CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-20

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-1020018 20 2019-07-29 2019-10-09
7.5
 None Remote Low Not required Partial Partial Partial
Discourse before 2.3.0 and 2.4.x before 2.4.0.beta3 lacks a confirmation screen when logging in via an email link.
2 CVE-2019-1020015 20 2019-07-29 2019-08-05
5.0
 None Remote Low Not required None Partial None
graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.
3 CVE-2019-1020011 20 2019-07-29 2019-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SmokeDetector intentionally does automatic deployments of updated copies of SmokeDetector without server operator authority.
4 CVE-2019-1010293 20 Mem. Corr. 2019-07-15 2019-07-16
7.5
 None Remote Low Not required Partial Partial Partial
Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Boundary crossing. The impact is: Memory corruption of the TEE itself. The component is: optee_os. The fixed version is: 3.4.0 and later.
5 CVE-2019-1010252 20 2019-07-18 2019-07-29
5.5
 None Remote Low Single system None Partial Partial
The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: applyFlowRules() and apply() functions in FlowRuleManager.java. The attack vector is: network management and connectivity.
6 CVE-2019-1010251 20 DoS Bypass 2019-07-18 2019-07-23
5.0
 None Remote Low Not required None None Partial
Open Information Security Foundation Suricata prior to version 4.1.2 is affected by: Denial of Service - DNS detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed network packet. The component is: app-layer-detect-proto.c, decode.c, decode-teredo.c and decode-ipv6.c (https://github.com/OISF/suricata/pull/3590/commits/11f3659f64a4e42e90cb3c09fcef66894205aefe, https://github.com/OISF/suricata/pull/3590/commits/8357ef3f8ffc7d99ef6571350724160de356158b). The attack vector is: An attacker can trigger the vulnerability by sending a specifically crafted network request. The fixed version is: 4.1.2.
7 CVE-2019-1010250 20 2019-07-18 2019-07-25
5.5
 None Remote Low Single system None Partial Partial
The Linux Foundation ONOS 2.0.0 and earlier is affected by: Poor Input-validation. The impact is: A network administrator (or attacker) can install unintended flow rules in the switch by mistake. The component is: createFlow() and createFlows() functions in FlowWebResource.java (RESTful service). The attack vector is: network management and connectivity.
8 CVE-2019-1010245 20 Exec Code 2019-07-19 2019-07-25
7.5
 None Remote Low Not required Partial Partial Partial
The Linux Foundation ONOS SDN Controller 1.15 and earlier versions is affected by: Improper Input Validation. The impact is: A remote attacker can execute arbitrary commands on the controller. The component is: apps/yang/src/main/java/org/onosproject/yang/impl/YangLiveCompilerManager.java. The attack vector is: network connectivity. The fixed version is: 1.15.
9 CVE-2019-1010234 20 Exec Code 2019-07-22 2019-07-25
7.5
 None Remote Low Not required Partial Partial Partial
The Linux Foundation ONOS 1.15.0 and ealier is affected by: Improper Input Validation. The impact is: The attacker can remotely execute any commands by sending malicious http request to the controller. The component is: Method runJavaCompiler in YangLiveCompilerManager.java. The attack vector is: network connectivity.
10 CVE-2019-1010173 20 DoS 2019-07-23 2019-07-23
5.0
 None Remote Low Not required None None Partial
Jsish 2.4.84 2.0484 is affected by: Reachable Assertion. The impact is: denial of service. The component is: function Jsi_ValueArrayIndex (jsiValue.c:366). The attack vector is: executing crafted javascript code. The fixed version is: after commit 738ead193aff380a7e3d7ffb8e11e446f76867f3.
11 CVE-2019-1010152 20 Exec Code 2019-07-23 2019-07-24
7.5
 None Remote Low Not required Partial Partial Partial
zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/manage.php line 31-80.
12 CVE-2019-1010150 20 Exec Code 2019-07-23 2019-07-26
7.5
 None Remote Low Not required Partial Partial Partial
zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/zssave.php.
13 CVE-2019-1010149 20 Exec Code 2019-07-23 2019-07-26
7.5
 None Remote Low Not required Partial Partial Partial
zzcms version 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: zzcms File Delete to Code Execution. The component is: user/licence_save.php.
14 CVE-2019-1003011 20 DoS 2019-02-06 2019-10-09
5.5
 None Remote Low Single system Partial None Partial
An information exposure and denial of service vulnerability exists in Jenkins Token Macro Plugin 2.5 and earlier in src/main/java/org/jenkinsci/plugins/tokenmacro/Parser.java, src/main/java/org/jenkinsci/plugins/tokenmacro/TokenMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/AbstractChangesSinceMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ChangesSinceLastBuildMacro.java, src/main/java/org/jenkinsci/plugins/tokenmacro/impl/ProjectUrlMacro.java that allows attackers with the ability to control token macro input (such as SCM changelogs) to define recursive input that results in unexpected macro evaluation.
15 CVE-2019-1000012 20 Exec Code 2019-02-04 2019-04-01
6.8
 None Remote Medium Not required Partial Partial Partial
Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.19.
16 CVE-2019-17507 20 2019-10-11 2019-10-15
5.0
 None Remote Low Not required Partial None None
An issue was discovered on D-Link DIR-816 A1 1.06 devices. An attacker could access management pages of the router via a client that ignores the 'top.location.href = "/dir_login.asp"' line in a .asp file. This provides access to d_status.asp, version.asp, d_dhcptbl.asp, and d_acl.asp.
17 CVE-2019-17370 20 Exec Code 2019-10-09 2019-10-11
6.5
 None Remote Low Single system Partial Partial Partial
OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFile_deal.php blocks "into outfile" in a SELECT statement, but does not block the "into/**/outfile" manipulation. Therefore, the attacker can create a .php file.
18 CVE-2019-17348 20 DoS 2019-10-07 2019-10-11
4.9
 None Local Low Not required None None Complete
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service because of an incompatibility between Process Context Identifiers (PCID) and shadow-pagetable switching.
19 CVE-2019-17347 20 DoS +Priv 2019-10-07 2019-10-10
4.6
 None Local Low Not required Partial Partial Partial
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because a guest can manipulate its virtualised %cr4 in a way that is incompatible with Linux (and possibly other guest kernels).
20 CVE-2019-17346 20 DoS +Priv 2019-10-07 2019-10-10
7.2
 None Local Low Not required Complete Complete Complete
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because of an incompatibility between Process Context Identifiers (PCID) and TLB flushes.
21 CVE-2019-17345 20 DoS 2019-10-07 2019-10-10
4.9
 None Local Low Not required None None Complete
An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed guest.
22 CVE-2019-17344 20 DoS 2019-10-07 2019-10-11
4.9
 None Local Low Not required None None Complete
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service by leveraging a long-running operation that exists to support restartability of PTE updates.
23 CVE-2019-17343 20 DoS +Priv 2019-10-07 2019-10-10
4.6
 None Local Low Not required Partial Partial Partial
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging incorrect use of the HVM physmap concept for PV domains.
24 CVE-2019-17340 20 DoS +Priv 2019-10-07 2019-10-10
6.1
 None Local Low Not required Partial Partial Complete
An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or gain privileges because grant-table transfer requests are mishandled.
25 CVE-2019-17317 20 2019-10-07 2019-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user.
26 CVE-2019-17316 20 2019-10-07 2019-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user.
27 CVE-2019-17315 20 2019-10-07 2019-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user.
28 CVE-2019-17310 20 2019-10-07 2019-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user.
29 CVE-2019-17309 20 2019-10-07 2019-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user.
30 CVE-2019-17308 20 2019-10-07 2019-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user.
31 CVE-2019-17307 20 2019-10-07 2019-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user.
32 CVE-2019-17306 20 2019-10-07 2019-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user.
33 CVE-2019-17305 20 2019-10-07 2019-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user.
34 CVE-2019-17304 20 2019-10-07 2019-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by an Admin user.
35 CVE-2019-17303 20 2019-10-07 2019-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Developer user.
36 CVE-2019-17302 20 2019-10-07 2019-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by a Developer user.
37 CVE-2019-17301 20 2019-10-07 2019-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by an Admin user.
38 CVE-2019-17300 20 2019-10-07 2019-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by a Developer user.
39 CVE-2019-17299 20 2019-10-07 2019-10-09
6.5
 None Remote Low Single system Partial Partial Partial
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by an Admin user.
40 CVE-2019-17267 20 2019-10-06 2019-10-10
7.5
 None Remote Low Not required Partial Partial Partial
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.
41 CVE-2019-17232 20 2019-10-07 2019-10-09
5.0
 None Remote Low Not required None Partial None
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.
42 CVE-2019-17192 20 DoS 2019-10-04 2019-10-10
7.5
 None Remote Low Not required Partial Partial Partial
** DISPUTED ** The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call, which might make it easier for remote attackers to cause a denial of service or possibly have unspecified other impact via malformed packets. NOTE: the vendor plans to continue this behavior for performance reasons unless a WebRTC design change occurs.
43 CVE-2019-17191 20 2019-10-04 2019-10-11
5.0
 None Remote Low Not required Partial None None
The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message. The existence of the call is noticeable to the callee; however, the audio channel may be open before the callee can block eavesdropping.
44 CVE-2019-17132 20 2019-10-04 2019-10-11
6.8
 None Remote Medium Not required Partial Partial Partial
vBulletin through 5.5.4 mishandles custom avatars.
45 CVE-2019-17069 20 DoS 2019-10-01 2019-10-08
5.0
 None Remote Low Not required None None Partial
PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.
46 CVE-2019-17063 20 2019-10-01 2019-10-08
4.3
 None Remote Medium Not required None None Partial
In Snowtide PDFxStream before 3.7.1 (for Java), a crafted PDF file can trigger an extremely long running computation because of page-tree mishandling.
47 CVE-2019-17055 20 2019-10-01 2019-10-08
2.1
 None Local Low Not required None Partial None
base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-b91ee4aa2a21.
48 CVE-2019-17051 20 Exec Code 2019-09-30 2019-10-04
6.8
 None Remote Medium Not required Partial Partial Partial
Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attachment files, as demonstrated by a one-click attack involving a drag-and-drop operation on a crafted Terminal file.
49 CVE-2019-16943 20 2019-10-01 2019-10-11
7.5
 None Remote Low Not required Partial Partial Partial
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
50 CVE-2019-16942 20 2019-10-01 2019-10-08
7.5
 None Remote Low Not required Partial Partial Partial
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.