CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2019(Bypass) (CVSS score >= 6)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-1010263 284 Bypass 2019-07-17 2019-07-28
7.5
None Remote Low Not required Partial Partial Partial
Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. The impact is: allow attackers to bypass authentication by providing a token by crafting with hmac(). The component is: JWT.pm, line 614. The attack vector is: network connectivity. The fixed version is: after commit b98a59b42ded9f9e51b2560410106207c2152d6c.
2 CVE-2019-1010161 284 Bypass 2019-07-25 2019-08-02
7.5
None Remote Low Not required Partial Partial Partial
perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The component is: JWT.pm for JWT security token, line 614 in _decode_jws(). The attack vector is: network connectivity(crafting user-controlled input to bypass authentication). The fixed version is: 0.023.
3 CVE-2019-1010156 287 DoS Bypass +Info 2019-07-23 2019-07-24
6.4
None Remote Low Not required Partial None Partial
D-Link DSL-2750U Firmware 1.11 is affected by: Authentication Bypass. The impact is: denial of service and information leakage. The component is: login form.
4 CVE-2019-1010155 287 DoS Bypass +Info 2019-07-23 2019-08-08
6.4
None Remote Low Not required Partial None Partial
** DISPUTED ** D-Link DSL-2750U 1.11 is affected by: Authentication Bypass. The impact is: denial of service and information leakage. The component is: login. NOTE: Third parties dispute this issues as not being a vulnerability because although the wizard is accessible without authentication, it can't actually configure anything. Thus, there is no denial of service or information leakage.
5 CVE-2019-1010022 119 Overflow Bypass 2019-07-15 2019-07-18
7.5
None Remote Low Not required Partial Partial Partial
GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard.
6 CVE-2019-1003041 254 Bypass 2019-03-28 2019-06-10
7.5
None Remote Low Not required Partial Partial Partial
A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
7 CVE-2019-1003040 254 Bypass 2019-03-28 2019-06-10
7.5
None Remote Low Not required Partial Partial Partial
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
8 CVE-2019-1003034 254 Exec Code Bypass 2019-03-08 2019-04-10
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/SandboxDslScriptLoader.groovy that allows attackers with control over Job DSL definitions to execute arbitrary code on the Jenkins master JVM.
9 CVE-2019-1003031 254 Exec Code Bypass 2019-03-08 2019-04-10
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.
10 CVE-2019-1003030 254 Exec Code Bypass 2019-03-08 2019-04-10
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
11 CVE-2019-1003029 254 Exec Code Bypass 2019-03-08 2019-04-10
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
12 CVE-2019-1003024 254 Exec Code Bypass 2019-02-20 2019-10-09
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.52 and earlier in RejectASTTransformsCustomizer.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
13 CVE-2019-1003006 284 Exec Code Bypass 2019-02-06 2019-10-09
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
14 CVE-2019-1003005 264 Exec Code Bypass 2019-02-06 2019-04-10
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
15 CVE-2019-1003002 254 Exec Code Bypass 2019-01-22 2019-10-09
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
16 CVE-2019-1003001 254 Exec Code Bypass 2019-01-22 2019-10-09
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
17 CVE-2019-1003000 254 Exec Code Bypass 2019-01-22 2019-05-17
6.5
None Remote Low Single system Partial Partial Partial
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
18 CVE-2019-17188 434 Bypass 2019-10-04 2019-10-10
6.5
None Remote Low Single system Partial Partial Partial
An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. An attacker can bypass a front-end restriction and upload PHP code to the webserver, by providing image data and the image/jpeg content type, with a .php extension. This occurs because the code relies on the getimagesize function.
19 CVE-2019-17134 287 Bypass 2019-10-08 2019-10-15
6.4
None Remote Low Not required Partial Partial None
Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED.
20 CVE-2019-16892 400 DoS Bypass 2019-09-25 2019-10-01
7.1
None Remote Medium Not required None None Complete
In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).
21 CVE-2019-16722 20 Exec Code Bypass 2019-09-23 2019-09-23
7.5
None Remote Low Not required Partial Partial Partial
ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an str_ireplace operation.
22 CVE-2019-16378 290 Bypass 2019-09-17 2019-09-17
7.5
None Remote Low Not required Partial Partial Partial
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applications that consider a domain name to be relevant to the origin of an e-mail message.
23 CVE-2019-16318 434 Bypass 2019-09-14 2019-09-17
6.5
None Remote Low Single system Partial Partial Partial
In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.
24 CVE-2019-16190 287 Bypass 2019-09-09 2019-09-11
7.5
None Remote Low Not required Partial Partial Partial
SharePort Web Access on D-Link DIR-868L REVB through 2.03, DIR-885L REVA through 1.20, and DIR-895L REVA through 1.21 devices allows Authentication Bypass, as demonstrated by a direct request to folder_view.php or category_view.php.
25 CVE-2019-16098 269 Exec Code Bypass 2019-09-11 2019-09-13
7.2
None Local Low Not required Complete Complete Complete
The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.
26 CVE-2019-15941 863 Bypass 2019-09-25 2019-10-01
7.5
None Remote Low Not required Partial Partial Partial
OpenID Connect Issuer in LemonLDAP::NG 2.x through 2.0.5 may allow an attacker to bypass access control rules via a crafted OpenID Connect authorization request. To be vulnerable, there must exist an OIDC Relaying party within the LemonLDAP configuration with weaker access control rules than the target RP, and no filtering on redirection URIs.
27 CVE-2019-15894 74 Exec Code Bypass 2019-10-07 2019-10-15
7.2
None Local Low Not required Complete Complete Complete
An issue was discovered in Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.3.x through 3.3.1. An attacker who uses fault injection to physically disrupt the ESP32 CPU can bypass the Secure Boot digest verification at startup, and boot unverified code from flash. The fault injection attack does not disable the Flash Encryption feature, so if the ESP32 is configured with the recommended combination of Secure Boot and Flash Encryption, then the impact is minimized. If the ESP32 is configured without Flash Encryption then successful fault injection allows arbitrary code execution. To protect devices with Flash Encryption and Secure Boot enabled against this attack, a firmware change must be made to permanently enable Flash Encryption in the field if it is not already permanently enabled.
28 CVE-2019-15826 254 Bypass 2019-08-30 2019-09-04
7.5
None Remote Low Not required Partial Partial Partial
The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.
29 CVE-2019-15825 254 Bypass 2019-08-30 2019-09-04
7.5
None Remote Low Not required Partial Partial Partial
The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.
30 CVE-2019-15824 254 Bypass 2019-08-30 2019-09-04
7.5
None Remote Low Not required Partial Partial Partial
The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.
31 CVE-2019-15823 254 Bypass 2019-08-30 2019-09-04
7.5
None Remote Low Not required Partial Partial Partial
The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.
32 CVE-2019-15813 94 Exec Code Bypass 2019-09-04 2019-09-04
6.5
None Remote Low Single system Partial Partial Partial
Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arbitrary code via a webshell.
33 CVE-2019-15806 264 Bypass 2019-08-29 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/basic_sett.html. Any user connected to the Wi-Fi can exploit this.
34 CVE-2019-15805 255 Bypass 2019-08-29 2019-09-05
7.5
None Remote Low Not required Partial Partial Partial
CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/login.html. Any user connected to the Wi-Fi can exploit this.
35 CVE-2019-15272 444 Bypass 2019-10-02 2019-10-09
6.4
None Remote Low Not required Partial Partial None
A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an unauthenticated, remote attacker to bypass security restrictions. The vulnerability is due to improper handling of malformed HTTP methods. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected system. A successful exploit could allow the attacker to gain unauthorized access to the system.
36 CVE-2019-15106 264 Exec Code Bypass 2019-08-15 2019-08-27
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirement and execute commands on the server. The "username+'@opm' string is used for the password. For example, if the username is admin, the password is [email protected]
37 CVE-2019-15088 704 Bypass 2019-09-20 2019-09-20
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in PRiSE adAS 1.7.0. Password hashes are compared using the equality operator. Thus, under specific circumstances, it is possible to bypass login authentication.
38 CVE-2019-15069 287 +Priv Bypass 2019-09-25 2019-09-26
7.5
None Remote Low Not required Partial Partial Partial
An unsafe authentication interface was discovered in Smart Battery A4, a multifunctional portable charger, firmware version ?<= r1.7.9 . An attacker can bypass authentication without modifying device file and gain web page management privilege.
39 CVE-2019-15067 287 +Priv Bypass 2019-09-25 2019-10-01
10.0
None Remote Low Not required Complete Complete Complete
An authentication bypass vulnerability discovered in Smart Battery A2-25DE, a multifunctional portable charger, firmware version ?<= SECFS-2013-10-16-13:42:58-629c30ee-60c68be6. An attacker can bypass authentication and gain privilege by modifying the login page.
40 CVE-2019-15062 352 Bypass CSRF 2019-08-14 2019-08-28
6.0
None Remote Medium Single system Partial Partial Partial
An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the application's own settings pages, this mechanism is bypassed.)
41 CVE-2019-15053 79 XSS Bypass 2019-08-14 2019-08-21
6.0
None Remote Medium Single system Partial Partial Partial
The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element.
42 CVE-2019-14817 264 Exec Code Bypass 2019-09-03 2019-09-09
6.8
None Remote Medium Not required Partial Partial Partial
A flaw was found in, ghostscript versions prior to 9.28, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
43 CVE-2019-14813 264 Exec Code Bypass 2019-09-06 2019-09-09
7.5
None Remote Low Not required Partial Partial Partial
A flaw was found in ghostscript, versions 9.x before 9.28, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
44 CVE-2019-14811 264 Exec Code Bypass 2019-09-03 2019-09-09
6.8
None Remote Medium Not required Partial Partial Partial
A flaw was found in, ghostscript versions prior to 9.28, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.
45 CVE-2019-14809 20 Bypass 2019-08-13 2019-08-24
7.5
None Remote Low Not required Partial Partial Partial
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
46 CVE-2019-14537 287 Bypass 2019-08-07 2019-08-14
7.5
None Remote Low Not required Partial Partial Partial
YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.
47 CVE-2019-14253 863 Bypass 2019-09-18 2019-09-18
6.4
None Remote Low Not required Partial Partial None
An issue was discovered in servletcontroller in the secure portal in Publisure 2.1.2. One can bypass authentication and perform a query on PHP forms within the /AdminDir folder that should be restricted.
48 CVE-2019-13953 287 Bypass 2019-09-06 2019-09-06
8.3
None Local Network Low Not required Complete Complete Complete
An exploitable authentication bypass vulnerability exists in the Bluetooth Low Energy (BLE) authentication module of YI M1 Mirrorless Camera V3.2-cn. An attacker can send a set of BLE commands to trigger this vulnerability, resulting in sensitive data leakage (e.g., personal photos). An attacker can also control the camera to record or take a picture after bypassing authentication.
49 CVE-2019-13605 287 Bypass 2019-07-16 2019-07-18
6.5
None Remote Low Single system Partial Partial Partial
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowledge of a valid username. The attacker must defeat an encoding that is not equivalent to base64, and thus this is different from CVE-2019-13360.
50 CVE-2019-13526 287 Exec Code Bypass 2019-08-30 2019-10-09
6.5
None Remote Low Single system Partial Partial Partial
Datalogic AV7000 Linear barcode scanner all versions prior to 4.6.0.0 is vulnerable to authentication bypass, which may allow an attacker to remotely execute arbitrary code.
Total number of vulnerabilities : 209   Page : 1 (This Page)2 3 4 5
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.