The Common Vulnerabilities and Exposures (CVE) project, maintained by the MITRE Corporation, is a list of all standardized names for vulnerabilities and security exposures.
| ID | Description | Priority | Modified date | Fixed Release |
|---|---|---|---|---|
| CVE-2019-9676 | Buffer overflow vulnerability found in some Dahua IP Camera devices IPC-HFW1XXX,IPC-HDW1XXX,IPC-HFW2XXX Build before 2018/11. The vulnerability exits in the function of redirection display for serial port printing information, which can not be used by product basic functions. After an attacker logs in locally, this vulnerability can be exploited to cause device restart or arbitrary code execution. Dahua has identified the corresponding security problems in the static code auditing process, so it has gradually deleted this function, which is no longer available in the newer devices and softwares. Dahua has released versions of the affected products to fix the vulnerability. | HIGH | Jun 17, 2019 | n/a |
| CVE-2019-9675 | An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: This issue allows theoretical compromise of security, but a practical attack is usually impossible. | MEDIUM | Jun 3, 2019 | n/a |
| CVE-2019-9674 | Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. | HIGH | Feb 6, 2020 | n/a |
| CVE-2019-9673 | Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI. | MEDIUM | Jun 10, 2019 | n/a |
| CVE-2019-9670 | mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml. | High | May 30, 2019 | n/a |
| CVE-2019-9669 | The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but rather it is a set of rules hosted on vendor servers and pushed to the plugin with no versioning associated. Bypassing a WAF rule doesn\'t make a WordPress site vulnerable (speaking in terms of software vulnerabilities) | Medium | Apr 26, 2019 | n/a |
| CVE-2019-9668 | An issue was discovered in rovinbhandari FTP through 2012-03-28. receive_file in file_transfer_functions.c allows remote attackers to cause a denial of service (daemon crash) via a 0xffff datalen field value. | MEDIUM | Jan 10, 2020 | n/a |
| CVE-2019-9662 | An issue was discovered in JTBC(PHP) 3.0.1.8. Its cache management module is flawed. An arbitrary file ending in \"inc.php\" can be deleted via a console/cache/manage.php?type=action&action=batch&batch=delete&ids=../ substring. | MEDIUM | Mar 20, 2019 | n/a |
| CVE-2019-9661 | Stored XSS exists in YzmCMS 5.2 via the admin/system_manage/user_config_edit.html \"value\" parameter, | LOW | Mar 20, 2019 | n/a |
| CVE-2019-9660 | Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html \"catname\" parameter. | LOW | Mar 20, 2019 | n/a |
| CVE-2019-9659 | The Chuango 433 MHz burglar-alarm product line uses static codes in the RF remote control, allowing an attacker to arm, disarm, or trigger the alarm remotely via replay attacks, as demonstrated by Chuango branded products, and non-Chuango branded products such as the Eminent EM8617 OV2 Wifi Alarm System. | MEDIUM | Mar 20, 2019 | n/a |
| CVE-2019-9658 | Checkstyle before 8.18 loads external DTDs by default. | MEDIUM | Mar 22, 2019 | n/a |
| CVE-2019-9657 | Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control, a different issue than CVE-2018-19588. This occurs because of incorrect protection of VPN certificates (used for initiating a VPN session to the Alarm.com infrastructure) on the local camera device. | MEDIUM | Jul 18, 2019 | n/a |
| CVE-2019-9656 | An issue was discovered in LibOFX 0.9.14. There is a NULL pointer dereference in the function OFXApplication::startElement in the file lib/ofx_sgml.cpp, as demonstrated by ofxdump. | MEDIUM | Mar 20, 2019 | n/a |
| CVE-2019-9653 | NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands via shell metacharacters to handle_load_config.php. | HIGH | Jun 3, 2019 | n/a |
| CVE-2019-9652 | There is a CSRF in SDCMS V1.7 via an m=admin&c=theme&a=edit request. It allows PHP code injection by providing a filename in the file parameter, and providing file content in the t2 parameter. | MEDIUM | Mar 20, 2019 | n/a |
| CVE-2019-9651 | An issue was discovered in SDCMS V1.7. In the \\app\\admin\\controller\\themecontroller.php file, the check_bad() function\'s filtering is not strict, resulting in PHP code execution. This occurs because some dangerous PHP functions (such as \"eval\") are blocked but others (such as \"system\") are not, and because \".php\" is blocked but \".PHP\" is not blocked. | HIGH | Mar 20, 2019 | n/a |
| CVE-2019-9650 | An XSS issue was discovered in upcoming_events.php in the Upcoming Events plugin before 1.33 for MyBB via a crafted name for an event. | MEDIUM | Mar 27, 2019 | n/a |
| CVE-2019-9649 | An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal technique (..\\..\\) to browse outside the root directory to determine the existence of a file on the operating system, and its last modified date. | MEDIUM | Mar 27, 2019 | n/a |
| CVE-2019-9648 | An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \\..\\..\\ substring, allowing an attacker to enumerate file existence based on the returned information. | MEDIUM | Mar 27, 2019 | n/a |
| CVE-2019-9647 | Gila CMS 1.9.1 has XSS. | MEDIUM | Jun 6, 2019 | n/a |
| CVE-2019-9646 | The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the \"custom edition area.\" | MEDIUM | Mar 20, 2019 | n/a |
| CVE-2019-9644 | An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of error messages, though not reproduced with other browsers. This occurs because Internet Explorer\'s error messages can include the content of any invalid JavaScript that was encountered. | MEDIUM | Mar 20, 2019 | n/a |
| CVE-2019-9642 | An issue was discovered in proxy.php in pydio-core in Pydio through 8.2.2. Through an unauthenticated request, it possible to evaluate malicious PHP code by placing it on the fourth line of a .php file, as demonstrated by a PoC.php created by the guest account, with execution via a proxy.php?hash=../../../../../var/lib/pydio/data/personal/guest/PoC.php request. This is related to plugins/action.share/src/Store/ShareStore.php. | HIGH | Jun 5, 2019 | n/a |
| CVE-2019-9641 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF. | High | Mar 27, 2019 | n/a |
| CVE-2019-9640 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in exif_process_SOFn. | High | Mar 27, 2019 | n/a |
| CVE-2019-9639 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable. | High | Mar 27, 2019 | n/a |
| CVE-2019-9638 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note->offset relationship to value_len. | High | Mar 27, 2019 | n/a |
| CVE-2019-9637 | An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data. | Medium | Mar 27, 2019 | n/a |
| CVE-2019-9636 | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9. | Medium | Mar 27, 2019 | n/a |
| CVE-2019-9635 | NULL pointer dereference in Google TensorFlow before 1.12.2 could cause a denial of service via an invalid GIF file. | Medium | Apr 26, 2019 | n/a |
| CVE-2019-9634 | Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. | Medium | Mar 26, 2019 | n/a |
| CVE-2019-9633 | gio/gsocketclient.c in GNOME GLib 2.59.2 does not ensure that a parent GTask remains alive during the execution of a connection-attempting enumeration, which allows remote attackers to cause a denial of service (g_socket_client_connected_callback mishandling and application crash) via a crafted web site, as demonstrated by GNOME Web (aka Epiphany). | Medium | Mar 14, 2019 | n/a |
| CVE-2019-9632 | ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request. | MEDIUM | Mar 20, 2019 | n/a |
| CVE-2019-9631 | Poppler 0.74.0 has a heap-based buffer over-read in the CairoRescaleBox.cc downsample_row_box_filter function. | High | Mar 8, 2019 | n/a |
| CVE-2019-9630 | Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images. | MEDIUM | Jul 15, 2019 | n/a |
| CVE-2019-9629 | Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials). | HIGH | Jul 15, 2019 | n/a |
| CVE-2019-9628 | The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type. | MEDIUM | Apr 12, 2019 | n/a |
| CVE-2019-9627 | A buffer overflow in the kernel driver CybKernelTracker.sys in CyberArk Endpoint Privilege Manager versions prior to 10.7 allows an attacker (without Administrator privileges) to escalate privileges or crash the machine by loading an image, such as a DLL, with a long path. | MEDIUM | Mar 20, 2019 | n/a |
| CVE-2019-9626 | PHPSHE 1.7 allows module/index/cart.php pintuan_id SQL Injection to index.php. | HIGH | Mar 20, 2019 | n/a |
| CVE-2019-9625 | JBMC DirectAdmin 1.55 allows CSRF via the /CMD_ACCOUNT_ADMIN URI to create a new admin account. | MEDIUM | Mar 20, 2019 | n/a |
| CVE-2019-9624 | Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the Java file manager and Upload and Download privileges to upload a crafted .cgi file via the /updown/upload.cgi URI. | Medium | Mar 22, 2019 | n/a |
| CVE-2019-9623 | Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via \"<!--#exec cmd=\" in a .shtml file to ck_upload_handler.php. | HIGH | Mar 20, 2019 | n/a |
| CVE-2019-9622 | eBrigade through 4.5 allows Arbitrary File Download via ../ directory traversal in the showfile.php file parameter, as demonstrated by reading the user-data/save/backup.sql file. | MEDIUM | Mar 20, 2019 | n/a |
| CVE-2019-9621 | Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component. | MEDIUM | May 3, 2019 | n/a |
| CVE-2019-9619 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none | -- | Nov 7, 2023 | n/a |
| CVE-2019-9618 | The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the \"cfg\" parameter. | HIGH | May 17, 2019 | n/a |
| CVE-2019-9617 | An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadFile URI. | MEDIUM | Mar 20, 2019 | n/a |
| CVE-2019-9616 | An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadScrawl URI. | MEDIUM | Mar 20, 2019 | n/a |
| CVE-2019-9615 | An issue was discovered in OFCMS before 1.1.3. It allows admin/system/generate/create?sql= SQL injection, related to SystemGenerateController.java. | MEDIUM | Mar 20, 2019 | n/a |
