# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
9051 |
CVE-2019-15549 |
400 |
|
|
2019-08-26 |
2020-08-24 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
An issue was discovered in the asn1_der crate before 0.6.2 for Rust. Attackers can trigger memory exhaustion by supplying a large value in a length field. |
9052 |
CVE-2019-15545 |
347 |
|
|
2019-08-26 |
2020-08-24 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures. |
9053 |
CVE-2019-15544 |
770 |
|
|
2019-08-26 |
2021-09-14 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls. |
9054 |
CVE-2019-15542 |
674 |
|
|
2019-08-26 |
2020-08-24 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization. |
9055 |
CVE-2019-15541 |
88 |
|
DoS |
2019-08-26 |
2019-09-03 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service (loop of conn_event and ready) by arranging for a client to never be writable. |
9056 |
CVE-2019-15523 |
252 |
|
|
2020-12-30 |
2021-01-04 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It neglects to call this function again, as required by the design of the API. |
9057 |
CVE-2019-15520 |
22 |
|
Dir. Trav. |
2019-08-23 |
2019-08-27 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
comelz Quark before 2019-03-26 allows directory traversal to locations outside of the project directory. |
9058 |
CVE-2019-15518 |
22 |
|
Dir. Trav. |
2019-08-23 |
2019-08-27 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler. |
9059 |
CVE-2019-15516 |
22 |
|
Dir. Trav. |
2019-08-23 |
2019-08-27 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply removes one ../ substring. |
9060 |
CVE-2019-15514 |
200 |
|
+Info |
2019-08-23 |
2021-07-21 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackers can find these numbers via the Group Info feature, e.g., by adding a significant fraction of a region's assigned phone numbers. |
9061 |
CVE-2019-15502 |
|
|
|
2019-08-29 |
2020-08-24 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
The TeamSpeak client before 3.3.2 allows remote servers to trigger a crash via the 0xe2 0x81 0xa8 0xe2 0x81 0xa7 byte sequence, aka Unicode characters U+2068 (FIRST STRONG ISOLATE) and U+2067 (RIGHT-TO-LEFT ISOLATE). |
9062 |
CVE-2019-15330 |
200 |
|
+Info |
2019-08-22 |
2021-07-21 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading. |
9063 |
CVE-2019-15326 |
22 |
|
Dir. Trav. |
2019-08-22 |
2019-08-23 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal. |
9064 |
CVE-2019-15325 |
|
|
|
2019-08-22 |
2020-08-24 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
In GalliumOS 3.0, CONFIG_SECURITY_YAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/ptrace_scope to 1, which might increase risk because of the appearance that a protection mechanism is present when actually it is not. |
9065 |
CVE-2019-15323 |
22 |
|
Dir. Trav. |
2019-08-22 |
2019-09-06 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The ad-inserter plugin before 2.4.20 for WordPress has path traversal. |
9066 |
CVE-2019-15302 |
404 |
|
|
2019-09-11 |
2020-08-24 |
5.5 |
None |
Remote |
Low |
??? |
None |
Partial |
Partial |
The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text pad with editing rights for the URL) to corrupt it (i.e., cause data loss) via a trivial URL modification. |
9067 |
CVE-2019-15294 |
532 |
|
|
2019-08-28 |
2020-08-24 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). Upon an upgrade, if a custom service account is in use and the visitor management service is installed, the Windows username and password for this service are logged in cleartext to the Command_centre.log file. |
9068 |
CVE-2019-15282 |
306 |
|
|
2019-10-16 |
2019-10-22 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker read tcpdump files generated on an affected device. The vulnerability is due an issue in the authentication logic of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web interface. A successful exploit could allow the attacker to read a tcpdump file generated with a particular naming scheme. |
9069 |
CVE-2019-15252 |
119 |
|
Exec Code Overflow |
2019-10-16 |
2019-10-18 |
5.2 |
None |
Local Network |
Low |
??? |
Partial |
Partial |
Partial |
Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default. |
9070 |
CVE-2019-15251 |
119 |
|
Exec Code Overflow |
2019-10-16 |
2019-10-18 |
5.2 |
None |
Local Network |
Low |
??? |
Partial |
Partial |
Partial |
Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default. |
9071 |
CVE-2019-15250 |
119 |
|
Exec Code Overflow |
2019-10-16 |
2019-10-18 |
5.2 |
None |
Local Network |
Low |
??? |
Partial |
Partial |
Partial |
Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default. |
9072 |
CVE-2019-15249 |
119 |
|
Exec Code Overflow |
2019-10-16 |
2019-10-18 |
5.2 |
None |
Local Network |
Low |
??? |
Partial |
Partial |
Partial |
Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default. |
9073 |
CVE-2019-15248 |
119 |
|
Exec Code Overflow |
2019-10-16 |
2019-10-18 |
5.2 |
None |
Local Network |
Low |
??? |
Partial |
Partial |
Partial |
Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default. |
9074 |
CVE-2019-15247 |
119 |
|
Exec Code Overflow |
2019-10-16 |
2019-10-18 |
5.2 |
None |
Local Network |
Low |
??? |
Partial |
Partial |
Partial |
Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default. |
9075 |
CVE-2019-15246 |
119 |
|
Exec Code Overflow |
2019-10-16 |
2019-10-18 |
5.2 |
None |
Local Network |
Low |
??? |
Partial |
Partial |
Partial |
Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default. |
9076 |
CVE-2019-15245 |
119 |
|
Exec Code Overflow |
2019-10-16 |
2019-10-18 |
5.2 |
None |
Local Network |
Low |
??? |
Partial |
Partial |
Partial |
Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default. |
9077 |
CVE-2019-15244 |
119 |
|
Exec Code Overflow |
2019-10-16 |
2019-10-18 |
5.2 |
None |
Local Network |
Low |
??? |
Partial |
Partial |
Partial |
Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default. |
9078 |
CVE-2019-15243 |
119 |
|
Exec Code Overflow |
2019-10-16 |
2019-10-18 |
5.2 |
None |
Local Network |
Low |
??? |
Partial |
Partial |
Partial |
Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default. |
9079 |
CVE-2019-15242 |
119 |
|
Exec Code Overflow |
2019-10-16 |
2019-10-18 |
5.2 |
None |
Local Network |
Low |
??? |
Partial |
Partial |
Partial |
Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default. |
9080 |
CVE-2019-15241 |
119 |
|
Exec Code Overflow |
2019-10-16 |
2019-10-18 |
5.2 |
None |
Local Network |
Low |
??? |
Partial |
Partial |
Partial |
Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default. |
9081 |
CVE-2019-15240 |
119 |
|
Exec Code Overflow |
2019-10-16 |
2019-10-18 |
5.2 |
None |
Local Network |
Low |
??? |
Partial |
Partial |
Partial |
Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default. |
9082 |
CVE-2019-15225 |
770 |
|
DoS |
2019-08-19 |
2020-08-24 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
In Envoy through 1.11.1, users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. A remote attacker may send a request with a very long URI to result in a denial of service (memory consumption). This is a related issue to CVE-2019-14993. |
9083 |
CVE-2019-15166 |
120 |
|
|
2019-10-03 |
2022-04-13 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
lmp_print_data_link_subobjs() in print-lmp.c in tcpdump before 4.9.3 lacks certain bounds checks. |
9084 |
CVE-2019-15165 |
770 |
|
|
2019-10-03 |
2022-04-08 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. |
9085 |
CVE-2019-15164 |
918 |
|
|
2019-10-03 |
2019-10-27 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source. |
9086 |
CVE-2019-15163 |
476 |
|
DoS |
2019-10-03 |
2019-10-27 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daemon crash) if a crypt() call fails. |
9087 |
CVE-2019-15162 |
345 |
|
|
2019-10-03 |
2019-10-27 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which might make it easier for attackers to enumerate valid usernames. |
9088 |
CVE-2019-15161 |
131 |
|
|
2019-10-03 |
2020-08-24 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse of a variable. This may open up an attack vector involving extra data at the end of a request. |
9089 |
CVE-2019-15160 |
611 |
|
DoS |
2019-08-19 |
2021-07-21 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD. |
9090 |
CVE-2019-15138 |
668 |
|
|
2019-09-20 |
2022-01-01 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL. |
9091 |
CVE-2019-15137 |
|
|
|
2019-08-18 |
2020-08-24 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
The Access Control plugin in eProsima Fast RTPS through 1.9.0 allows fnmatch pattern matches with topic name strings (instead of the permission expressions themselves), which can lead to unintended connections between participants in a Data Distribution Service (DDS) network. |
9092 |
CVE-2019-15136 |
862 |
|
Bypass |
2019-08-18 |
2020-08-24 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
The Access Control plugin in eProsima Fast RTPS through 1.9.0 does not check partition permissions from remote participant connections, which can lead to policy bypass for a secure Data Distribution Service (DDS) partition. |
9093 |
CVE-2019-15135 |
319 |
|
|
2019-08-18 |
2020-08-24 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The handshake protocol in Object Management Group (OMG) DDS Security 1.1 sends cleartext information about all of the capabilities of a participant (including capabilities inapplicable to the current session), which makes it easier for attackers to discover potentially sensitive reachability information on a Data Distribution Service (DDS) network. |
9094 |
CVE-2019-15132 |
200 |
|
+Info |
2019-08-17 |
2021-07-21 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of seconds). This affects both api_jsonrpc.php and index.php. |
9095 |
CVE-2019-15129 |
200 |
|
+Info |
2019-08-18 |
2021-07-21 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to access all candidates' files in the photo folder on the website by specifying a "user id" parameter and file name, such as in a recruitment_online/upload/user/[user_id]/photo/[file_name] URI. |
9096 |
CVE-2019-15119 |
732 |
|
|
2019-08-16 |
2020-08-24 |
5.8 |
None |
Remote |
Medium |
Not required |
None |
Partial |
Partial |
lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user. |
9097 |
CVE-2019-15085 |
200 |
|
+Info |
2019-09-20 |
2020-08-24 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
An issue was discovered in PRiSE adAS 1.7.0. The current database password is embedded in the change password form. |
9098 |
CVE-2019-15080 |
|
|
|
2020-12-30 |
2021-01-04 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an Ethereum token. A typo in the constructor of the Owned contract (which is inherited by MORPH Token) allows attackers to acquire contract ownership. A new owner can subsequently obtain MORPH Tokens for free and can perform a DoS attack. |
9099 |
CVE-2019-15079 |
|
|
|
2020-12-30 |
2021-01-04 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
A typo exists in the constructor of a smart contract implementation for EAI through 2019-06-05, an Ethereum token. This vulnerability could be used by an attacker to acquire EAI tokens for free. |
9100 |
CVE-2019-15078 |
|
|
|
2020-12-30 |
2021-01-04 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
An issue was discovered in a smart contract implementation for AIRDROPX BORN through 2019-05-29, an Ethereum token. The name of the constructor has a typo (wrong case: XBornID versus XBORNID) that allows an attacker to change the owner of the contract and obtain cryptocurrency for free. |