CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In July 2019(Bypass)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-1010279 347 DoS Bypass 2019-07-18 2019-08-01
5.0
None Remote Low Not required None None Partial
Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed sequence of network packets. The component is: detect.c (https://github.com/OISF/suricata/pull/3625/commits/d8634daf74c882356659addb65fb142b738a186b). The attack vector is: An attacker can trigger the vulnerability by a specifically crafted network TCP session. The fixed version is: 4.1.3.
2 CVE-2019-1010263 284 Bypass 2019-07-17 2019-07-28
7.5
None Remote Low Not required Partial Partial Partial
Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. The impact is: allow attackers to bypass authentication by providing a token by crafting with hmac(). The component is: JWT.pm, line 614. The attack vector is: network connectivity. The fixed version is: after commit b98a59b42ded9f9e51b2560410106207c2152d6c.
3 CVE-2019-1010251 20 DoS Bypass 2019-07-18 2019-07-23
5.0
None Remote Low Not required None None Partial
Open Information Security Foundation Suricata prior to version 4.1.2 is affected by: Denial of Service - DNS detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed network packet. The component is: app-layer-detect-proto.c, decode.c, decode-teredo.c and decode-ipv6.c (https://github.com/OISF/suricata/pull/3590/commits/11f3659f64a4e42e90cb3c09fcef66894205aefe, https://github.com/OISF/suricata/pull/3590/commits/8357ef3f8ffc7d99ef6571350724160de356158b). The attack vector is: An attacker can trigger the vulnerability by sending a specifically crafted network request. The fixed version is: 4.1.2.
4 CVE-2019-1010199 79 XSS Bypass 2019-07-23 2019-07-25
4.3
None Remote Medium Not required None Partial None
ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting (XSS). The impact is: JavaScrpit is reflected in the server response, hence executed by the browser. The component is: the query used in the GET request is prone. The attack vector is: Since there is no server-side validation and If Browser encoding is bypassed, the victim is affected when opening a crafted URL. The fixed version is: 5.2.0.
5 CVE-2019-1010161 284 Bypass 2019-07-25 2019-08-02
7.5
None Remote Low Not required Partial Partial Partial
perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The component is: JWT.pm for JWT security token, line 614 in _decode_jws(). The attack vector is: network connectivity(crafting user-controlled input to bypass authentication). The fixed version is: 0.023.
6 CVE-2019-1010156 287 DoS Bypass +Info 2019-07-23 2019-07-24
6.4
None Remote Low Not required Partial None Partial
D-Link DSL-2750U Firmware 1.11 is affected by: Authentication Bypass. The impact is: denial of service and information leakage. The component is: login form.
7 CVE-2019-1010155 287 DoS Bypass +Info 2019-07-23 2019-08-08
6.4
None Remote Low Not required Partial None Partial
** DISPUTED ** D-Link DSL-2750U 1.11 is affected by: Authentication Bypass. The impact is: denial of service and information leakage. The component is: login. NOTE: Third parties dispute this issues as not being a vulnerability because although the wizard is accessible without authentication, it can't actually configure anything. Thus, there is no denial of service or information leakage.
8 CVE-2019-1010025 200 Bypass +Info 2019-07-15 2019-08-05
5.0
None Remote Low Not required Partial None None
** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability."
9 CVE-2019-1010024 200 Bypass +Info 2019-07-15 2019-09-20
5.0
None Remote Low Not required Partial None None
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc.
10 CVE-2019-1010022 119 Overflow Bypass 2019-07-15 2019-07-18
7.5
None Remote Low Not required Partial Partial Partial
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard.
11 CVE-2019-13605 287 Bypass 2019-07-16 2019-07-18
6.5
None Remote Low Single system Partial Partial Partial
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowledge of a valid username. The attacker must defeat an encoding that is not equivalent to base64, and thus this is different from CVE-2019-13360.
12 CVE-2019-13483 345 Bypass 2019-07-25 2019-07-31
7.5
None Remote Low Not required Partial Partial Partial
Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms.
13 CVE-2019-13464 434 Bypass 2019-07-09 2019-07-15
5.0
None Remote Low Not required None Partial None
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into underscores in certain contexts where dots are invalid.
14 CVE-2019-13372 287 Exec Code Bypass 2019-07-06 2019-07-12
7.5
None Remote Low Not required Partial Partial Partial
/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arbitrary PHP code via a cookie because a cookie's username field allows eval injection, and an empty password bypasses authentication.
15 CVE-2019-13360 287 Bypass 2019-07-16 2019-07-18
7.5
None Remote Low Not required Partial Partial Partial
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid username.
16 CVE-2019-13344 287 Bypass 2019-07-05 2019-07-31
5.0
None Remote Low Not required None Partial None
An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings. The contains() function in wp_like_button.php did not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update settings, as demonstrated by the wp-admin/admin.php?page=facebook-like-button each_page_url or code_snippet parameter.
17 CVE-2019-13337 287 Bypass 2019-07-09 2019-07-16
5.0
None Remote Low Not required None Partial None
In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token (this is the parameter used by the API). No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is required.
18 CVE-2019-13164 254 Bypass 2019-07-03 2019-08-26
4.6
None Local Low Not required Partial Partial Partial
qemu-bridge-helper.c in QEMU 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.
19 CVE-2019-12970 79 XSS Bypass 2019-07-01 2019-07-30
4.3
None Remote Medium Not required None Partial None
XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBED, NOFRAMES, NOSCRIPT, or TEXTAREA element.
20 CVE-2019-12923 352 Bypass CSRF 2019-07-08 2019-07-16
4.3
None Remote Medium Not required None Partial None
In MailEnable Enterprise Premium 10.23, the potential cross-site request forgery (CSRF) protection mechanism was not implemented correctly and it was possible to bypass it by removing the anti-CSRF token parameter from the request. This could allow an attacker to manipulate a user into unwittingly performing actions within the application (such as sending email, adding contacts, or changing settings) on behalf of the attacker.
21 CVE-2019-12866 285 Bypass 2019-07-03 2019-07-10
7.5
None Remote Low Not required Partial Partial Partial
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168.
22 CVE-2019-12782 285 Bypass 2019-07-09 2019-07-19
5.5
None Remote Low Single system None Partial Partial
An authorization bypass vulnerability in pinboard updates in ThoughtSpot 4.4.1 through 5.1.1 (before 5.1.2) allows a low-privilege user with write access to at least one pinboard to corrupt pinboards of another user in the application by spoofing GUIDs in pinboard update requests, effectively deleting them.
23 CVE-2019-12472 284 Bypass 2019-07-10 2019-07-17
5.0
None Remote Low Not required None Partial None
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
24 CVE-2019-12468 284 Bypass 2019-07-10 2019-07-17
7.5
None Remote Low Not required Partial Partial Partial
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover.
25 CVE-2019-11725 20 Bypass 2019-07-23 2019-08-15
4.0
None Remote Low Single system None Partial None
When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation is interrupted but resources from the same site loaded through websockets are not blocked, leading to the loading of unsafe resources and bypassing safebrowsing protections. This vulnerability affects Firefox < 68.
26 CVE-2019-11716 20 Bypass 2019-07-23 2019-08-15
7.5
None Remote Low Not required Partial Partial Partial
Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNames(window). Sites that deploy a sandboxing that depends on enumerating and freezing access to the window object may miss this, allowing their sandboxes to be bypassed. This vulnerability affects Firefox < 68.
27 CVE-2019-11712 352 Bypass CSRF 2019-07-23 2019-07-29
6.8
None Remote Medium Not required Partial Partial Partial
POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery (CSRF) attacks. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
28 CVE-2019-10639 200 Bypass +Info 2019-07-05 2019-07-19
5.0
None Remote Low Not required Partial None None
The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP addresses. NOTE: this attack against KASLR became viable in 4.1 because IP ID generation was changed to have a dependency on an address associated with a network namespace.
29 CVE-2019-10356 254 Exec Code Bypass 2019-07-31 2019-09-04
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to execute arbitrary code in sandboxed scripts.
30 CVE-2019-10355 254 Exec Code Bypass 2019-07-31 2019-09-04
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts.
31 CVE-2019-10354 200 Bypass +Info 2019-07-17 2019-07-26
4.0
None Remote Low Single system Partial None None
A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
32 CVE-2019-10353 352 Bypass CSRF 2019-07-17 2019-07-26
5.1
None Remote High Not required Partial Partial Partial
CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.
33 CVE-2019-10198 287 Bypass 2019-07-31 2019-10-09
4.0
None Remote Low Single system Partial None None
An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_resource, which performed authorization checks. After the change to Foreman, an unauthenticated user can view the details of a task through the web UI or API, if they can discover or guess the UUID of the task.
34 CVE-2019-10190 20 Bypass 2019-07-16 2019-07-18
5.0
None Remote Low Not required None Partial None
A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers to bypass DNSSEC validation for non-existence answer. NXDOMAIN answer would get passed through to the client even if its DNSSEC validation failed, instead of sending a SERVFAIL packet. Caching is not affected by this particular bug but see CVE-2019-10191.
35 CVE-2019-9884 264 Bypass 2019-07-25 2019-10-09
10.0
None Remote Low Not required Complete Complete Complete
eClass platform < ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page.
36 CVE-2019-9816 704 Bypass 2019-07-23 2019-07-26
4.3
None Remote Medium Not required None Partial None
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
37 CVE-2019-9147 20 Bypass 2019-07-09 2019-08-29
4.3
None Remote Medium Not required None Partial None
Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is intended to be accessible from web applications, the browser's extension isolation mechanisms are disabled (web_accessible_resources). Mailvelope implements additional measures to prevent web applications from directly embedding the settings page, but this mechanism can be bypassed.
38 CVE-2019-7667 287 Bypass 2019-07-01 2019-07-31
6.4
None Remote Low Not required Partial Partial None
Prima Systems FlexAir, Versions 2.3.38 and prior. The application generates database backup files with a predictable name, and an attacker can use brute force to identify the database backup file name. A malicious actor can exploit this issue to download the database file and disclose login information, which can allow the attacker to bypass authentication and have full access to the system.
39 CVE-2019-7280 613 Bypass 2019-07-01 2019-07-31
4.0
None Remote Low Single system Partial None None
Prima Systems FlexAir, Versions 2.3.38 and prior. The session-ID is of an insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session and bypass authentication.
40 CVE-2019-7266 287 Bypass 2019-07-02 2019-07-05
7.5
None Remote Low Not required Partial Partial Partial
Linear eMerge 50P/5000P devices allow Authentication Bypass.
41 CVE-2019-7259 285 Bypass 2019-07-02 2019-07-05
4.0
None Remote Low Single system Partial None None
Linear eMerge E3-Series devices allow Authorization Bypass with Information Disclosure.
42 CVE-2019-6635 284 Bypass 2019-07-03 2019-07-10
3.6
None Local Low Not required None Partial Partial
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, when the BIG-IP system is licensed for Appliance mode, a user with either the Administrator or the Resource Administrator role can bypass Appliance mode restrictions.
43 CVE-2019-6633 264 Bypass 2019-07-03 2019-07-11
3.6
None Local Low Not required Partial Partial None
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4.1, and 11.5.1-11.6.4, when the BIG-IP system is licensed with Appliance mode, user accounts with Administrator and Resource Administrator roles can bypass Appliance mode restrictions.
44 CVE-2019-6627 362 Bypass 2019-07-03 2019-07-10
4.3
None Remote Medium Not required None None Partial
On F5 SSL Orchestrator 14.1.0-14.1.0.5, on rare occasions, specific to a certain race condition, TMM may restart when SSL Forward Proxy enforces the bypass action for an SSL Orchestrator transparent virtual server with SNAT enabled.
45 CVE-2019-5964 287 Bypass 2019-07-05 2019-07-10
5.8
None Local Network Low Not required Partial Partial Partial
iDoors Reader 2.10.17 and earlier allows an attacker on the same network segment to bypass authentication to access the management console and operate the product via unspecified vectors.
46 CVE-2019-5455 287 Bypass 2019-07-30 2019-10-09
4.6
None Local Low Not required Partial Partial Partial
Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process.
47 CVE-2019-5453 284 Bypass 2019-07-30 2019-10-09
3.6
None Local Low Not required Partial Partial None
Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to the Nextcloud file provider.
48 CVE-2019-5452 20 Bypass 2019-07-30 2019-10-09
2.1
None Local Low Not required Partial None None
Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although the lock protection was not solved.
49 CVE-2019-5451 20 Bypass 2019-07-30 2019-10-09
2.1
None Local Low Not required Partial None None
Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing the app in a very short time.
50 CVE-2019-5220 275 Bypass 2019-07-10 2019-07-18
2.1
None Local Low Not required None Partial None
There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones. The system does not sufficiently verify the permission, an attacker could do a certain operation on certain step of setup wizard. Successful exploit could allow the attacker bypass the FRP protection. Affected products: Mate 20 X, versions earlier than Ever-AL00B 9.0.0.200(C00E200R2P1); Mate 20, versions earlier than Hima-AL00B/Hima-TL00B 9.0.0.200(C00E200R2P1); Honor Magic 2, versions earlier than Tony-AL00B/Tony-TL00B 9.0.0.182(C00E180R2P2).
Total number of vulnerabilities : 68   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.