CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
551 CVE-2019-11601 22 Dir. Trav. 2019-08-21 2019-10-09
6.4
None Remote Low Not required None Partial Partial
A directory traversal vulnerability in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location.
552 CVE-2019-11600 89 Exec Code Sql 2019-05-13 2019-05-14
6.8
None Remote Medium Not required Partial Partial Partial
A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.
553 CVE-2019-11599 362 DoS +Info 2019-04-29 2019-05-28
6.9
None Local Medium Not required Complete Complete Complete
The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c.
554 CVE-2019-11595 20 Exec Code 2019-04-29 2019-04-30
6.8
None Remote Medium Not required Partial Partial Partial
In uBlock before 0.9.5.15, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a script for execution using XMLHttpRequest or Fetch, and the script origin has an open redirect.
555 CVE-2019-11594 74 Exec Code 2019-04-29 2019-04-30
6.8
None Remote Medium Not required Partial Partial Partial
In AdBlock before 3.45.0, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a script for execution using XMLHttpRequest or Fetch, and the script origin has an open redirect.
556 CVE-2019-11593 74 Exec Code 2019-04-29 2019-04-30
6.8
None Remote Medium Not required Partial Partial Partial
In Adblock Plus before 3.5.2, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a script for execution using XMLHttpRequest or Fetch, and the script origin has an open redirect.
557 CVE-2019-11591 352 Dir. Trav. CSRF File Inclusion 2019-04-29 2019-08-22
6.8
None Remote Medium Not required Partial Partial Partial
The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
558 CVE-2019-11590 352 Dir. Trav. CSRF File Inclusion 2019-04-29 2019-05-03
6.8
None Remote Medium Not required Partial Partial Partial
The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
559 CVE-2019-11569 352 CSRF 2019-05-06 2019-05-07
6.8
None Remote Medium Not required Partial Partial Partial
Veeam ONE Reporter 9.5.0.3201 allows CSRF.
560 CVE-2019-11568 434 2019-04-27 2019-04-29
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in AikCms v2.0. There is a File upload vulnerability, as demonstrated by an admin/page/system/nav.php request with PHP code in a .php file with the application/octet-stream content type.
561 CVE-2019-11567 89 Sql 2019-04-27 2019-04-29
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered in AikCms v2.0. There is a SQL Injection vulnerability via $_GET['del'], as demonstrated by an admin/page/system/nav.php?del= URI.
562 CVE-2019-11557 352 Dir. Trav. CSRF File Inclusion 2019-04-26 2019-08-22
6.8
None Remote Medium Not required Partial Partial Partial
The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
563 CVE-2019-11553 284 2019-07-19 2019-07-23
6.5
None Remote Low Single system Partial Partial Partial
In Code42 for Enterprise through 6.8.4, an administrator without web restore permission but with the ability to manage users in an organization can impersonate a user with web restore permission. When requesting the token to do a web restore, an administrator with permission to manage a user could request the token of that user. If the administrator was not authorized to perform web restores but the user was authorized to perform web restores, this would allow the administrator to impersonate the user with greater permissions. In order to exploit this vulnerability, the user would have to be an administrator with access to manage an organization with a user with greater permissions than themselves.
564 CVE-2019-11542 119 Overflow 2019-04-25 2019-08-09
6.5
None Remote Low Single system Partial Partial Partial
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, an authenticated attacker (via the admin web interface) can send a specially crafted message resulting in a stack buffer overflow.
565 CVE-2019-11539 77 Exec Code 2019-04-25 2019-08-09
6.5
None Remote Low Single system Partial Partial Partial
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.
566 CVE-2019-11518 89 Sql 2019-04-25 2019-04-26
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered in SEMCMS 3.8. SEMCMS_Inquiry.php allows AID[] SQL Injection because the class.phpmailer.php inject_check_sql protection mechanism is incomplete.
567 CVE-2019-11509 284 Exec Code 2019-06-03 2019-06-04
6.5
None Remote Low Single system Partial Partial Partial
In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1, 5.2 before 5.2R12.1, 5.3 before 5.3R15.1, 5.4 before 5.4R7.1, and 9.0 before 9.0R3.2, an authenticated attacker (via the admin web interface) can exploit Incorrect Access Control to execute arbitrary code on the appliance.
568 CVE-2019-11508 22 Exec Code Dir. Trav. 2019-05-08 2019-08-09
6.5
None Remote Low Single system Partial Partial Partial
In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticated attacker (via the admin web interface) can exploit Directory Traversal to execute arbitrary code on the appliance.
569 CVE-2019-11506 119 DoS Overflow 2019-04-24 2019-05-22
6.8
None Remote Medium Not required Partial Partial Partial
In GraphicsMagick from version 1.3.30 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WriteMATLABImage of coders/mat.c, which allows an attacker to cause a denial of service or possibly have unspecified other impact via a crafted image file. This is related to ExportRedQuantumType in magick/export.c.
570 CVE-2019-11505 119 DoS Overflow 2019-04-24 2019-05-22
6.8
None Remote Medium Not required Partial Partial Partial
In GraphicsMagick from version 1.3.8 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WritePDBImage of coders/pdb.c, which allows an attacker to cause a denial of service or possibly have unspecified other impact via a crafted image file. This is related to MagickBitStreamMSBWrite in magick/bit_stream.c.
571 CVE-2019-11496 287 2019-09-10 2019-09-26
6.4
None Remote Low Not required Partial Partial None
In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and write access without authentication. As part of 5.0, the behavior of all buckets including "default" were changed to only allow access by authenticated users with sufficient authorization. However, users were allowed unauthenticated and unauthorized access to the "default" bucket if the properties of this bucket were edited. This has been fixed in versions 5.1.0 and 5.5.0.
572 CVE-2019-11493 119 Exec Code Overflow 2019-04-26 2019-04-26
6.8
None Remote Medium Not required Partial Partial Partial
VeryPDF 4.1 has a Memory Overflow leading to Code Execution because pdfocx!CxImageTIF::operator in pdfocx.ocx (used by pdfeditor.exe and pdfcmd.exe) is mishandled.
573 CVE-2019-11488 284 2019-04-25 2019-05-03
6.8
None Remote Medium Not required Partial Partial Partial
Incorrect Access Control in the Account Access / Password Reset Link in SimplyBook.me Enterprise before 2019-04-23 allows Unauthorized Attackers to READ/WRITE Customer or Administrator data via a persistent HTTP GET Request Hash Link Replay, as demonstrated by a login-link from the browser history.
574 CVE-2019-11486 362 2019-04-23 2019-06-14
6.9
None Local Medium Not required Complete Complete Complete
The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions.
575 CVE-2019-11471 416 2019-04-23 2019-04-24
6.8
None Remote Medium Not required Partial Partial Partial
libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context.cc mishandles references to non-existing alpha images.
576 CVE-2019-11460 20 2019-04-22 2019-05-27
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in GNOME gnome-desktop 3.26, 3.28, and 3.30 prior to 3.30.2.2, and 3.32 prior to 3.32.1.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063.
577 CVE-2019-11458 20 2019-05-08 2019-05-09
6.4
None Remote Low Not required None Partial Partial
An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.
578 CVE-2019-11457 352 CSRF 2019-08-27 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/.
579 CVE-2019-11456 352 CSRF 2019-04-22 2019-04-26
6.8
None Remote Medium Not required Partial Partial Partial
Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code.
580 CVE-2019-11452 89 Sql 2019-04-22 2019-04-22
6.5
None Remote Low Single system Partial Partial Partial
whatsns 4.0 allows index.php?admin_category/remove.html cid[] SQL injection.
581 CVE-2019-11451 89 Sql 2019-04-22 2019-04-22
6.5
None Remote Low Single system Partial Partial Partial
whatsns 4.0 allows index.php?inform/add.html qid SQL injection.
582 CVE-2019-11447 434 Exec Code Bypass 2019-04-22 2019-04-26
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of a file can be changed and the control can be bypassed for code execution. (An attacker can use the GIF header for this.)
583 CVE-2019-11446 434 Bypass 2019-04-22 2019-04-26
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The Upload Files section in the File Manager field contains an arbitrary file upload vulnerability via upload.php. The $IllegalExtensions value only lists lowercase (and thus .phP is a bypass), and omits .shtml and .phtml.
584 CVE-2019-11409 79 Exec Code XSS 2019-06-17 2019-06-18
6.5
None Remote Low Single system Partial Partial Partial
app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.
585 CVE-2019-11401 434 Exec Code 2019-04-22 2019-04-24
6.5
None Remote Low Single system Partial Partial Partial
A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted.
586 CVE-2019-11378 434 Dir. Trav. 2019-04-20 2019-05-10
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.
587 CVE-2019-11377 434 2019-04-20 2019-04-22
6.5
None Remote Low Single system Partial Partial Partial
wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is a valid extension according to the fm_get_text_exts function.
588 CVE-2019-11376 94 Exec Code 2019-04-20 2019-04-22
6.5
None Remote Low Single system Partial Partial Partial
** DISPUTED ** SOY CMS v3.0.2 allows remote attackers to execute arbitrary PHP code via a <?php substring in the second text box. NOTE: the vendor indicates that there was an assumption that the content is "made editable on its own."
589 CVE-2019-11374 352 CSRF 2019-04-20 2019-04-26
6.8
None Remote Medium Not required Partial Partial Partial
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
590 CVE-2019-11363 89 Exec Code Sql 2019-08-29 2019-09-03
6.5
None Remote Low Single system Partial Partial Partial
A SQL injection vulnerability in Snare Central before 7.4.5 allows remote authenticated attackers to execute arbitrary SQL commands via the AgentConsole/UserGroupQuery.php ShowUser parameter.
591 CVE-2019-11354 94 Exec Code 2019-04-19 2019-06-24
6.8
None Remote Medium Not required Partial Partial Partial
The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices communication.
592 CVE-2019-11339 125 DoS 2019-04-18 2019-05-06
6.8
None Remote Medium Not required Partial Partial Partial
The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data.
593 CVE-2019-11338 476 DoS 2019-04-18 2019-05-29
6.8
None Remote Medium Not required Partial Partial Partial
libavcodec/hevcdec.c in FFmpeg 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.
594 CVE-2019-11332 287 2019-04-18 2019-04-22
6.8
None Remote Medium Not required Partial Partial Partial
MKCMS 5.0 allows remote attackers to take over arbitrary user accounts by posting a username and e-mail address to ucenter/repass.php, which triggers e-mail transmission with the password, as demonstrated by 123456.
595 CVE-2019-11331 254 2019-04-18 2019-07-23
6.8
None Remote Medium Not required Partial Partial Partial
Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not required, which makes it easier for remote attackers to conduct off-path attacks.
596 CVE-2019-11326 269 +Priv 2019-09-20 2019-09-23
6.5
None Remote Low Single system Partial Partial Partial
An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protected by a login. A guest is allowed to login. Once logged in as a guest, an attacker can browse a URL to read the password of the administrative user. The same procedure allows a regular user to gain administrative privileges. The guest login is possible in the default configuration.
597 CVE-2019-11280 269 +Priv 2019-09-20 2019-10-09
6.5
None Remote Low Single system Partial Partial Partial
Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizations. A remote authenticated user can gain additional privileges by inviting themselves to spaces that they should not have access to.
598 CVE-2019-11279 269 2019-09-26 2019-10-09
6.5
None Remote Low Single system Partial Partial Partial
CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls.
599 CVE-2019-11248 200 DoS +Info 2019-08-28 2019-10-09
6.4
None Remote Low Not required Partial None Partial
The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.
600 CVE-2019-11247 264 2019-08-28 2019-09-11
6.5
None Remote Low Single system Partial Partial Partial
The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.