The Common Vulnerabilities and Exposures (CVE) project, maintained by the MITRE Corporation, is a list of all standardized names for vulnerabilities and security exposures.
| ID | Description | Priority | Modified date | Fixed Release |
|---|---|---|---|---|
| CVE-2019-20184 | KeePass 2.4.1 allows CSV injection in the title field of a CSV export. | MEDIUM | Jan 10, 2020 | n/a |
| CVE-2019-20183 | uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only on the client side. The attacker can modify global.js to allow the .php extension. | MEDIUM | Jan 10, 2020 | n/a |
| CVE-2019-20182 | The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter. | LOW | Jan 14, 2020 | n/a |
| CVE-2019-20181 | The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter. | LOW | Jan 14, 2020 | n/a |
| CVE-2019-20180 | The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. | MEDIUM | Jan 9, 2020 | n/a |
| CVE-2019-20179 | SOPlanning 1.45 has SQL injection via the user_list.php by parameter. | MEDIUM | Jan 15, 2020 | n/a |
| CVE-2019-20178 | Advisto PEEL Shopping 9.2.1 has CSRF via administrer/utilisateurs.php to delete a user. | MEDIUM | Jan 14, 2020 | n/a |
| CVE-2019-20176 | In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c. | MEDIUM | Jan 8, 2020 | n/a |
| CVE-2019-20175 | An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest system can crash the QEMU process in the host system via a special SCSI_IOCTL_SEND_COMMAND. It hits an assertion that implies that the size of successful DMA transfers there must be a multiple of 512 (the size of a sector). NOTE: a member of the QEMU security team disputes the significance of this issue because a privileged guest user has many ways to cause similar DoS effect, without triggering this assert. | MEDIUM | Jan 15, 2020 | 10.19.45.6 (Wind River Linux LTS 19) |
| CVE-2019-20174 | Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder. | MEDIUM | Feb 5, 2020 | n/a |
| CVE-2019-20173 | The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php. | MEDIUM | Feb 7, 2020 | n/a |
| CVE-2019-20172 | Kernel/VM/MemoryManager.cpp in SerenityOS before 2019-12-30 does not reject syscalls with pointers into the kernel-only virtual address space, which allows local users to gain privileges by overwriting a return address that was found on the kernel stack. | MEDIUM | Jan 10, 2020 | n/a |
| CVE-2019-20171 | An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There are memory leaks in metx_New in isomedia/box_code_base.c and abst_Read in isomedia/box_code_adobe.c. | MEDIUM | Jan 8, 2020 | n/a |
| CVE-2019-20170 | An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is an invalid pointer dereference in the function GF_IPMPX_AUTH_Delete() in odf/ipmpx_code.c. | MEDIUM | Jan 8, 2020 | n/a |
| CVE-2019-20169 | An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a use-after-free in the function trak_Read() in isomedia/box_code_base.c. | MEDIUM | Jan 2, 2020 | n/a |
| CVE-2019-20168 | An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a use-after-free in the function gf_isom_box_dump_ex() in isomedia/box_funcs.c. | MEDIUM | Jan 2, 2020 | n/a |
| CVE-2019-20167 | An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function senc_Parse() in isomedia/box_code_drm.c. | MEDIUM | Jan 2, 2020 | n/a |
| CVE-2019-20166 | An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function gf_isom_dump() in isomedia/box_dump.c. | MEDIUM | Jan 2, 2020 | n/a |
| CVE-2019-20165 | An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function ilst_item_Read() in isomedia/box_code_apple.c. | MEDIUM | Jan 2, 2020 | n/a |
| CVE-2019-20164 | An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function gf_isom_box_del() in isomedia/box_funcs.c. | MEDIUM | Jan 2, 2020 | n/a |
| CVE-2019-20163 | An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a NULL pointer dereference in the function gf_odf_avc_cfg_write_bs() in odf/descriptors.c. | MEDIUM | Jan 2, 2020 | n/a |
| CVE-2019-20162 | An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is heap-based buffer overflow in the function gf_isom_box_parse_ex() in isomedia/box_funcs.c. | MEDIUM | Jan 2, 2020 | n/a |
| CVE-2019-20161 | An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is heap-based buffer overflow in the function ReadGF_IPMPX_WatermarkingInit() in odf/ipmpx_code.c. | MEDIUM | Jan 2, 2020 | n/a |
| CVE-2019-20160 | An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a stack-based buffer overflow in the function av1_parse_tile_group() in media_tools/av_parsers.c. | MEDIUM | Jan 2, 2020 | n/a |
| CVE-2019-20159 | An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. There is a memory leak in dinf_New() in isomedia/box_code_base.c. | MEDIUM | Jan 8, 2020 | n/a |
| CVE-2019-20155 | An issue was discovered in report_edit.jsp in Determine (formerly Selectica) Contract Lifecycle Management (CLM) v5.4. Any authenticated user may execute Groovy code when generating a report, resulting in arbitrary code execution on the underlying server. | HIGH | Jan 10, 2020 | n/a |
| CVE-2019-20154 | An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) v5.4. A cross-site scripting (XSS) vulnerability in multiple getchart.jsp parameters allows remote attackers to inject arbitrary web script or HTML. | MEDIUM | Jan 10, 2020 | n/a |
| CVE-2019-20153 | An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) in v5.4. An XML external entity (XXE) vulnerability in the upload definition feature in definition_upload_attach.jsp allows authenticated remote attackers to read arbitrary files (including configuration files containing administrative credentials). | MEDIUM | Jan 13, 2020 | n/a |
| CVE-2019-20152 | An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input, malicious JavaScript can be executed throughout the application. A malicious payload can be injected within the Custom Workflow component and inserted via the Create New Workflow field. As a result, the payload is executed via the navigation bar throughout the application. | MEDIUM | Aug 20, 2020 | n/a |
| CVE-2019-20151 | An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input, malicious JavaScript can be executed by the application\'s administrator(s). A malicious payload can be injected within the Multi Approval security component and inserted via the Note field. As a result, the payload is executed by the application\'s administrator(s). | MEDIUM | Aug 20, 2020 | n/a |
| CVE-2019-20150 | In TreasuryXpress 19191105, a logged-in user can discover saved credentials, even though the UI hides them. Using functionality within the application and a malicious host, it is possible to force the application to expose saved SSH/SFTP credentials. This can be done by using the application\'s editor to change the expected SFTP Host IP to a malicious host, and then using the Check Connectivity option. The application then sends these saved credentials to the malicious host. | MEDIUM | Aug 20, 2020 | n/a |
| CVE-2019-20149 | ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by \'constructor\': {\'name\':\'Symbol\'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result. | MEDIUM | Jan 15, 2020 | n/a |
| CVE-2019-20148 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 8.13 through 12.6.1. It has Incorrect Access Control. | MEDIUM | Jan 17, 2020 | n/a |
| CVE-2019-20147 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 9.1 through 12.6.1. It has Incorrect Access Control. | MEDIUM | Jan 17, 2020 | n/a |
| CVE-2019-20146 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.0 through 12.6. It allows Uncontrolled Resource Consumption. | MEDIUM | Jan 17, 2020 | n/a |
| CVE-2019-20145 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.4 through 12.6.1. It has Incorrect Access Control. | MEDIUM | Jan 17, 2020 | n/a |
| CVE-2019-20144 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 10.8 through 12.6.1. It has Incorrect Access Control. | MEDIUM | Jan 13, 2020 | n/a |
| CVE-2019-20143 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.6. It has Incorrect Access Control. | MEDIUM | Jan 13, 2020 | n/a |
| CVE-2019-20142 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.3 through 12.6.1. It allows Denial of Service. | MEDIUM | Jan 13, 2020 | n/a |
| CVE-2019-20141 | An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter. | MEDIUM | Jan 3, 2020 | n/a |
| CVE-2019-20140 | An issue was discovered in libsixel 1.8.4. There is a heap-based buffer overflow in the function gif_out_code at fromgif.c. | MEDIUM | Jan 7, 2020 | n/a |
| CVE-2019-20139 | In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user. | LOW | Jan 3, 2020 | n/a |
| CVE-2019-20138 | The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium\'s crypto_pwhash_str is not used. | MEDIUM | Jan 9, 2020 | n/a |
| CVE-2019-20107 | Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req_spec_id parameter to reqSpecCompareRevisions.php; the (3) requirement_id parameter to reqCompareVersions.php; the (4) build_id parameter to planUpdateTC.php; the (5) tplan_id parameter to newest_tcversions.php; the (6) tplan_id parameter to tcCreatedPerUserGUI.php; the (7) tcase_id parameter to tcAssign2Tplan.php; or the (8) testcase_id parameter to tcCompareVersions.php. Authentication is often easy to achieve: a guest account, that can execute this attack, can be created by anyone in the default configuration. | MEDIUM | Mar 7, 2020 | n/a |
| CVE-2019-20106 | Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug. | MEDIUM | Feb 7, 2020 | n/a |
| CVE-2019-20105 | The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.1, and from version 7.1.0 before version 7.1.3 allows remote attackers who have obtained access to administrator\'s session to access the EditApplinkServlet resource without needing to re-authenticate to pass WebSudo in products that support WebSudo through an improper access control vulnerability. | MEDIUM | Mar 17, 2020 | n/a |
| CVE-2019-20104 | The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability. | MEDIUM | Feb 10, 2020 | n/a |
| CVE-2019-20102 | The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0 through version 6.14.3, and version 6.15.0 before version 6.15.5 allows remote attackers to achieve stored cross-site- scripting (SXSS) via a malicious attachment with a modified `mimeType` parameter. | MEDIUM | Apr 22, 2020 | n/a |
| CVE-2019-20101 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via a Broken Access Control vulnerability in the /rest/whitelist/<version>/check endpoint. The affected versions are before version 8.13.3, and from version 8.14.0 before 8.14.1. | MEDIUM | Sep 14, 2021 | n/a |
| CVE-2019-20100 | The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). The following versions are affected: all versions prior to 5.4.21, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.2, and from version 7.1.0 before version 7.1.3. The vulnerable plugin is used by Atlassian Jira Server and Data Center before version 8.7.0. An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerate hosts and open ports on the internal network where Jira server is present. | MEDIUM | Feb 12, 2020 | n/a |
