CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-1003049 287 2019-04-10 2019-04-15
6.8
None Remote Medium Not required Partial Partial Partial
Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.
2 CVE-2019-1003034 254 Exec Code Bypass 2019-03-08 2019-04-10
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/SandboxDslScriptLoader.groovy that allows attackers with control over Job DSL definitions to execute arbitrary code on the Jenkins master JVM.
3 CVE-2019-1003031 254 Exec Code Bypass 2019-03-08 2019-04-10
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.
4 CVE-2019-1003030 254 Exec Code Bypass 2019-03-08 2019-04-10
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
5 CVE-2019-1003029 254 Exec Code Bypass 2019-03-08 2019-04-10
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
6 CVE-2019-1003024 254 Exec Code Bypass 2019-02-20 2019-04-25
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
7 CVE-2019-1003005 264 Exec Code Bypass 2019-02-06 2019-04-10
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
8 CVE-2019-1003004 613 2019-01-22 2019-05-08
6.5
None Remote Low Single system Partial Partial Partial
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.
9 CVE-2019-1003003 613 2019-01-22 2019-05-08
6.5
None Remote Low Single system Partial Partial Partial
An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g. to persist access to temporarily compromised user accounts.
10 CVE-2019-1003002 254 Exec Code Bypass 2019-01-22 2019-04-26
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
11 CVE-2019-1003001 254 Exec Code Bypass 2019-01-22 2019-04-26
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
12 CVE-2019-1003000 254 Exec Code Bypass 2019-01-22 2019-05-17
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
13 CVE-2019-1000012 20 Exec Code 2019-02-04 2019-04-01
6.8
None Remote Medium Not required Partial Partial Partial
Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.19.
14 CVE-2019-12872 89 Sql 2019-06-18 2019-06-18
6.5
None Remote Low Single system Partial Partial Partial
dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the role Publisher via view_unpushed_bundles.jsp.
15 CVE-2019-12868 502 Exec Code 2019-06-17 2019-06-18
6.5
None Remote Low Single system Partial Partial Partial
app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger deserialization.
16 CVE-2019-12839 77 Exec Code 2019-06-15 2019-06-17
6.5
None Remote Low Single system Partial Partial Partial
In OrangeHRM 4.3.1 and before, there is an input validation error within admin/listMailConfiguration (txtSendmailPath parameter) that allows authenticated attackers to achieve arbitrary command execution.
17 CVE-2019-12831 20 2019-06-15 2019-06-17
6.5
None Remote Low Single system Partial Partial Partial
In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the cache directory of a targeted forum via a crafted XML import, as demonstrated by truncation of aaaaaaaaaaaaaaaaaaaaaaaaaa.php.css to aaaaaaaaaaaaaaaaaaaaaaaaaa.php with a 30-character limit, aka theme import stylesheet name RCE.
18 CVE-2019-12816 264 Exec Code 2019-06-15 2019-06-17
6.5
None Remote Low Single system Partial Partial Partial
Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading a module with a crafted name.
19 CVE-2019-12802 119 DoS Overflow 2019-06-13 2019-06-17
6.8
None Remote Medium Not required Partial Partial Partial
In radare2 through 3.5.1, the rcc_context function of libr/egg/egg_lang.c mishandles changing context. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (invalid memory access in r_egg_lang_parsechar; invalid free in rcc_pusharg).
20 CVE-2019-12799 502 Exec Code Bypass 2019-06-13 2019-06-17
6.5
None Remote Low Single system Partial Partial Partial
In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.
21 CVE-2019-12794 255 2019-06-11 2019-06-11
6.0
None Remote Medium Single system Partial Partial Partial
An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins (organization admins have the inherent ability to reset passwords for all of their organization's users). This, however, could be abused in a situation where the host organization of an instance creates organization admins. An organization admin could set a password manually for the site admin or simply use the API key of the site admin to impersonate them. The potential for abuse only occurs when the host organization creates lower-privilege organization admins instead of the usual site admins. Also, only organization admins of the same organization as the site admin could abuse this.
22 CVE-2019-12790 125 DoS 2019-06-10 2019-06-11
6.8
None Remote Medium Not required Partial Partial Partial
In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_lang_parsechar function of egg_lang.c. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact because of missing length validation in libr/egg/egg.c.
23 CVE-2019-12788 119 Overflow 2019-06-10 2019-06-12
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in Photodex ProShow Producer v9.0.3797 (an application that runs with Administrator privileges). It is possible to perform a buffer overflow via a crafted file.
24 CVE-2019-12787 91 2019-06-10 2019-06-11
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of the value of the Gateway key.
25 CVE-2019-12786 77 2019-06-10 2019-06-11
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of the value of the IPAddress key.
26 CVE-2019-12779 59 2019-06-07 2019-06-10
6.6
None Local Low Not required None Complete Complete
libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames (under /dev/shm and /tmp) without O_EXCL.
27 CVE-2019-12760 502 Exec Code 2019-06-06 2019-06-07
6.0
None Remote Medium Single system Partial Partial Partial
A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution.
28 CVE-2019-12742 287 2019-06-05 2019-06-06
6.5
None Remote Low Single system Partial Partial Partial
Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference (a modified username POST parameter).
29 CVE-2019-12739 78 Exec Code 2019-06-05 2019-06-06
6.5
None Remote Low Single system Partial Partial Partial
lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacters in a RAR filename via ajax/extractRar.php (nameOfFile and directory parameters).
30 CVE-2019-12728 669 2019-06-04 2019-06-04
6.8
None Remote Medium Not required Partial Partial Partial
Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP.
31 CVE-2019-12591 77 2019-06-03 2019-06-03
6.5
None Remote Low Single system Partial Partial Partial
NETGEAR Insight Cloud with firmware before Insight 5.6 allows remote authenticated users to achieve command injection.
32 CVE-2019-12548 94 Exec Code 2019-06-03 2019-06-04
6.5
None Remote Low Single system Partial Partial Partial
Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo.
33 CVE-2019-12483 119 Overflow 2019-05-30 2019-05-31
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in GPAC 0.7.1. There is a heap-based buffer overflow in the function ReadGF_IPMPX_RemoveToolNotificationListener in odf/ipmpx_code.c in libgpac.a, as demonstrated by MP4Box.
34 CVE-2019-12448 362 2019-05-29 2019-05-29
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement query_info_on_read/write.
35 CVE-2019-12374 89 Sql 2019-06-03 2019-06-04
6.8
None Remote Medium Not required Partial Partial Partial
A SQL Injection vulnerability exists in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 due to improper username sanitization in the Basic Authentication implementation in core/provisioning.secure/ProvisioningSecure.asmx in Provisioning.Secure.dll.
36 CVE-2019-12303 77 Exec Code 2019-06-06 2019-06-10
6.5
None Remote Low Single system Partial Partial Partial
In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container.
37 CVE-2019-12293 125 2019-05-23 2019-06-06
6.8
None Remote Medium Not required Partial Partial Partial
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.
38 CVE-2019-12291 284 2019-06-06 2019-06-10
6.4
None Remote Low Not required None Partial Partial
HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured.
39 CVE-2019-12270 275 2019-05-21 2019-05-22
6.8
None Remote Medium Not required Partial Partial Partial
OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. During installation, a displaylistcache file share is created on the Windows server with full read and write permissions for the Everyone group at both the NTFS and Share levels. The share is used to retrieve documents for processing, and to store processed documents for display in the browser. The only required share level access is read/write by the JobProcessor service account. At the local filesystem level, the only additional required permissions would be read/write from the servlet engine, such as Tomcat. (The affected server components are not installed with Content Server by default, and must be installed separately.) NOTE: the vendor's position is that customers are not supposed to use this default setting without consulting the documentation.
40 CVE-2019-12251 89 Sql 2019-05-21 2019-05-21
6.5
None Remote Low Single system Partial Partial Partial
sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadmin_ceditpost cvalue parameter.
41 CVE-2019-12239 89 Sql CSRF 2019-05-20 2019-05-21
6.5
None Remote Low Single system Partial Partial Partial
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access.
42 CVE-2019-12219 415 2019-05-20 2019-05-21
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an invalid free error in the SDL function SDL_SetError_REAL at SDL_error.c.
43 CVE-2019-12181 264 2019-06-17 2019-06-18
6.5
None Remote Low Single system Partial Partial Partial
A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux.
44 CVE-2019-12173 20 Exec Code 2019-05-17 2019-05-20
6.8
None Remote Medium Not required Partial Partial Partial
MacDown 0.7.1 (870) allows remote code execution via a file:\\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138.
45 CVE-2019-12172 20 Exec Code 2019-05-17 2019-05-21
6.8
None Remote Medium Not required Partial Partial Partial
Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137.
46 CVE-2019-12169 434 Exec Code Dir. Trav. 2019-06-03 2019-06-05
6.8
None Remote Medium Not required Partial Partial Partial
ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive to the mods/_core/languages/language_import.php (aka Import New Language) or mods/_standard/patcher/index_admin.php (aka Patcher) component.
47 CVE-2019-12154 611 DoS 2019-06-11 2019-06-13
6.4
None Remote Low Not required Partial None Partial
XXE in the XML parser library in RealObjects PDFreactor before 10.1.10722 allows attackers to supply malicious XML content in externally referenced resources, leading to disclosure of local file contents and/or denial of service conditions.
48 CVE-2019-12153 918 2019-06-11 2019-06-17
6.4
None Remote Low Not required Partial Partial None
Lack of validation in the HTML parser in RealObjects PDFreactor before 10.1.10722 leads to SSRF, allowing attackers to access network or file resources on behalf of the server by supplying malicious HTML content.
49 CVE-2019-12146 22 Dir. Trav. 2019-06-11 2019-06-12
6.4
None Remote Low Not required Partial Partial None
A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a flaw in the SCP listener by crafting strings using specific patterns to write files and create directories outside of their authorized directory.
50 CVE-2019-12137 22 Dir. Trav. 2019-05-16 2019-06-13
6.8
None Remote Medium Not required Partial Partial Partial
Typora 0.9.9.24.6 on macOS allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.