CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
4801 CVE-2019-11481 59 2020-02-08 2020-02-12
6.1
None Local Low Not required Complete Partial Partial
Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a user could get apport to read any file on the system as root, with unknown consequences.
4802 CVE-2019-11480 345 2020-04-14 2020-04-14
6.8
None Remote Medium Not required Partial Partial Partial
The pc-kernel snap build process hardcoded the --allow-insecure-repositories and --allow-unauthenticated apt options when creating the build chroot environment. This could allow an attacker who is able to perform a MITM attack between the build environment and the Ubuntu archive to install a malicious package within the build chroot. This issue affects pc-kernel versions prior to and including 2019-07-16
4803 CVE-2019-11471 416 2019-04-23 2019-04-24
6.8
None Remote Medium Not required Partial Partial Partial
libheif 1.4.0 has a use-after-free in heif::HeifContext::Image::set_alpha_channel in heif_context.h because heif_context.cc mishandles references to non-existing alpha images.
4804 CVE-2019-11460 20 2019-04-22 2019-05-27
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in GNOME gnome-desktop 3.26, 3.28, and 3.30 prior to 3.30.2.2, and 3.32 prior to 3.32.1.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063.
4805 CVE-2019-11458 502 2019-05-08 2020-08-24
6.4
None Remote Low Not required None Partial Partial
An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.
4806 CVE-2019-11457 352 CSRF 2019-08-27 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/.
4807 CVE-2019-11456 352 CSRF 2019-04-22 2019-04-26
6.8
None Remote Medium Not required Partial Partial Partial
Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code.
4808 CVE-2019-11452 89 Sql 2019-04-22 2019-04-22
6.5
None Remote Low ??? Partial Partial Partial
whatsns 4.0 allows index.php?admin_category/remove.html cid[] SQL injection.
4809 CVE-2019-11451 89 Sql 2019-04-22 2019-04-22
6.5
None Remote Low ??? Partial Partial Partial
whatsns 4.0 allows index.php?inform/add.html qid SQL injection.
4810 CVE-2019-11447 434 Exec Code Bypass 2019-04-22 2020-09-11
6.5
None Remote Low ??? Partial Partial Partial
An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of a file can be changed and the control can be bypassed for code execution. (An attacker can use the GIF header for this.)
4811 CVE-2019-11446 434 Bypass 2019-04-22 2019-04-26
6.5
None Remote Low ??? Partial Partial Partial
An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The Upload Files section in the File Manager field contains an arbitrary file upload vulnerability via upload.php. The $IllegalExtensions value only lists lowercase (and thus .phP is a bypass), and omits .shtml and .phtml.
4812 CVE-2019-11409 79 Exec Code XSS 2019-06-17 2019-06-18
6.5
None Remote Low ??? Partial Partial Partial
app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.
4813 CVE-2019-11401 434 Exec Code 2019-04-22 2019-04-24
6.5
None Remote Low ??? Partial Partial Partial
A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp, which is converted to .asp because the "as" substring is deleted.
4814 CVE-2019-11378 434 Dir. Trav. 2019-04-20 2019-05-10
6.5
None Remote Low ??? Partial Partial Partial
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.
4815 CVE-2019-11377 434 2019-04-20 2019-04-22
6.5
None Remote Low ??? Partial Partial Partial
wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is a valid extension according to the fm_get_text_exts function.
4816 CVE-2019-11376 94 Exec Code 2019-04-20 2019-04-22
6.5
None Remote Low ??? Partial Partial Partial
** DISPUTED ** SOY CMS v3.0.2 allows remote attackers to execute arbitrary PHP code via a <?php substring in the second text box. NOTE: the vendor indicates that there was an assumption that the content is "made editable on its own."
4817 CVE-2019-11374 352 CSRF 2019-04-20 2019-04-26
6.8
None Remote Medium Not required Partial Partial Partial
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
4818 CVE-2019-11363 89 Exec Code Sql 2019-08-29 2019-09-03
6.5
None Remote Low ??? Partial Partial Partial
A SQL injection vulnerability in Snare Central before 7.4.5 allows remote authenticated attackers to execute arbitrary SQL commands via the AgentConsole/UserGroupQuery.php ShowUser parameter.
4819 CVE-2019-11361 863 2020-03-19 2020-08-24
6.5
None Remote Low ??? Partial Partial Partial
Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually a full application takeover.
4820 CVE-2019-11354 94 Exec Code 2019-04-19 2019-06-24
6.8
None Remote Medium Not required Partial Partial Partial
The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices communication.
4821 CVE-2019-11339 125 DoS 2019-04-19 2019-05-06
6.8
None Remote Medium Not required Partial Partial Partial
The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote attackers to cause a denial of service (out-of-array access) or possibly have unspecified other impact via crafted MPEG-4 video data.
4822 CVE-2019-11338 476 DoS 2019-04-19 2021-01-04
6.8
None Remote Medium Not required Partial Partial Partial
libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attackers to cause a denial of service (NULL pointer dereference and out-of-array access) or possibly have unspecified other impact via crafted HEVC data.
4823 CVE-2019-11332 2019-04-18 2020-08-24
6.8
None Remote Medium Not required Partial Partial Partial
MKCMS 5.0 allows remote attackers to take over arbitrary user accounts by posting a username and e-mail address to ucenter/repass.php, which triggers e-mail transmission with the password, as demonstrated by 123456.
4824 CVE-2019-11331 2019-04-18 2020-08-24
6.8
None Remote Medium Not required Partial Partial Partial
Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not required, which makes it easier for remote attackers to conduct off-path attacks.
4825 CVE-2019-11326 425 +Priv 2019-09-20 2020-08-24
6.5
None Remote Low ??? Partial Partial Partial
An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protected by a login. A guest is allowed to login. Once logged in as a guest, an attacker can browse a URL to read the password of the administrative user. The same procedure allows a regular user to gain administrative privileges. The guest login is possible in the default configuration.
4826 CVE-2019-11286 502 Exec Code 2020-07-31 2020-08-11
6.5
None Remote Low ??? Partial Partial Partial
VMware GemFire versions prior to 9.10.0, 9.9.1, 9.8.5, and 9.7.5, and VMware Tanzu GemFire for VMs versions prior to 1.11.0, 1.10.1, 1.9.2, and 1.8.2, contain a JMX service available to the network which does not properly restrict input. A remote authenticated malicious user may request against the service with a crafted set of credentials leading to remote code execution.
4827 CVE-2019-11280 269 +Priv 2019-09-20 2019-10-09
6.5
None Remote Low ??? Partial Partial Partial
Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizations. A remote authenticated user can gain additional privileges by inviting themselves to spaces that they should not have access to.
4828 CVE-2019-11279 2019-09-26 2020-10-05
6.5
None Remote Low ??? Partial Partial Partial
CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls.
4829 CVE-2019-11278 +Priv +Info 2019-09-26 2020-10-05
6.5
None Remote Low ??? Partial Partial Partial
CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft a SCIM query, which leaks information that allows an escalation of privileges, ultimately allowing the malicious user to gain control of UAA scopes they should not have.
4830 CVE-2019-11248 862 DoS +Info 2019-08-29 2020-10-05
6.4
None Remote Low Not required Partial None Partial
The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.
4831 CVE-2019-11247 863 2019-08-29 2020-10-02
6.5
None Remote Low ??? Partial Partial Partial
The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.
4832 CVE-2019-11229 Exec Code 2019-04-15 2021-02-04
6.5
None Remote Low ??? Partial Partial Partial
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.
4833 CVE-2019-11224 78 2019-05-15 2019-05-16
6.5
None Remote Low ??? Partial Partial Partial
HARMAN AMX MVP5150 v2.87.13 devices allow remote OS Command Injection.
4834 CVE-2019-11222 119 Overflow 2019-04-15 2020-10-14
6.8
None Remote Medium Not required Partial Partial Partial
gf_bin128_parse in utils/os_divers.c in GPAC 0.7.1 has a buffer overflow issue for the crypt feature when encountering a crafted_drm_file.xml file.
4835 CVE-2019-11221 119 Overflow 2019-04-15 2019-05-10
6.8
None Remote Medium Not required Partial Partial Partial
GPAC 0.7.1 has a buffer overflow issue in gf_import_message() in media_import.c.
4836 CVE-2019-11219 310 2019-04-26 2019-05-02
6.4
None Remote Low Not required Partial Partial None
The algorithm used to generate device IDs (UIDs) for devices that utilize Shenzhen Yunni Technology iLnkP2P suffers from a predictability flaw that allows remote attackers to establish direct connections to arbitrary devices.
4837 CVE-2019-11218 19 +Priv 2019-04-24 2019-05-01
6.5
None Remote Low ??? Partial Partial Partial
Improper handling of extra parameters in the AccountController (User Profile edit) in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows authenticated users to gain application administrator privileges via additional form parameter submissions.
4838 CVE-2019-11215 79 Exec Code XSS 2020-02-14 2020-08-24
6.8
None Remote Medium Not required Partial Partial Partial
In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling ajax.dataloader with a maliciously crafted payload. Many conditions can place the configuration file into a writable state: during installation; during upgrade; in certain cases, an error during modification of the file from the web interface leaves the file writable (can be triggered with XSS); a race condition can be triggered by the hub-connector module (community version only from 2.4.1 to 2.6.0); or editing the file in a CLI.
4839 CVE-2019-11213 384 2019-04-12 2020-04-29
6.8
None Remote Medium Not required Partial Partial Partial
In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end user, a related issue to CVE-2019-1573. (The endpoint would need to be already compromised for exploitation to succeed.) This affects Pulse Desktop Client 5.x before Secure Desktop 5.3R7 and Pulse Desktop Client 9.x before Secure Desktop 9.0R3. It also affects (for Network Connect customers) Pulse Connect Secure 8.1 before 8.1R14, 8.3 before 8.3R7, and 9.0 before 9.0R3.
4840 CVE-2019-11209 2019-08-20 2020-08-24
6.5
None Remote Low ??? Partial Partial Partial
The realm configuration component of TIBCO Software Inc.'s TIBCO FTL Community Edition, TIBCO FTL Developer Edition, TIBCO FTL Enterprise Edition contains a vulnerability that theoretically fails to properly enforce access controls. This issue affects TIBCO FTL Community Edition 6.0.0; 6.0.1; 6.1.0, TIBCO FTL Developer Edition 6.0.1; 6.1.0, and TIBCO FTL Enterprise Edition 6.0.0; 6.0.1; 6.1.0.
4841 CVE-2019-11208 2019-08-08 2020-08-24
6.5
None Remote Low ??? Partial Partial Partial
The authorization component of TIBCO Software Inc.'s TIBCO API Exchange Gateway, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically processes OAuth authorization incorrectly, leading to potential escalation of privileges for the specific customer endpoint, when the implementation uses multiple scopes. This issue affects: TIBCO Software Inc.'s TIBCO API Exchange Gateway version 2.3.1 and prior versions, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric version 2.3.1 and prior versions.
4842 CVE-2019-11207 352 XSS CSRF 2019-08-13 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
The web server component of TIBCO Software Inc.'s TIBCO LogLogic Enterprise Virtual Appliance, and TIBCO LogLogic Log Management Intelligence contains multiple vulnerabilities that theoretically allow persistent and reflected cross-site scripting (XSS) attacks, as well as cross-site request forgery (CSRF) attacks. This issue affects: TIBCO Software Inc. TIBCO LogLogic Enterprise Virtual Appliance version 6.2.1 and prior versions. TIBCO Software Inc. TIBCO LogLogic Log Management Intelligence 6.2.1. TIBCO LogLogic LX825 Appliance 0.0.004, TIBCO LogLogic LX1025 Appliance 0.0.004, TIBCO LogLogic LX4025 Appliance 0.0.004, TIBCO LogLogic MX3025 Appliance 0.0.004, TIBCO LogLogic MX4025 Appliance 0.0.004, TIBCO LogLogic ST1025 Appliance 0.0.004, TIBCO LogLogic ST2025-SAN Appliance 0.0.004, and TIBCO LogLogic ST4025 Appliance 0.0.004 using TIBCO LogLogic Log Management Intelligence versions 6.2.1 and below. TIBCO LogLogic LX1035 Appliance 0.0.005, TIBCO LogLogic LX1025R1 Appliance 0.0.004, TIBCO LogLogic LX1025R2 Appliance 0.0.004, TIBCO LogLogic LX4025R1 Appliance 0.0.004, TIBCO LogLogic LX4025R2 Appliance 0.0.004, TIBCO LogLogic LX4035 Appliance 0.0.005, TIBCO LogLogic ST2025-SANR1 Appliance 0.0.004, TIBCO LogLogic ST2025-SANR2 Appliance 0.0.004, TIBCO LogLogic ST2035-SAN Appliance 0.0.005, TIBCO LogLogic ST4025R1 Appliance 0.0.004, TIBCO LogLogic ST4025R2 Appliance 0.0.004, and TIBCO LogLogic ST4035 Appliance 0.0.005 using TIBCO LogLogic Log Management Intelligence versions 6.2.1 and below.
4843 CVE-2019-11200 2019-07-29 2020-08-24
6.5
None Remote Low ??? Partial Partial Partial
Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient checks on the export parameters to mysqldump, which can lead to execution of arbitrary binaries on the server. (Malicious binaries can be uploaded by abusing other functionalities of the application.)
4844 CVE-2019-11193 352 XSS Bypass CSRF 2019-04-30 2020-08-24
6.8
None Remote Medium Not required Partial Partial Partial
The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER; an attacker can bypass the CSRF protection with this, and take over the administration panel.
4845 CVE-2019-11168 613 DoS 2019-11-14 2019-11-19
6.4
None Remote Low Not required Partial None Partial
Insufficient session validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure and/or denial of service via network access.
4846 CVE-2019-11132 79 XSS 2019-12-18 2019-12-31
6.8
None Remote Medium Not required Partial Partial Partial
Cross site scripting in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow a privileged user to potentially enable escalation of privilege via network access.
4847 CVE-2019-11082 22 Dir. Trav. 2019-05-10 2019-05-10
6.4
None Remote Low Not required None Partial Partial
core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in the overwrite of local files with the contents of an archive.
4848 CVE-2019-11078 352 CSRF 2019-04-11 2019-04-11
6.8
None Remote Medium Not required Partial Partial Partial
MKCMS V5.0 has a CSRF vulnerability to add a new admin user via the ucenter/userinfo.php URI.
4849 CVE-2019-11077 352 CSRF 2019-04-11 2019-10-15
6.8
None Remote Medium Not required Partial Partial Partial
FastAdmin V1.0.0.20190111_beta has a CSRF vulnerability to add a new admin user via the admin/auth/admin/add?dialog=1 URI.
4850 CVE-2019-11071 20 Exec Code 2019-04-10 2020-09-28
6.5
None Remote Low ??? Partial Partial Partial
SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.