CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
5401 CVE-2019-7581 770 2019-02-07 2020-08-24
6.8
None Remote Medium Not required Partial Partial Partial
The parseSWF_ACTIONRECORD function in util/parser.c in libming through 0.4.8 allows remote attackers to have unspecified impact via a crafted swf file that triggers a memory allocation failure, a different vulnerability than CVE-2018-7876.
5402 CVE-2019-7580 94 Exec Code 2019-02-07 2019-02-08
6.5
None Remote Low ??? Partial Partial Partial
ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin_category/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection.
5403 CVE-2019-7577 125 2019-02-07 2021-02-22
6.8
None Remote Medium Not required Partial Partial Partial
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c.
5404 CVE-2019-7576 125 2019-02-07 2019-09-10
6.8
None Remote Medium Not required Partial Partial Partial
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef loop).
5405 CVE-2019-7575 787 Overflow 2019-02-07 2021-02-22
6.8
None Remote Medium Not required Partial Partial Partial
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.
5406 CVE-2019-7574 125 2019-02-07 2019-09-10
6.8
None Remote Medium Not required Partial Partial Partial
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c.
5407 CVE-2019-7573 125 2019-02-07 2019-09-10
6.8
None Remote Medium Not required Partial Partial Partial
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef loop).
5408 CVE-2019-7572 125 2019-02-07 2019-09-10
6.8
None Remote Medium Not required Partial Partial Partial
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.
5409 CVE-2019-7569 352 CSRF 2019-02-07 2019-02-07
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in DOYO (aka doyocms) 2.3(20140425 update). There is a CSRF vulnerability that can add a super administrator account via admin.php?c=a_adminuser&a=add&run=1.
5410 CVE-2019-7566 352 CSRF 2019-02-07 2019-02-07
6.8
None Remote Medium Not required Partial Partial Partial
CSZ CMS 1.1.8 has CSRF via admin/users/new/add.
5411 CVE-2019-7551 79 XSS 2019-04-10 2019-09-27
6.0
None Remote Medium ??? Partial Partial Partial
Cantemo Portal before 3.2.13, 3.3.x before 3.3.8, and 3.4.x before 3.4.9 has XSS. Leveraging this vulnerability would enable performing actions as users, including administrative users. This could enable account creation and deletion as well as deletion of information contained within the app.
5412 CVE-2019-7548 89 Sql 2019-02-06 2021-01-20
6.8
None Remote Medium Not required Partial Partial Partial
SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
5413 CVE-2019-7539 94 2019-03-21 2019-03-25
6.8
None Remote Medium Not required Partial Partial Partial
A code injection issue was discovered in ipycache through 2016-05-31.
5414 CVE-2019-7486 94 Exec Code 2019-12-19 2019-12-31
6.5
None Remote Low ??? Partial Partial Partial
Code injection in SonicWall SMA100 allows an authenticated user to execute arbitrary code in viewcacert CGI script. This vulnerability impacted SMA100 version 9.0.0.4 and earlier.
5415 CVE-2019-7485 120 Exec Code Overflow 2019-12-19 2019-12-31
6.5
None Remote Low ??? Partial Partial Partial
Buffer overflow in SonicWall SMA100 allows an authenticated user to execute arbitrary code in DEARegister CGI script. This vulnerability impacted SMA100 version 9.0.0.3 and earlier.
5416 CVE-2019-7479 269 2019-12-31 2020-10-09
6.5
None Remote Low ??? Partial Partial Partial
A vulnerability in SonicOS allow authenticated read-only admin can elevate permissions to configuration mode. This vulnerability affected SonicOS Gen 5 version 5.9.1.12-4o and earlier, Gen 6 version 6.2.7.4-32n, 6.5.1.4-4n, 6.5.2.3-4n, 6.5.3.3-3n, 6.2.7.10-3n, 6.4.1.0-3n, 6.5.3.3-3n, 6.5.1.9-4n and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).
5417 CVE-2019-7476 320 2019-04-26 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
A vulnerability in SonicWall Global Management System (GMS), allow a remote user to gain access to the appliance using existing SSH key. This vulnerability affects GMS versions 9.1, 9.0, 8.7, 8.6, 8.4, 8.3 and earlier.
5418 CVE-2019-7439 2019-03-21 2020-08-24
6.1
None Local Network Low Not required None None Complete
cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices allows a DoS (Hang) via the mask POST parameter.
5419 CVE-2019-7433 352 CSRF 2019-03-21 2019-03-22
6.8
None Remote Medium Not required Partial Partial Partial
PHP Scripts Mall Rental Bike Script 2.0.3 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.
5420 CVE-2019-7394 269 +Priv 2019-05-28 2020-10-06
6.5
None Remote Low ??? Partial Partial Partial
A privilege escalation vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.x and CA Risk Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 3.1.x allows an authenticated attacker to gain additional privileges in some cases where an account has customized and limited privileges.
5421 CVE-2019-7392 287 +Priv 2019-02-26 2021-04-12
6.4
None Remote Low Not required Partial Partial None
An improper authentication vulnerability in CA Privileged Access Manager 3.x Web-UI jk-manager and jk-status allows a remote attacker to gain sensitive information or alter configuration.
5422 CVE-2019-7391 352 CSRF 2019-03-21 2019-03-29
6.8
None Remote Medium Not required Partial Partial Partial
ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.
5423 CVE-2019-7364 427 Exec Code 2019-08-23 2019-09-03
6.8
None Remote Medium Not required Partial Partial Partial
DLL preloading vulnerability in versions 2017, 2018, 2019, and 2020 of Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D and version 2017 of AutoCAD P&ID. An attacker may trick a user into opening a malicious DWG file that may leverage a DLL preloading vulnerability in AutoCAD which may result in code execution.
5424 CVE-2019-7363 416 Exec Code 2019-08-23 2019-08-30
6.8
None Remote Medium Not required Partial Partial Partial
Use-after-free vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a user into opening a malicious DWF file that may leverage a use-after-free vulnerability, which may result in code execution.
5425 CVE-2019-7362 426 Exec Code 2019-08-23 2019-08-29
6.8
None Remote Medium Not required Partial Partial Partial
DLL preloading vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a user into opening a malicious DWF file that may leverage a DLL preloading vulnerability, which may result in code execution.
5426 CVE-2019-7361 502 Exec Code 2019-04-09 2019-04-11
6.8
None Remote Medium Not required Partial Partial Partial
An attacker may convince a victim to open a malicious action micro (.actm) file that has serialized data, which may trigger a code execution in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018.
5427 CVE-2019-7360 416 Exec Code 2019-04-09 2019-05-13
6.8
None Remote Medium Not required Partial Partial Partial
An exploitable use-after-free vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018. A specially crafted DXF file may trigger a use-after-free, resulting in code execution.
5428 CVE-2019-7359 787 Exec Code Overflow 2019-04-09 2020-08-24
6.8
None Remote Medium Not required Partial Partial Partial
An exploitable heap overflow vulnerability in the AcCellMargin handling code in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018. A specially crafted DXF file with too many cell margins populating an AcCellMargin object may cause a heap overflow, resulting in code execution.
5429 CVE-2019-7358 787 Exec Code Overflow 2019-04-09 2020-08-24
6.8
None Remote Medium Not required Partial Partial Partial
An exploitable heap overflow vulnerability in the DXF-parsing functionality in Autodesk Advance Steel 2018, Autodesk AutoCAD 2018, Autodesk AutoCAD Architecture 2018, Autodesk AutoCAD Electrical 2018, Autodesk AutoCAD Map 3D 2018, Autodesk AutoCAD Mechanical 2018, Autodesk AutoCAD MEP 2018, Autodesk AutoCAD P&ID 2018, Autodesk AutoCAD Plant 3D 2018, Autodesk AutoCAD LT 2018, and Autodesk Civil 3D 2018. A specially crafted DXF file may cause a heap overflow, resulting in code execution.
5430 CVE-2019-7357 352 CSRF 2020-11-10 2020-11-25
6.8
None Remote Medium Not required Partial Partial Partial
Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins.
5431 CVE-2019-7353 200 +Info 2019-05-17 2020-08-24
6.4
None Remote Low Not required Partial Partial None
An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4. GitLab Releases were vulnerable to an authorization issue that allowed users to view confidential issue and merge request titles of other projects.
5432 CVE-2019-7347 367 2019-02-04 2020-08-24
6.0
None Remote Medium ??? Partial Partial Partial
A Time-of-check Time-of-use (TOCTOU) Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for an authenticated user even after deletion from the users table. This allows a nonexistent user to access and modify records (add/delete Monitors, Users, etc.).
5433 CVE-2019-7346 352 CSRF 2019-02-04 2019-02-05
6.8
None Remote Medium Not required Partial Partial Partial
A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback function is called displaying a "Try again" button, which allows resending the failed request, making the CSRF attack successful.
5434 CVE-2019-7319 269 2019-11-26 2020-08-24
6.5
None Remote Low ??? Partial Partial Partial
An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0. When using one of following authentication backends: LdapBackend, PamBackend, SpnegoDjangoBackend, RemoteUserDjangoBackend, SAML2Backend, OpenIDBackend, or OAuthBackend, external users are created with superuser privileges.
5435 CVE-2019-7310 125 DoS 2019-02-03 2020-11-09
6.8
None Remote Medium Not required Partial Partial Partial
In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.
5436 CVE-2019-7286 787 +Priv Mem. Corr. 2019-12-18 2020-08-24
6.8
None Remote Medium Not required Partial Partial Partial
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.
5437 CVE-2019-7281 352 2019-07-01 2019-07-31
6.8
None Remote Medium Not required Partial Partial Partial
Prima Systems FlexAir, Versions 2.3.38 and prior. An unauthenticated user can send unverified HTTP requests, which may allow the attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious website.
5438 CVE-2019-7278 269 2019-07-01 2020-08-24
6.4
None Remote Low Not required Partial Partial None
Optergy Proton/Enterprise devices have an Unauthenticated SMS Sending Service.
5439 CVE-2019-7273 352 CSRF 2019-07-01 2019-11-12
6.8
None Remote Medium Not required Partial Partial Partial
Optergy Proton/Enterprise devices allow Cross-Site Request Forgery (CSRF).
5440 CVE-2019-7270 352 CSRF 2019-07-02 2020-07-02
6.8
None Remote Medium Not required Partial Partial Partial
Linear eMerge 50P/5000P devices allow Cross-Site Request Forgery (CSRF).
5441 CVE-2019-7262 352 CSRF 2019-07-02 2019-11-12
6.8
None Remote Medium Not required Partial Partial Partial
Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).
5442 CVE-2019-7258 863 2019-07-02 2020-08-24
6.5
None Remote Low ??? Partial Partial Partial
Linear eMerge E3-Series devices allow Privilege Escalation.
5443 CVE-2019-7235 22 Dir. Trav. 2019-01-30 2019-02-01
6.4
None Remote Low Not required None Partial Partial
An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/../ to designate an arbitrary directory because of an apps.admincp.php error. This directory can then be deleted via an admincp.php?app=apps&do=uninstall request.
5444 CVE-2019-7234 22 Dir. Trav. 2019-01-30 2019-02-05
6.4
None Remote Low Not required Partial Partial None
An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/../ to begin the process of creating a ZIP archive file with the complete contents of any directory because of an apps.admincp.php error. This ZIP archive file can then be downloaded via an admincp.php?app=apps&do=pack request.
5445 CVE-2019-7233 476 2019-01-30 2019-02-01
6.8
None Remote Medium Not required Partial Partial Partial
In libdoc through 2019-01-28, doc2text in catdoc.c has a NULL pointer dereference.
5446 CVE-2019-7216 Bypass 2019-01-31 2020-08-24
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in FileChucker 4.99e-free-e02. filechucker.cgi has a filter bypass that allows a malicious user to upload any type of file by using % characters within the extension, e.g., file.%ph%p becomes file.php.
5447 CVE-2019-7215 613 2019-06-06 2019-06-10
6.4
None Remote Low Not required Partial Partial None
Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions are changed.
5448 CVE-2019-7212 798 2019-04-24 2020-02-10
6.4
None Remote Low Not required Partial Partial None
SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated attacker could access other users’ emails and file attachments. It was also possible to interact with mailing lists.
5449 CVE-2019-7162 2019-12-31 2020-08-24
6.4
None Remote Low Not required Partial Partial None
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation.
5450 CVE-2019-7143 125 2019-05-22 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Total number of vulnerabilities : 22306   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 (This Page)110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.