CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In February 2019

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
351 CVE-2019-7342 79 Exec Code XSS 2019-02-04 2019-02-05
4.3
None Remote Medium Not required None Partial None
POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filter[AutoExecuteCmd]' parameter value in the view filter (filter.php) because proper filtration is omitted.
352 CVE-2019-7341 79 Exec Code XSS 2019-02-04 2019-02-05
4.3
None Remote Medium Not required None Partial None
Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitor[LinkedMonitors]' parameter value in the view monitor (monitor.php) because proper filtration is omitted.
353 CVE-2019-7340 79 Exec Code XSS 2019-02-04 2019-02-05
4.3
None Remote Medium Not required None Partial None
POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filter[Query][terms][0][val]' parameter value in the view filter (filter.php) because proper filtration is omitted.
354 CVE-2019-7339 79 Exec Code XSS 2019-02-04 2019-02-05
4.3
None Remote Medium Not required None Partial None
POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'level' parameter value in the view log (log.php) because proper filtration is omitted.
355 CVE-2019-7338 79 Exec Code XSS 2019-02-04 2019-02-05
4.3
None Remote Medium Not required None Partial None
Self - Stored XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'group' as it insecurely prints the 'Group Name' value on the web page without applying any proper filtration.
356 CVE-2019-7337 79 XSS 2019-02-04 2019-02-05
3.5
None Remote Medium ??? None Partial None
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value, without applying any proper output filtration. This issue exists because of the function sortHeader() in functions.php, which insecurely returns the value of the limit query string parameter without applying any filtration.
357 CVE-2019-7336 79 XSS 2019-02-04 2019-02-05
4.3
None Remote Medium Not required None Partial None
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the view _monitor_filters.php contains takes in input from the user and saves it into the session, and retrieves it later (insecurely). The values of the MonitorName and Source parameters are being displayed without any output filtration being applied. This relates to the view=cycle value.
358 CVE-2019-7335 79 Exec Code XSS 2019-02-04 2019-02-05
4.3
None Remote Medium Not required None Partial None
Self - Stored XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'log' as it insecurely prints the 'Log Message' value on the web page without applying any proper filtration. This relates to the view=logs value.
359 CVE-2019-7334 79 Exec Code XSS 2019-02-04 2019-02-05
4.3
None Remote Medium Not required None Partial None
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile' parameter value in the view export (export.php) because proper filtration is omitted.
360 CVE-2019-7333 79 Exec Code XSS 2019-02-04 2019-02-05
4.3
None Remote Medium Not required None Partial None
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile' parameter value in the view download (download.php) because proper filtration is omitted.
361 CVE-2019-7332 79 Exec Code XSS 2019-02-04 2019-02-05
4.3
None Remote Medium Not required None Partial None
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'eid' (aka Event ID) parameter value in the view download (download.php) because proper filtration is omitted.
362 CVE-2019-7331 79 XSS 2019-02-04 2019-02-05
4.3
None Remote Medium Not required None Partial None
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 while editing an existing monitor field named "signal check color" (monitor.php). There exists no input validation or output filtration, leaving it vulnerable to HTML Injection and an XSS attack.
363 CVE-2019-7330 79 Exec Code XSS 2019-02-04 2019-02-05
4.3
None Remote Medium Not required None Partial None
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'show' parameter value in the view frame (frame.php) because proper filtration is omitted.
364 CVE-2019-7329 79 XSS 2019-02-04 2019-02-05
4.3
None Remote Medium Not required None Partial None
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as the form action on multiple views utilizes $_SERVER['PHP_SELF'] insecurely, mishandling any arbitrary input appended to the webroot URL, without any proper filtration, leading to XSS.
365 CVE-2019-7328 79 Exec Code XSS 2019-02-04 2019-02-05
4.3
None Remote Medium Not required None Partial None
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'scale' parameter value in the view frame (frame.php) via /js/frame.js.php because proper filtration is omitted.
366 CVE-2019-7327 79 Exec Code XSS 2019-02-04 2019-02-05
4.3
None Remote Medium Not required None Partial None
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'scale' parameter value in the view frame (frame.php) because proper filtration is omitted.
367 CVE-2019-7326 79 Exec Code XSS 2019-02-04 2019-02-04
4.3
None Remote Medium Not required None Partial None
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Host' parameter value in the view console (console.php) because proper filtration is omitted. This relates to the index.php?view=monitor Host Name field.
368 CVE-2019-7325 79 XSS 2019-02-04 2019-02-04
4.3
None Remote Medium Not required None Partial None
Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as multiple views under web/skins/classic/views insecurely utilize $_REQUEST['PHP_SELF'], without applying any proper filtration.
369 CVE-2019-7324 79 XSS 2019-02-04 2019-05-30
4.3
None Remote Medium Not required None Partial None
app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting.
370 CVE-2019-7323 345 Exec Code 2019-02-04 2020-08-24
5.1
None Remote High Not required Partial Partial Partial
GUP (generic update process) in LightySoft LogMX before 7.4.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update. The update process relies on cleartext HTTP. The attacker could replace the LogMXUpdater.class file.
371 CVE-2019-7317 416 2019-02-04 2021-10-20
2.6
None Remote High Not required None None Partial
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
372 CVE-2019-7316 89 Sql 2019-02-04 2020-10-07
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. The userid parameter in jumpin.php has a SQL injection vulnerability.
373 CVE-2019-7314 416 2019-02-04 2020-07-07
7.5
None Remote Low Not required Partial Partial Partial
liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact.
374 CVE-2019-7313 93 2019-02-03 2019-02-06
5.8
None Remote Medium Not required None Partial Partial
www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain.
375 CVE-2019-7312 200 +Info 2019-02-03 2019-02-26
5.0
None Remote Low Not required Partial None None
Limited plaintext disclosure exists in PRIMX Zed Entreprise for Windows before 6.1.2240, Zed Entreprise for Windows (ANSSI qualification submission) before 6.1.2150, Zed Entreprise for Mac before 2.0.199, Zed Entreprise for Linux before 2.0.199, Zed Pro for Windows before 1.0.195, Zed Pro for Mac before 1.0.199, Zed Pro for Linux before 1.0.199, Zed Free for Windows before 1.0.195, Zed Free for Mac before 1.0.199, and Zed Free for Linux before 1.0.199. Analyzing a Zed container can lead to the disclosure of plaintext content of very small files (a few bytes) stored into it.
376 CVE-2019-7310 125 DoS 2019-02-03 2021-07-21
6.8
None Remote Medium Not required Partial Partial Partial
In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.
377 CVE-2019-7309 2019-02-03 2020-08-24
2.1
None Local Low Not required None None Partial
In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.
378 CVE-2019-7308 189 2019-02-01 2019-09-24
4.7
None Local Medium Not required Complete None None
kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks.
379 CVE-2019-7301 78 Exec Code 2019-02-01 2020-08-24
9.0
None Remote Low ??? Complete Complete Complete
Zen Load Balancer 3.10.1 allows remote authenticated admin users to execute arbitrary commands as root via shell metacharacters in the index.cgi?action=View_Cert certname parameter.
380 CVE-2019-7300 522 Exec Code 2019-02-01 2020-08-24
9.0
None Remote Low ??? Complete Complete Complete
Artica Proxy 3.06.200056 allows remote attackers to execute arbitrary commands as root by reading the ressources/settings.inc ldap_admin and ldap_password fields, using these credentials at logon.php, and then entering the commands in the admin.index.php command-line field.
381 CVE-2019-7298 78 Exec Code 2019-02-01 2019-02-05
9.3
None Remote Medium Not required Complete Complete Complete
An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body, such as a body of ' /bin/telnetd' for the GetDeviceSettingsset API function. Consequently, an attacker can execute any command remotely when they control this input.
382 CVE-2019-7164 89 Sql 2019-02-20 2021-12-03
7.5
None Remote Low Not required Partial Partial Partial
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
383 CVE-2019-7006 327 2019-02-27 2022-01-01
2.1
None Local Low Not required Partial None None
Avaya one-X Communicator uses weak cryptographic algorithms in the client authentication component that could allow a local attacker to decrypt sensitive information. Affected versions include all 6.2.x versions prior to 6.2 SP13.
384 CVE-2019-6975 770 2019-02-11 2020-08-24
5.0
None Remote Low Not required None None Partial
Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.
385 CVE-2019-6974 362 2019-02-15 2021-07-21
6.8
None Remote Medium Not required Partial Partial Partial
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.
386 CVE-2019-6595 79 XSS 2019-02-26 2019-02-27
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in F5 BIG-IP Access Policy Manager (APM) 11.5.x and 11.6.x Admin Web UI.
387 CVE-2019-6594 835 2019-02-26 2020-08-24
4.3
None Remote Medium Not required None None Partial
On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP) does not protect against multiple zero length DATA_FINs in the reassembly queue, which can lead to an infinite loop in some circumstances.
388 CVE-2019-6593 310 2019-02-26 2021-07-21
4.3
None Remote Medium Not required Partial None None
On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited, this may result in plaintext recovery of encrypted messages through a man-in-the-middle (MITM) attack, despite the attacker not having gained access to the server's private key itself. (CVE-2019-6593 also known as Zombie POODLE and GOLDENDOODLE.)
389 CVE-2019-6592 295 2019-02-26 2019-02-28
6.4
None Remote Low Not required None Partial Partial
On BIG-IP 14.1.0-14.1.0.1, TMM may restart and produce a core file when validating SSL certificates in client SSL or server SSL profiles.
390 CVE-2019-6591 79 XSS 2019-02-05 2019-02-06
3.5
None Remote Medium ??? None Partial None
On BIG-IP APM 14.0.0 to 14.0.0.4, 13.0.0 to 13.1.1.3 and 12.1.0 to 12.1.3.7, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system.
391 CVE-2019-6590 2019-02-05 2020-08-24
7.1
None Remote Medium Not required None None Complete
On BIG-IP LTM 13.0.0 to 13.0.1 and 12.1.0 to 12.1.3.6, under certain conditions, the TMM may consume excessive resources when processing SSL Session ID Persistence traffic.
392 CVE-2019-6589 79 XSS 2019-02-14 2019-02-14
4.3
None Remote Medium Not required None Partial None
On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, and 11.6.0-11.6.3.2, a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the BIG-IP TMUI (Traffic Management User Interface) also known as the BIG-IP configuration utility.
393 CVE-2019-6555 20 Exec Code 2019-02-28 2019-10-09
6.8
None Remote Medium Not required Partial Partial Partial
Cscape, 9.80 SP4 and prior. An improper input validation vulnerability may be exploited by processing specially crafted POC files. This may allow an attacker to read confidential information and remotely execute arbitrary code.
394 CVE-2019-6551 425 Bypass 2019-02-28 2020-10-05
7.8
None Remote Low Not required None None Complete
Pangea Communications Internet FAX ATA all Versions 3.1.8 and prior allow an attacker to bypass user authentication using a specially crafted URL to cause the device to reboot, which may be used to cause a continual denial-of-service condition.
395 CVE-2019-6549 522 2019-02-12 2020-10-05
4.0
None Remote Low ??? Partial None None
An attacker could retrieve plain-text credentials stored in a XML file on PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) through FTP.
396 CVE-2019-6547 125 2019-02-28 2019-10-09
4.3
None Remote Medium Not required None None Partial
Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.84 and prior. An out-of-bounds read vulnerability may cause the software to crash due to lacking user input validation for processing project files.
397 CVE-2019-6545 99 2019-02-13 2019-10-09
10.0
None Remote Low Not required Complete Complete Complete
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. An unauthenticated remote user could use a specially crafted database connection configuration file to execute an arbitrary process on the server machine.
398 CVE-2019-6543 306 Exec Code 2019-02-13 2019-10-09
10.0
None Remote Low Not required Complete Complete Complete
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. Code is executed under the program runtime privileges, which could lead to the compromise of the machine.
399 CVE-2019-6541 787 Exec Code Mem. Corr. 2019-02-13 2020-10-05
6.8
None Remote Medium Not required Partial Partial Partial
A memory corruption vulnerability has been identified in WECON LeviStudioU version 1.8.56 and prior, which may allow arbitrary code execution. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnerabilities to NCCIC.
400 CVE-2019-6539 787 Exec Code Overflow 2019-02-13 2020-10-05
9.3
None Remote Medium Not required Complete Complete Complete
Several heap-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior have been identified, which may allow arbitrary code execution. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnerabilities to NCCIC.
Total number of vulnerabilities : 839   Page : 1 2 3 4 5 6 7 8 (This Page)9 10 11 12 13 14 15 16 17
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.