database backup feature in upload/source/admincp/admincp_db.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP code. | 2019-05-22 | not yet calculated | CVE-2018-14729 MISC MISC MISC MISC |
| deltek — maconomy |
Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS//etc/passwd URI. | 2019-05-24 | not yet calculated | CVE-2019-12314 MISC |
| docker — docker |
In Docker through 18.06.1-ce-rc2, the API endpoints behind the ‘docker cp’ command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot). | 2019-05-23 | not yet calculated | CVE-2018-15664 MISC MISC |
| dollar_shave_club — shave |
XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element. | 2019-05-24 | not yet calculated | CVE-2019-12313 MISC MISC MISC |
| doxygen — doxygen |
Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection. | 2019-05-24 | not yet calculated | CVE-2016-10245 MISC MISC MISC |
| e107 — e107 |
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC. | 2019-05-24 | not yet calculated | CVE-2016-10753 MISC MISC |
| eventum — eventum |
An issue was discovered in Eventum 3.5.0. /htdocs/post_note.php has XSS via the garlic_prefix parameter. | 2019-05-24 | not yet calculated | CVE-2018-12624 MISC CONFIRM |
| exponent_cms — exponent_cms | Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expTagController.php related to change_tags. | 2019-05-24 | not yet calculated | CVE-2016-8900 MISC MISC |
| exponent_cms — exponent_cms | Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php. | 2019-05-24 | not yet calculated | CVE-2016-8898 MISC MISC |
| freeradius_server_project — freeradius |
It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. | 2019-05-24 | not yet calculated | CVE-2019-10143 CONFIRM CONFIRM |
| google — chrome | Incorrect command line processing in Chrome in Google Chrome prior to 73.0.3683.75 allowed a local attacker to perform domain spoofing via a crafted domain name. | 2019-05-23 | not yet calculated | CVE-2019-5804 MISC MISC |
| google — chrome | Incorrect handling of download origins in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page. | 2019-05-23 | not yet calculated | CVE-2019-5802 MISC MISC |
| google — chrome | An integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. | 2019-05-23 | not yet calculated | CVE-2019-5788 MISC MISC |
| google — chrome | Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file. | 2019-05-23 | not yet calculated | CVE-2019-5795 MISC MISC |
| google — chrome | An integer overflow leading to an incorrect capacity of a buffer in JavaScript in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. | 2019-05-23 | not yet calculated | CVE-2019-5790 MISC MISC |
| google — chrome | An integer overflow that leads to a use-after-free in WebMIDI in Google Chrome on Windows prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. | 2019-05-23 | not yet calculated | CVE-2019-5789 MISC MISC |
| google — chrome | Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. | 2019-05-23 | not yet calculated | CVE-2019-5798 MISC MISC DEBIAN |
| google — chrome | Incorrect handling of cancelled requests in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page. | 2019-05-23 | not yet calculated | CVE-2019-5794 MISC MISC |
| google — chrome | Insufficient policy enforcement in extensions in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to initiate the extensions installation user interface via a crafted HTML page. | 2019-05-23 | not yet calculated | CVE-2019-5793 MISC MISC |
| google — chrome | Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file. | 2019-05-23 | not yet calculated | CVE-2019-5792 MISC MISC |
| google — chrome | Inappropriate optimization in V8 in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. | 2019-05-23 | not yet calculated | CVE-2019-5791 MISC MISC |
| google — chrome | Data race in extensions guest view in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2019-05-23 | not yet calculated | CVE-2019-5796 MISC MISC |
| google — chrome |
Use-after-garbage-collection in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 2019-05-23 | not yet calculated | CVE-2019-5787 MISC MISC |
| hazelcast — hazelcast |
In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code. | 2019-05-22 | not yet calculated | CVE-2016-10750 MISC MISC |
| heidelberg — prinect_archiver | A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Heidelberg Prinect Archiver v2013 release 1.0. | 2019-05-24 | not yet calculated | CVE-2019-10685 MISC MISC |
| ibm — storwize_v7000 |
IBM Storwize V7000 Unified (2073) 1.6 configuration may allow an attacker to reveal the server version in default installation, which could be used in further attacks against the system. IBM X-Force ID: 160699. | 2019-05-20 | not yet calculated | CVE-2019-4293 BID XF CONFIRM |
| intel — active_management_technology |
Insufficient input validation vulnerability in subsystem for Intel(R) AMT before version 12.0.35 may allow a privileged user to potentially enable denial of service via network access. | 2019-05-17 | not yet calculated | CVE-2019-0097 MISC |
| intel — converged_security_and_management_engine_and_server_platform_services | Insufficient access control vulnerability in subsystem for Intel(R) CSME before version 12.0.35, Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow unauthenticated user to potentially enable escalation of privilege via physical access. | 2019-05-17 | not yet calculated | CVE-2019-0090 MISC |
| intel — csme_and_server_platform_services |
Insufficient data sanitization vulnerability in HECI subsystem for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow a privileged user to potentially enable information disclosure via local access. | 2019-05-17 | not yet calculated | CVE-2019-0093 MISC |
| intel — csme_and_txe |
Code injection vulnerability in installer for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access. | 2019-05-17 | not yet calculated | CVE-2019-0091 MISC |
| intel — i915_graphics_for_linux | Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0 may allow an authenticated user to potentially enable escalation of privilege via local access. | 2019-05-17 | not yet calculated | CVE-2019-11085 CONFIRM MISC |
| intel — quartus_software |
Improper directory permissions in the installer for Intel(R) Quartus(R) software may allow an authenticated user to potentially enable escalation of privilege via local access. | 2019-05-17 | not yet calculated | CVE-2019-0171 CONFIRM MISC |
| intel — server_platform_services |
Insufficient access control vulnerability in subsystem in Intel(R) SPS before version SPS_E3_05.00.04.027.0 may allow an unauthenticated user to potentially enable escalation of privilege via physical access. | 2019-05-17 | not yet calculated | CVE-2019-0099 MISC |
| intel — server_platform_services |
Improper data sanitization vulnerability in subsystem in Intel(R) SPS before versions SPS_E5_04.00.04.381.0, SPS_E3_04.01.04.054.0, SPS_SoC-A_04.00.04.181.0, and SPS_SoC-X_04.00.04.086.0 may allow a privileged user to potentially enable escalation of privilege via local access. | 2019-05-17 | not yet calculated | CVE-2019-0089 MISC |
| karamasoft — ultimateeditor |
Karamasoft UltimateEditor 1 does not ensure that an uploaded file is an image or document (neither file types nor extensions are restricted). The attacker must use the Attach icon to perform an upload. An uploaded file is accessible under the UltimateEditorInclude/UserFiles/ URI. | 2019-05-24 | not yet calculated | CVE-2019-12150 MISC MISC |
| kliqqi — kliqqi | Kliqqi 3.0.0.5 allows CSRF with resultant Arbitrary File Upload because module.php?module=upload can be used to configure the uploading of .php files, and then modules/upload/upload_main.php can be used for the upload itself. | 2019-05-24 | not yet calculated | CVE-2016-10756 MISC MISC |
| libreswan_project — libreswan |
In Libreswan before 3.28, an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by sending two IKEv2 packets (init_IKE and delete_IKE) in 3des_cbc mode to a Libreswan server. This affects send_v2N_spi_response_from_state in programs/pluto/ikev2_send.c when built with Network Security Services (NSS). | 2019-05-24 | not yet calculated | CVE-2019-12312 MISC MISC MISC |
| medienhaus_gersoene — phpkit | PHPKIT 1.6.6 allows arbitrary File Upload, as demonstrated by a .php file to pkinc/admin/mediaarchive.php and pkinc/func/default.php via the image_name parameter. | 2019-05-24 | not yet calculated | CVE-2016-10758 MISC MISC |
| mitsubishi_electric — melsec-q_series_ethernet_module |
In Mitsubishi Electric MELSEC-Q series Ethernet module QJ71E71-100 serial number 20121 and prior, an attacker could send crafted TCP packets against the FTP service, forcing the target devices to enter an error mode and cause a denial-of-service condition. | 2019-05-23 | not yet calculated | CVE-2019-10977 BID MISC |
| mlm_software — multiple_products | SQL injection exists in ADD Clicking MLM Software 1.0, Binary MLM Software 1.0, Level MLM Software 1.0, Singleleg MLM Software 1.0, Autopool MLM Software 1.0, Investment MLM Software 1.0, Bidding MLM Software 1.0, Moneyorder MLM Software 1.0, Repurchase MLM Software 1.0, and Gift MLM Software 1.0 via the member/readmsg.php msg_id parameter, the member/tree.php pid parameter, or the member/downline.php m_id parameter. | 2019-05-24 | not yet calculated | CVE-2018-17843 MISC MISC |
| open-xchange — ox_app_suite |
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF. | 2019-05-23 | not yet calculated | CVE-2017-13667 MISC CONFIRM |
| opentext — brava!_enterprise_and_brava!_server |
OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. During installation, a displaylistcache file share is created on the Windows server with full read and write permissions for the Everyone group at both the NTFS and Share levels. The share is used to retrieve documents for processing, and to store processed documents for display in the browser. The only required share level access is read/write by the JobProcessor service account. At the local filesystem level, the only additional required permissions would be read/write from the servlet engine, such as Tomcat. (The affected server components are not installed with Content Server by default, and must be installed separately.) NOTE: the vendor’s position is that customers are not supposed to use this default setting without consulting the documentation. | 2019-05-21 | not yet calculated | CVE-2019-12270 MISC |
| oracle — enterprise_manager_products_suite |
Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Products Suite (subcomponent: Services Integration). The supported version that is affected is 12.3.3. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager Ops Center. While the vulnerability is in Enterprise Manager Ops Center, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Enterprise Manager Ops Center. CVSS 3.0 Base Score 6.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H). | 2019-05-24 | not yet calculated | CVE-2019-2726 MISC |
| osclass — osclass |
osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajax_upload. | 2019-05-24 | not yet calculated | CVE-2016-10751 MISC MISC |
| panda_security — multiple_products |
Insecure permissions of the section object Global\PandaDevicesAgentSharedMemory and the event Global\PandaDevicesAgentSharedMemoryChange in Panda products before 18.07.03 allow attackers to queue an event (as an encrypted JSON string) to the system service AgentSvc.exe, which leads to privilege escalation when the CmdLineExecute event is queued. This affects Panda Antivirus, Panda Antivirus Pro, Panda Dome, Panda Global Protection, Panda Gold Protection, and Panda Internet Security. | 2019-05-23 | not yet calculated | CVE-2019-12042 MISC MISC CONFIRM |
| precurio_software_company — precurio |
The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php because ExtendedFileManager can be used to rename the .htaccess file that blocks .php uploads. | 2019-05-24 | not yet calculated | CVE-2016-10759 MISC MISC |
| prestashop — prestashop |
In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup (accepting terms and conditions) before executing the malicious link. | 2019-05-24 | not yet calculated | CVE-2019-11876 MISC MISC |
| qualcomm — multiple_products | Processing messages after error may result in user after free memory fault in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, SM7150 | 2019-05-24 | not yet calculated | CVE-2018-13899 CONFIRM |
| qualcomm — multiple_products | Signature verification of the skel library could potentially be disabled as the memory region on the remote subsystem in which the library is loaded is allocated from userspace currently in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 | 2019-05-24 | not yet calculated | CVE-2018-11967 CONFIRM |
| qualcomm — multiple_products | Error in parsing PMT table frees the memory allocated for the map section but does not reset the context map section reference causing heap use after free issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130 | 2019-05-24 | not yet calculated | CVE-2018-13925 CONFIRM |
| qualcomm — multiple_products | Use-after-free condition due to Improper handling of hrtimers when the PMU driver tries to access its events in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MSM8909W, QCS605, Qualcomm 215, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 712 / SD 710 / SD 670, SD 820A, SD 845 / SD 850, SD 855, SDM439, SDM630, SDM660, SDX24 | 2019-05-24 | not yet calculated | CVE-2018-13920 CONFIRM |
| qualcomm — multiple_products | Improper check before assigning value can lead to integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA4020, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA8081, QCA9377, QCA9379, QCA9531, QCA9558, QCA9563, QCA9880, QCA9886, QCA9980, QCN5502, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660, SDX20, SDX24, SM7150, Snapdragon_High_Med_2016, SXR1130 | 2019-05-24 | not yet calculated | CVE-2018-11968 CONFIRM |
| qualcomm — multiple_products | Due to the missing permissions on several content providers of the RCS app in its android manifest file will lead to an unprivileged access to phone in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 | 2019-05-24 | not yet calculated | CVE-2018-13895 CONFIRM |
| qualcomm — multiple_products | ECDSA signature code leaks private keys from secure world to non-secure world in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9150, MDM9206, MDM9607, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCA8081, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130 | 2019-05-24 | not yet calculated | CVE-2018-11976 CONFIRM |
| qualcomm — multiple_products | An unprivileged user can issue a binder call and cause a system halt in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, SM7150 | 2019-05-24 | not yet calculated | CVE-2018-12005 CONFIRM |
| qualcomm — multiple_products | Unchecked OTA field in GNSS XTRA3 lead to integer overflow and then buffer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX20, SM7150, Snapdragon_High_Med_2016, SXR1130 | 2019-05-24 | not yet calculated | CVE-2018-13886 CONFIRM |
| qualcomm — multiple_products | While processing ssid IE length from remote AP, possible out-of-bounds access may occur due to crafted ssid IE length in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 650/52, SD 820, SD 820A, SDM439, SDX20 | 2019-05-24 | not yet calculated | CVE-2018-11953 CONFIRM |
| qualcomm — multiple_products | Improper authentication in locked memory region can lead to unprivilged access to the memory in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 636, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM630, SDM660, SXR1130 | 2019-05-24 | not yet calculated | CVE-2018-12013 CONFIRM |
| qualcomm — multiple_products | While updating blacklisting region shared buffered memory region is not validated against newly updated black list, causing boot-up to be compromised in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 8CX, SXR1130 | 2019-05-24 | not yet calculated | CVE-2018-12012 CONFIRM |
| qualcomm — multiple_products | Secure keypad is unlocked with secure display still intact in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 636, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM630, SDM660, SXR1130 | 2019-05-24 | not yet calculated | CVE-2018-12004 CONFIRM |
| qualcomm — multiple_products | Untrusted header fields in GNSS XTRA3 function can lead to integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, MSM8909W, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX20, SM7150, SXR1130 | 2019-05-24 | not yet calculated | CVE-2018-13887 CONFIRM |
| qualcomm — multiple_products | Failure to initialize the extra buffer can lead to an out of buffer access in WLAN function in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24 | 2019-05-24 | not yet calculated | CVE-2018-11949 CONFIRM |
| qualcomm — multiple_products | Possible memory overread may be lead to access of sensitive data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9650, MDM9655, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX20, SM7150, SXR1130 | 2019-05-24 | not yet calculated | CVE-2018-13885 CONFIRM |
| qualcomm — multiple_products | Kernel can write to arbitrary memory address passed by user while freeing/stopping a thread in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in QCS605, SD 675, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SM7150, SXR1130 | 2019-05-24 | not yet calculated | CVE-2019-2250 CONFIRM |
| qualcomm — multiple_products | Possibility of double free issue while running multiple instances of smp2p test because of proper protection is missing while using global variable in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 | 2019-05-24 | not yet calculated | CVE-2019-2247 CONFIRM |
| qualcomm — multiple_products | Buffer overflow can occur if invalid header tries to overwrite the existing buffer which fix size allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 820, SD 820A, SD 845 / SD 850, SDM439, SDM660, SDX20 | 2019-05-24 | not yet calculated | CVE-2019-2248 CONFIRM |
| qualcomm — multiple_products | Lack of check on length parameter may cause buffer overflow while processing WMI commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA8081, QCA9377, QCA9379, QCA9886, QCS605, SD 210/SD 212/SD 205, SD 425, SD 600, SD 625, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660, SDX20, SDX24, SM7150, SXR1130 | 2019-05-24 | not yet calculated | CVE-2018-11928 CONFIRM |
| qualcomm — multiple_products | Lack of input validation before copying can lead to a buffer over read in WLAN function in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24, SM7150 | 2019-05-24 | not yet calculated | CVE-2018-11937 CONFIRM |
| qualcomm — multiple_products | Improper buffer length check before copying can lead to integer overflow and then a buffer overflow in WMA event handler in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24 | 2019-05-24 | not yet calculated | CVE-2018-11923 CONFIRM |
| qualcomm — multiple_products | Possible integer underflow can happen when calculating length of elementary stream map from invalid packet length which is later used to read from input buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SM7150, Snapdragon_High_Med_2016 | 2019-05-24 | not yet calculated | CVE-2019-2245 CONFIRM |
| qualcomm — multiple_products | Lack of check in length before using memcpy in WLAN function can lead to OOB access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCS605, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24, SXR1130 | 2019-05-24 | not yet calculated | CVE-2018-11940 CONFIRM |
| qualcomm — multiple_products | Improper buffer length validation in WLAN function can lead to a potential integer oveflow issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS605, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24, SM7150 | 2019-05-24 | not yet calculated | CVE-2018-11924 CONFIRM |
| qualcomm — multiple_products | Data length received from firmware is not validated against the max allowed size which can result in buffer overflow. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24 | 2019-05-24 | not yet calculated | CVE-2018-11925 CONFIRM |
| qualcomm — multiple_products | Improper input validation on input which is used as an array index will lead to an out of bounds issue while processing AP find event from firmware in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 625, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SD 855, SDX20, SDX24, SM7150 | 2019-05-24 | not yet calculated | CVE-2018-11927 CONFIRM |
| qualcomm — multiple_products | Improper input validation on input data which is used to locate and copy the additional IEs in WLAN function can lead to potential integer truncation issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCS605, Qualcomm 215, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, SM7150 | 2019-05-24 | not yet calculated | CVE-2018-11930 CONFIRM |
| qualcomm — multiple_products | Index of array is processed in a wrong way inside a while loop and result in invalid index (-1 or something else) leads to out of bound memory access. in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9379, QCA9886, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 820, SD 820A, SD 835, SDX20, SDX24, Snapdragon_High_Med_2016 | 2019-05-24 | not yet calculated | CVE-2018-11936 CONFIRM |
| qualcomm — multiple_products |
Improper authentication can happen on Remote command handling due to inappropriate handling of events in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SM7150, Snapdragon_High_Med_2016, SXR1130 | 2019-05-24 | not yet calculated | CVE-2018-11271 CONFIRM |
| qualcomm — multiple_products |
Possible integer underflow can happen when calculating length of elementary stream info from invalid section length which is later used to read from input buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearable in MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016 | 2019-05-24 | not yet calculated | CVE-2019-2244 CONFIRM |
| quest — kace_systems_management_appliance |
An issue was discovered in Quest KACE Systems Management Appliance before 9.1. The script at /service/kbot_service_notsoap.php is vulnerable to unauthenticated reflected XSS when user-supplied input to the METHOD GET parameter is processed by the web application. Since the application does not properly validate and sanitize this parameter, it is possible to place arbitrary script code into the context of the same page. | 2019-05-24 | not yet calculated | CVE-2019-11604 MISC FULLDISC MISC |
| redaxo — redaxo |
In Redaxo 5.2.0, the cron management of the admin panel suffers from CSRF that leads to arbitrary Remote Code Execution via addons/cronjob/lib/types/phpcode.php. | 2019-05-24 | not yet calculated | CVE-2016-10757 MISC MISC |
| s9y — serendipity |
serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles an extensionless filename during a rename, as demonstrated by “php” as a filename. | 2019-05-24 | not yet calculated | CVE-2016-10752 MISC MISC |
| samsung — scx-824_printers |
Samsung SCX-824 printers allow a reflected Cross-Site-Scripting (XSS) vulnerability that can be triggered by using the “print from file” feature, as demonstrated by the sws/swsAlert.sws?popupid=successMsg msg parameter. | 2019-05-24 | not yet calculated | CVE-2019-12315 MISC |
| schneider_electric — modbus_serial_driver | An Externally Controlled Reference to a Resource (CWE-610) vulnerability exists in Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 and prior , For 32-bit Windows OS:V2.17 IE 27 and prior, and as part of the Driver Suite version:V14.12 and prior) which could allow write access to system files available only to users with SYSTEM privilege or other important user files. | 2019-05-22 | not yet calculated | CVE-2018-7824 CONFIRM |
| schneider_electric — modicon_quantum | A CWE-255 Credentials Management vulnerability exists in Modicon Quantum with firmware versions prior to V2.40. which could cause a Denial Of Service when using a Telnet connection. | 2019-05-22 | not yet calculated | CVE-2018-7788 MISC |
| schneider_electric — multiple_modicon_controllers | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible Denial of Service when writing out of bounds variables to the controller over Modbus. | 2019-05-22 | not yet calculated | CVE-2018-7857 MISC |
| schneider_electric — pelco_endura_net55xx_encoder |
An Improper Access Control: CWE-284 vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 which could cause impact to confidentiality, integrity, and availability when a remote attacker crafts a malicious request to the encoder webUI. | 2019-05-22 | not yet calculated | CVE-2019-6814 MISC |
| schneider_electric — pelco_sarix_enhanced_camera | A Permissions, Privileges, and Access Control vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to delete an arbitrary file. | 2019-05-22 | not yet calculated | CVE-2018-7816 MISC |
| schneider_electric — pelco_sarix_enhanced_camera | A Command Injection vulnerability exists in the web-based GUI of the 1st Gen PelcoSarix Enhanced Camera that could allow a remote attacker to execute arbitrary commands. | 2019-05-22 | not yet calculated | CVE-2018-7825 MISC |
| schneider_electric — pelco_sarix_enhanced_camera | A Command Injection vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to execute arbitrary commands. | 2019-05-22 | not yet calculated | CVE-2018-7826 MISC |
| schneider_electric — pelco_sarix_enhanced_camera_and_spectra_enhanced_ptz_camera | A Cross-Site Scripting (XSS) vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which a remote attacker can execute arbitrary HTML and script code in a user?s browser session. | 2019-05-22 | not yet calculated | CVE-2018-7827 MISC |
| schneider_electric — pelco_sarix_enhanced_camera_and_spectra_enhanced_ptz_camera | A Cross-Site Request Forgery (CSRF) vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera when an authenticated user clicks a specially crafted malicious link while logged into the camera. | 2019-05-22 | not yet calculated | CVE-2018-7828 MISC |
| schneider_electric — pelco_sarix_enhanced_camera_and_spectra_enhanced_ptz_camera | An Improper Neutralization of Special Elements in Query vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which allows an attacker to execute arbitrary system commands. | 2019-05-22 | not yet calculated | CVE-2018-7829 MISC |
| schneider_electric — pelco_videoxpert_opscenter | A Uncontrolled Search Path Element (CWE-427) vulnerability exists in VideoXpert OpsCenter versions prior to 3.1 which could allow an attacker to cause the system to call an incorrect DLL. | 2019-05-22 | not yet calculated | CVE-2018-7840 MISC |
| tp-link — tl-wr840n_devices |
TP-Link TL-WR840N v5 00000005 devices allow XSS via the network name. The attacker must log into the router by breaking the password and going to the admin login page by THC-HYDRA to get the network name. With an XSS payload, the network name changed automatically and the internet connection was disconnected. All the users become disconnected from the internet. | 2019-05-24 | not yet calculated | CVE-2019-12195 MISC MISC |
| vstarcam — 100t_c7824wip_and_200v_c38s_devices | An issue was discovered in upgrade_firmware.cgi on VStarcam 100T (C7824WIP) CH-sys-48.53.75.119~123 and 200V (C38S) CH-sys-48.53.203.119~123 devices. A remote command can be executed through a system firmware update without authentication. The attacker can modify the files within the internal firmware or even steal account information by executing a command. | 2019-05-23 | not yet calculated | CVE-2019-12289 MISC |
| vstarcam — 100t_c7824wip_and_200v_c38s_devices |
An issue was discovered in upgrade_htmls.cgi on VStarcam 100T (C7824WIP) KR75.8.53.20 and 200V (C38S) KR203.18.1.20 devices. The web service, network, and account files can be manipulated through a web UI firmware update without any authentication. The attacker can achieve access to the device through a manipulated web UI firmware update. | 2019-05-23 | not yet calculated | CVE-2019-12288 MISC |
| vtiger — vtiger_crm |
modules/Calendar/Activity.php in Vtiger CRM 6.5.0 allows SQL injection via the contactidlist parameter. | 2019-05-24 | not yet calculated | CVE-2016-10754 MISC MISC |
| webm_project — libwebp | In libwebp 0.5.1, there is a double free bug in libwebpmux. | 2019-05-23 | not yet calculated | CVE-2016-9969 MISC |
| westermo — dr-250_pre-5162_and_dr-260_pre-5162_routers | Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allow CSRF. | 2019-05-24 | not yet calculated | CVE-2018-19613 MISC MISC |
| westermo — dr-250_pre-5162_and_dr-260_pre-5162_routers | The /uploadfile? functionality in Westermo DR-250 Pre-5162 and DR-260 Pre-5162 routers allows remote users to upload malicious file types and execute ASP code. | 2019-05-24 | not yet calculated | CVE-2018-19612 MISC MISC |
| western_digital_technologies — my_cloud_products |
Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execution (as root, starting from a low-privilege user session) vulnerability. The cgi-bin/webfile_mgr.cgi file allows arbitrary file write by abusing symlinks. Specifically, this occurs by uploading a tar archive that contains a symbolic link, then uploading another archive that writes a file to the link using the “cgi_untar” command. Other commands might also be susceptible. Code can be executed because the “name” parameter passed to the cgi_unzip command is not sanitized. | 2019-05-23 | not yet calculated | CVE-2019-9949 CONFIRM |
| wordpress — wordpress | In the Form Maker plugin before 1.13.3 for WordPress, it’s possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter. | 2019-05-23 | not yet calculated | CVE-2019-10866 MISC MISC |
| zoho_manageengine — adselfservice_plus |
In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user’s AD self-service password reset and MFA token. | 2019-05-24 | not yet calculated | CVE-2019-8346 MISC |
This product is provided subject to this Notification and this Privacy & Use policy.