CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
101 CVE-2019-13961 352 CSRF 2019-07-18 2019-07-19
6.8
None Remote Medium Not required Partial Partial Partial
A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files.upload-script.php.
102 CVE-2019-13954 400 2019-07-26 2019-08-07
6.8
None Remote Low Single system None None Complete
Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to memory exhaustion. By sending a crafted HTTP request, an authenticated remote attacker can crash the HTTP server and in some circumstances reboot the system. Malicious code cannot be injected.
103 CVE-2019-13949 352 CSRF 2019-07-18 2019-07-18
6.8
None Remote Medium Not required Partial Partial Partial
SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change.
104 CVE-2019-13635 22 Dir. Trav. 2019-07-30 2019-08-13
6.4
None Remote Low Not required Partial Partial None
The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal.
105 CVE-2019-13623 22 Exec Code Dir. Trav. 2019-07-16 2019-08-12
6.8
None Remote Medium Not required Partial Partial Partial
In NSA Ghidra through 9.0.4, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its filename. This allows attackers to overwrite arbitrary files in scenarios where an intermediate analysis result is archived for sharing with other persons. To achieve arbitrary code execution, one approach is to overwrite some critical Ghidra modules, e.g., the decompile module.
106 CVE-2019-13616 125 2019-07-16 2019-07-17
6.8
None Remote Medium Not required Partial Partial Partial
SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.
107 CVE-2019-13611 352 2019-07-15 2019-07-22
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in python-engineio through 3.8.2. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to a server by using a victim's credentials, because the Origin header is not restricted.
108 CVE-2019-13605 287 Bypass 2019-07-16 2019-07-18
6.5
None Remote Low Single system Partial Partial Partial
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowledge of a valid username. The attacker must defeat an encoding that is not equivalent to base64, and thus this is different from CVE-2019-13360.
109 CVE-2019-13602 191 DoS Overflow 2019-07-14 2019-07-25
6.8
None Remote Medium Not required Partial Partial Partial
An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.
110 CVE-2019-13594 352 CSRF 2019-07-14 2019-07-17
6.8
None Remote Medium Not required Partial Partial Partial
In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server.
111 CVE-2019-13574 20 Exec Code 2019-07-11 2019-07-22
6.8
None Remote Medium Not required Partial Partial Partial
In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.
112 CVE-2019-13570 89 Sql 2019-07-23 2019-07-31
6.5
None Remote Low Single system Partial Partial Partial
The AJdG AdRotate plugin before 5.3 for WordPress allows SQL Injection.
113 CVE-2019-13568 119 Overflow 2019-07-31 2019-08-07
6.8
None Remote Medium Not required Partial Partial Partial
CImg through 2.6.7 has a heap-based buffer overflow in _load_bmp in CImg.h because of erroneous memory allocation for a malformed BMP image.
114 CVE-2019-13567 20 Exec Code 2019-07-12 2019-07-30
6.8
None Remote Medium Not required Partial Partial Partial
The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon (aka the hidden web server) is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a maliciously crafted launch URL. NOTE: ZoomOpener is removed by the Apple Malware Removal Tool (MRT) if this tool is enabled and has the 2019-07-10 MRTConfigData.
115 CVE-2019-13563 352 CSRF 2019-07-11 2019-07-12
6.8
None Remote Medium Not required Partial Partial Partial
D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console.
116 CVE-2019-13494 119 Overflow 2019-07-12 2019-08-02
6.8
None Remote Medium Not required Partial Partial Partial
nodeimp.exe in Castle Rock SNMPc before 9.0.12.1 and 10.x before 10.0.9 has a stack-based buffer overflow via a long variable string in a Map Objects text file.
117 CVE-2019-13475 88 Exec Code 2019-07-09 2019-07-16
6.8
None Remote Medium Not required Partial Partial Partial
In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user visits a specially crafted URL. Based on the available command-line arguments of the software, one can simply inject -exec to execute arbitrary commands. The additional arguments -hideterm and -exitwhendone in the payload make the attack less visible.
118 CVE-2019-13462 89 Sql 2019-08-12 2019-08-15
6.4
None Remote Low Not required Partial Partial None
Lansweeper before 7.1.117.4 allows unauthenticated SQL injection.
119 CVE-2019-13402 254 2019-07-07 2019-07-09
6.5
None Remote Low Single system Partial Partial Partial
/usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of services is reset.
120 CVE-2019-13401 352 CSRF 2019-07-07 2019-07-09
6.8
None Remote Medium Not required Partial Partial Partial
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/.
121 CVE-2019-13391 125 2019-07-07 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels.
122 CVE-2019-13386 264 Exec Code 2019-07-26 2019-08-05
6.5
None Remote Low Single system Partial Partial Partial
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a shell command, i.e., obtain a reverse shell with user privilege.
123 CVE-2019-13370 352 CSRF 2019-07-06 2019-07-09
6.8
None Remote Medium Not required Partial Partial Partial
index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator.
124 CVE-2019-13362 119 Overflow 2019-07-06 2019-07-09
6.8
None Remote Medium Not required Partial Partial Partial
Codedoc v3.2 has a stack-based buffer overflow in add_variable in codedoc.c, related to codedoc_strlcpy.
125 CVE-2019-13351 415 2019-07-05 2019-07-11
6.8
None Remote Medium Not required Partial Partial Partial
posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 (as distributed with alsa-plugins 1.1.7 and later) has a "double file descriptor close" issue during a failed connection attempt when jackd2 is not running. Exploitation success depends on multithreaded timing of that double close, which can result in unintended information disclosure, crashes, or file corruption due to having the wrong file associated with the file descriptor.
126 CVE-2019-13312 125 2019-07-04 2019-07-08
6.8
None Remote Medium Not required Partial Partial Partial
block_cmp() in libavcodec/zmbvenc.c in FFmpeg 4.1.3 has a heap-based buffer over-read.
127 CVE-2019-13308 119 Overflow 2019-07-04 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow in MagickCore/fourier.c in ComplexImage.
128 CVE-2019-13307 119 Overflow 2019-07-04 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows.
129 CVE-2019-13306 119 Overflow 2019-07-04 2019-08-16
6.8
None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.
130 CVE-2019-13305 119 Overflow 2019-07-04 2019-08-16
6.8
None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.
131 CVE-2019-13304 119 Overflow 2019-07-04 2019-08-16
6.8
None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment.
132 CVE-2019-13303 125 2019-07-04 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/composite.c in CompositeImage.
133 CVE-2019-13302 125 2019-07-04 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/fourier.c in ComplexImages.
134 CVE-2019-13300 119 Overflow 2019-07-04 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns.
135 CVE-2019-13299 125 2019-07-04 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/pixel-accessor.h in GetPixelChannel.
136 CVE-2019-13298 119 Overflow 2019-07-04 2019-08-21
6.8
None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/pixel-accessor.h in SetPixelViaPixelInfo because of a MagickCore/enhance.c error.
137 CVE-2019-13297 125 2019-07-04 2019-08-16
6.8
None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled.
138 CVE-2019-13295 125 2019-07-04 2019-08-16
6.8
None Remote Medium Not required Partial Partial Partial
ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled.
139 CVE-2019-13290 119 Exec Code Overflow 2019-07-04 2019-07-10
6.8
None Remote Medium Not required Partial Partial Partial
Artifex MuPDF 1.15.0 has a heap-based buffer overflow in fz_append_display_node located at fitz/list-device.c, allowing remote attackers to execute arbitrary code via a crafted PDF file. This occurs with a large BDC property name that overflows the allocated size of a display list node.
140 CVE-2019-13289 416 2019-07-04 2019-07-09
6.8
None Remote Medium Not required Partial Partial Partial
In Xpdf 4.01.01, there is a use-after-free vulnerability in the function JBIG2Stream::close() located at JBIG2Stream.cc. It can, for example, be triggered by sending a crafted PDF document to the pdftoppm tool.
141 CVE-2019-13283 119 DoS Overflow +Info 2019-07-04 2019-07-09
6.8
None Remote Medium Not required Partial Partial Partial
In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in strncpy from FoFiType1::parse in fofi/FoFiType1.cc because it does not ensure the source string has a valid length before making a fixed-length copy. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.
142 CVE-2019-13282 125 DoS +Info 2019-07-04 2019-07-09
6.8
None Remote Medium Not required Partial Partial Partial
In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in SampledFunction::transform in Function.cc when using a large index for samples. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.
143 CVE-2019-13281 119 DoS Overflow +Info 2019-07-04 2019-07-09
6.8
None Remote Medium Not required Partial Partial Partial
In Xpdf 4.01.01, a heap-based buffer overflow could be triggered in DCTStream::decodeImage() in Stream.cc when writing to frameBuf memory. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service, an information leak, or possibly unspecified other impact.
144 CVE-2019-13280 119 Exec Code Overflow 2019-07-09 2019-07-15
6.5
None Remote Low Single system Partial Partial Partial
TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow while returning an error message to the user about failure to resolve a hostname during a ping or traceroute attempt. This allows an authenticated user to execute arbitrary code. The exploit can be exercised on the local intranet or remotely if remote administration is enabled.
145 CVE-2019-13262 119 Overflow 2019-07-04 2019-07-07
6.8
None Remote Medium Not required Partial Partial Partial
XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x00000000003283eb.
146 CVE-2019-13261 119 Overflow 2019-07-04 2019-07-07
6.8
None Remote Medium Not required Partial Partial Partial
XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000328384.
147 CVE-2019-13260 119 Overflow 2019-07-04 2019-07-07
6.8
None Remote Medium Not required Partial Partial Partial
XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000327a07.
148 CVE-2019-13259 119 Overflow 2019-07-04 2019-07-07
6.8
None Remote Medium Not required Partial Partial Partial
XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000032e566.
149 CVE-2019-13258 119 Overflow 2019-07-04 2019-07-07
6.8
None Remote Medium Not required Partial Partial Partial
XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000328165.
150 CVE-2019-13257 119 Overflow 2019-07-04 2019-07-07
6.8
None Remote Medium Not required Partial Partial Partial
XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x00000000003273aa.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.