CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
4101 CVE-2019-17142 416 Exec Code 2019-10-25 2019-10-28
6.8
None Remote Medium Not required Partial Partial Partial
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of script within a Keystroke action of a listbox field. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9081.
4102 CVE-2019-17141 416 Exec Code 2019-10-25 2019-10-28
6.8
None Remote Medium Not required Partial Partial Partial
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of script within a Calculate action of a text field. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9044.
4103 CVE-2019-17140 416 Exec Code 2019-10-25 2019-10-28
6.8
None Remote Medium Not required Partial Partial Partial
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the OnFocus event. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9091.
4104 CVE-2019-17139 787 Exec Code 2019-10-25 2019-10-28
6.8
None Remote Medium Not required Partial Partial Partial
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of Javascript in the HTML2PDF plugin. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8692.
4105 CVE-2019-17136 125 Exec Code 2020-02-08 2020-03-11
6.8
None Remote Medium Not required Partial Partial Partial
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of DXF files to PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8776.
4106 CVE-2019-17135 787 Exec Code Mem. Corr. 2020-02-08 2020-10-09
6.8
None Remote Medium Not required Partial Partial Partial
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8775.
4107 CVE-2019-17134 287 Bypass 2019-10-08 2019-11-06
6.4
None Remote Low Not required Partial Partial None
Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED.
4108 CVE-2019-17132 20 2019-10-04 2019-10-11
6.8
None Remote Medium Not required Partial Partial Partial
vBulletin through 5.5.4 mishandles custom avatars.
4109 CVE-2019-17130 552 2019-10-04 2019-10-10
6.4
None Remote Low Not required Partial Partial None
vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories.
4110 CVE-2019-17119 89 Exec Code Sql 2019-10-17 2019-10-22
6.5
None Remote Low ??? Partial Partial Partial
Multiple SQL injection vulnerabilities in Logs.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allow authenticated users to execute arbitrary SQL commands via the source or subString parameter.
4111 CVE-2019-17118 352 CSRF 2019-10-17 2019-10-22
6.8
None Remote Medium Not required Partial Partial Partial
A CSRF issue in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows a remote attacker to trick an authenticated user into performing unintended actions such as (1) create or delete admin users; (2) create or delete groups; or (3) create, delete, enable, or disable normal users or devices.
4112 CVE-2019-17117 89 Exec Code Sql 2019-10-17 2019-10-22
6.5
None Remote Low ??? Partial Partial Partial
A SQL injection vulnerability in processPref.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows an authenticated user to execute arbitrary SQL commands via the processPref.jsp key parameter.
4113 CVE-2019-17107 94 Exec Code 2019-10-08 2019-10-15
6.5
None Remote Low ??? Partial Partial Partial
minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter. NOTE: some sources have listed CVE-2019-17017 for this, but that is incorrect.
4114 CVE-2019-17080 502 Exec Code 2019-10-02 2019-10-08
6.8
None Remote Medium Not required Partial Partial Partial
mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a REVIEWS_CACHE file is controlled by an attacker, because an unpickle occurs. This is resolved in 8.0.0 and backports.
4115 CVE-2019-17062 384 2019-11-05 2019-11-08
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. By using a specially crafted URL, users with administrative rights could unintentionally grant unauthorized users access to the admin panel via session fixation.
4116 CVE-2019-17061 120 Overflow 2020-02-10 2020-04-13
6.1
None Local Network Low Not required None None Complete
The Bluetooth Low Energy (BLE) stack implementation on Cypress PSoC 4 through 3.62 devices does not properly restrict the BLE Link Layer header and executes certain memory contents upon receiving a packet with a Link Layer ID (LLID) equal to zero. This allows attackers within radio range to cause deadlocks, cause anomalous behavior in the BLE state machine, or trigger a buffer overflow via a crafted BLE Link Layer frame.
4117 CVE-2019-17060 120 Overflow 2020-02-10 2020-02-13
6.1
None Local Network Low Not required None None Complete
The Bluetooth Low Energy (BLE) stack implementation on the NXP KW41Z (based on the MCUXpresso SDK with Bluetooth Low Energy Driver 2.2.1 and earlier) does not properly restrict the BLE Link Layer header and executes certain memory contents upon receiving a packet with a Link Layer ID (LLID) equal to zero. This allows attackers within radio range to cause deadlocks, cause anomalous behavior in the BLE state machine, or trigger a buffer overflow via a crafted BLE Link Layer frame.
4118 CVE-2019-17058 434 Exec Code Bypass 2019-11-18 2019-11-20
6.5
None Remote Low ??? Partial Partial Partial
Footy Tipping Software AFL Web Edition 2019 allows arbitrary file upload and resultant remote code execution because a whitelist can be bypassed by an Administrator who uploads a crafted upload.dat file.
4119 CVE-2019-17051 20 Exec Code 2019-09-30 2020-05-11
6.8
None Remote Medium Not required Partial Partial Partial
Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attachment files, as demonstrated by a one-click attack involving a drag-and-drop operation on a crafted Terminal file.
4120 CVE-2019-17050 639 2019-09-30 2019-10-04
6.5
None Remote Low ??? Partial Partial Partial
An issue was discovered in the Voyager package through 1.2.7 for Laravel. An attacker with admin privileges and Compass access can read or delete arbitrary files, such as the .env file. NOTE: a software maintainer has suggested a solution in which Compass is switched off in a production environment.
4121 CVE-2019-17026 843 2020-03-02 2021-05-13
6.8
None Remote Medium Not required Partial Partial Partial
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.
4122 CVE-2019-17025 787 Mem. Corr. 2020-01-08 2020-08-24
6.8
None Remote Medium Not required Partial Partial Partial
Mozilla developers reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 72.
4123 CVE-2019-17024 120 Mem. Corr. 2020-01-08 2020-01-13
6.8
None Remote Medium Not required Partial Partial Partial
Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
4124 CVE-2019-17019 20 2020-01-08 2020-01-13
6.8
None Remote Medium Not required Partial Partial Partial
When Python was installed on Windows, a python file being served with the MIME type of text/plain could be executed by Python instead of being opened as a text file when the Open option was selected upon download. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 72.
4125 CVE-2019-17017 843 2020-01-08 2020-01-13
6.8
None Remote Medium Not required Partial Partial Partial
Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
4126 CVE-2019-17015 787 Mem. Corr. 2020-01-08 2020-01-13
6.8
None Remote Medium Not required Partial Partial Partial
During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
4127 CVE-2019-17013 120 Mem. Corr. 2020-01-08 2020-01-13
6.8
None Remote Medium Not required Partial Partial Partial
Mozilla developers reported memory safety bugs present in Firefox 70. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 71.
4128 CVE-2019-17012 120 Mem. Corr. 2020-01-08 2020-01-16
6.8
None Remote Medium Not required Partial Partial Partial
Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
4129 CVE-2019-17008 416 2020-01-08 2020-01-16
6.8
None Remote Medium Not required Partial Partial Partial
When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
4130 CVE-2019-17005 120 Overflow Mem. Corr. 2020-01-08 2020-01-16
6.8
None Remote Medium Not required Partial Partial Partial
The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
4131 CVE-2019-16997 89 Sql 2019-09-30 2019-10-04
6.5
None Remote Low ??? Partial Partial Partial
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno parameter.
4132 CVE-2019-16996 89 Sql 2019-09-30 2019-10-04
6.5
None Remote Low ??? Partial Partial Partial
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter.
4133 CVE-2019-16993 352 CSRF 2019-09-30 2019-11-21
6.8
None Remote Medium Not required Partial Partial Partial
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
4134 CVE-2019-16980 89 Sql 2019-10-21 2019-10-23
6.5
None Remote Low ??? Partial Partial Partial
In FusionPBX up to v4.5.7, the file app\call_broadcast\call_broadcast_edit.php uses an unsanitized "id" variable coming from the URL in an unparameterized SQL query, leading to SQL injection.
4135 CVE-2019-16943 502 2019-10-01 2021-01-21
6.8
None Remote Medium Not required Partial Partial Partial
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
4136 CVE-2019-16941 91 Exec Code 2019-09-28 2019-10-04
6.8
None Remote Medium Not required Partial Partial Partial
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML document. This occurs in Features/BytePatterns/src/main/java/ghidra/bitpatterns/info/FileBitPatternInfoReader.java. An attack could start with an XML document that was originally created by DumpFunctionPatternInfoScript but then directly modified by an attacker (for example, to make a java.lang.Runtime.exec call).
4137 CVE-2019-16917 89 Sql 2019-10-17 2019-10-22
6.5
None Remote Low ??? Partial Partial Partial
WiKID Enterprise 2FA (two factor authentication) Enterprise Server through 4.2.0-b2047 is vulnerable to SQL injection through the searchDevices.jsp endpoint. The uid and domain parameters are used, unsanitized, in a SQL query constructed in the buildSearchWhereClause function.
4138 CVE-2019-16902 20 2019-09-27 2019-09-27
6.4
None Remote Low Not required None Partial Partial
In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname.
4139 CVE-2019-16891 502 Exec Code 2019-10-04 2019-10-10
6.5
None Remote Low ??? Partial Partial Partial
Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.
4140 CVE-2019-16887 120 2019-09-25 2019-09-26
6.8
None Remote Medium Not required Partial Partial Partial
In IrfanView 4.53, Data from a Faulting Address controls a subsequent Write Address starting at image00400000+0x000000000001dcfc.
4141 CVE-2019-16877 2019-11-07 2020-08-24
6.5
None Remote Low ??? Partial Partial Partial
Portainer before 1.22.1 has Incorrect Access Control (issue 4 of 4).
4142 CVE-2019-16861 426 Exec Code 2019-11-19 2019-11-21
6.9
None Local Medium Not required Complete Complete Complete
Code42 server through 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative attacker on the local server could create or modify a dynamic-link library (DLL). The Code42 service could then load it at runtime, and potentially execute arbitrary code at an elevated privilege on the local server.
4143 CVE-2019-16860 426 Exec Code 2019-11-19 2019-11-21
6.9
None Local Medium Not required Complete Complete Complete
Code42 app through version 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative attacker on the local machine could create or modify a dynamic-link library (DLL). The Code42 service could then load it at runtime, and potentially execute arbitrary code at an elevated privilege on the local machine.
4144 CVE-2019-16790 434 Exec Code 2019-12-30 2020-01-07
6.5
None Remote Low ??? Partial Partial Partial
In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted.
4145 CVE-2019-16789 444 Bypass 2019-12-26 2020-02-25
6.4
None Remote Low Not required Partial Partial None
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation.
4146 CVE-2019-16765 20 Exec Code 2019-11-25 2019-12-17
6.8
None Remote Medium Not required Partial Partial Partial
If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. This is fixed in version 1.0.1 of the extension. Users should upgrade to this version using Visual Studio Code Marketplace's upgrade mechanism. After upgrading, the codeQL.cli.executablePath setting can only be set in the per-user settings, and not in the per-workspace settings. More information about VS Code settings can be found here.
4147 CVE-2019-16745 89 Sql 2019-09-30 2019-10-03
6.5
None Remote Low ??? Partial Partial Partial
eBrigade before 5.0 has evenement_choice.php chxCal SQL Injection.
4148 CVE-2019-16744 89 Sql 2019-09-30 2019-10-03
6.5
None Remote Low ??? Partial Partial Partial
eBrigade before 5.0 has evenements.php cid SQL Injection.
4149 CVE-2019-16743 89 Sql 2019-09-30 2019-10-02
6.5
None Remote Low ??? Partial Partial Partial
eBrigade before 5.0 has evenement_ical.php evenement SQL Injection.
4150 CVE-2019-16718 78 Exec Code 2019-09-23 2020-11-16
6.8
None Remote Medium Not required Partial Partial Partial
In radare2 before 3.9.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to an insufficient fix for CVE-2019-14745 and improper handling of symbol names embedded in executables.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.