| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-21020 | Hig | 0.49 | 7.5 | 0.02 | Oct 8, 2019 | In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place. | ||
| CVE-2019-17262 | Hig | 0.51 | 7.8 | 0.00 | Oct 8, 2019 | XnView Classic 2.49.1 allows a User Mode Write AV starting at Xwsq+0x0000000000001fc0. | ||
| CVE-2019-17261 | Hig | 0.51 | 7.8 | 0.00 | Oct 8, 2019 | XnView Classic 2.49.1 allows a User Mode Write AV starting at Xwsq+0x0000000000001e51. | ||
| CVE-2019-17260 | Hig | 0.51 | 7.8 | 0.00 | Oct 8, 2019 | MPC-HC through 1.7.13 allows a Read Access Violation on a Block Data Move starting at mpc_hc!memcpy+0x000000000000004e. | ||
| CVE-2019-17259 | Hig | 0.51 | 7.8 | 0.00 | Oct 8, 2019 | KMPlayer 4.2.2.31 allows a User Mode Write AV starting at utils!src_new+0x000000000014d6ee. | ||
| CVE-2019-17258 | Hig | 0.51 | 7.8 | 0.02 | Oct 8, 2019 | IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at JPEG_LS+0x000000000000839c. | ||
| CVE-2019-17257 | Med | 0.36 | 5.5 | 0.01 | Oct 8, 2019 | IrfanView 4.53 allows a Exception Handler Chain to be Corrupted starting at EXR!ReadEXR+0x000000000002af80. | ||
| CVE-2019-17256 | Hig | 0.51 | 7.8 | 0.01 | Oct 8, 2019 | IrfanView 4.53 allows a User Mode Write AV starting at DPX!ReadDPX_W+0x0000000000001203. | ||
| CVE-2019-17255 | Hig | 0.51 | 7.8 | 0.01 | Oct 8, 2019 | IrfanView 4.53 allows a User Mode Write AV starting at EXR!ReadEXR+0x0000000000010836. | ||
| CVE-2019-17254 | Hig | 0.51 | 7.8 | 0.02 | Oct 8, 2019 | IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at FORMATS!Read_BadPNG+0x0000000000000101. | ||
| CVE-2019-17253 | Hig | 0.51 | 7.8 | 0.01 | Oct 8, 2019 | IrfanView 4.53 allows a User Mode Write AV starting at JPEG_LS+0x000000000000a6b8. | ||
| CVE-2019-17252 | Hig | 0.51 | 7.8 | 0.03 | Oct 8, 2019 | IrfanView 4.53 allows a User Mode Write AV starting at FORMATS!Read_BadPNG+0x0000000000000115. | ||
| CVE-2019-17251 | Hig | 0.51 | 7.8 | 0.01 | Oct 8, 2019 | IrfanView 4.53 allows a User Mode Write AV starting at FORMATS!GetPlugInInfo+0x0000000000007d43. | ||
| CVE-2019-17250 | Hig | 0.51 | 7.8 | 0.02 | Oct 8, 2019 | IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x00000000000042f5. | ||
| CVE-2019-17249 | Hig | 0.51 | 7.8 | 0.02 | Oct 8, 2019 | IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000d57b. | ||
| CVE-2019-17248 | Hig | 0.51 | 7.8 | 0.02 | Oct 8, 2019 | IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x00000000000025b6. | ||
| CVE-2019-17247 | Hig | 0.51 | 7.8 | 0.02 | Oct 8, 2019 | IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at JPEG_LS+0x0000000000007da8. | ||
| CVE-2019-17246 | Hig | 0.51 | 7.8 | 0.02 | Oct 8, 2019 | IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000258c. | ||
| CVE-2019-17245 | Hig | 0.51 | 7.8 | 0.01 | Oct 8, 2019 | IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x0000000000004359. | ||
| CVE-2019-17244 | Hig | 0.51 | 7.8 | 0.02 | Oct 8, 2019 | IrfanView 4.53 allows Data from a Faulting Address to control Code Flow starting at JPEG_LS+0x0000000000001d8a. | ||
| CVE-2019-17243 | Hig | 0.51 | 7.8 | 0.02 | Oct 8, 2019 | IrfanView 4.53 allows Data from a Faulting Address to control Code Flow starting at JPEG_LS+0x0000000000003155. | ||
| CVE-2019-17242 | Hig | 0.51 | 7.8 | 0.01 | Oct 8, 2019 | IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000966f. | ||
| CVE-2019-17241 | Hig | 0.51 | 7.8 | 0.01 | Oct 8, 2019 | IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000d563. | ||
| CVE-2019-17349 | Med | 0.36 | 5.5 | 0.00 | Oct 8, 2019 | An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a LoadExcl or StoreExcl operation. | ||
| CVE-2019-17348 | Med | 0.42 | 6.5 | 0.00 | Oct 8, 2019 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service because of an incompatibility between Process Context Identifiers (PCID) and shadow-pagetable switching. | ||
| CVE-2019-17347 | Hig | 0.51 | 7.8 | 0.00 | Oct 8, 2019 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because a guest can manipulate its virtualised %cr4 in a way that is incompatible with Linux (and possibly other guest kernels). | ||
| CVE-2019-17346 | Hig | 0.57 | 8.8 | 0.00 | Oct 8, 2019 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because of an incompatibility between Process Context Identifiers (PCID) and TLB flushes. | ||
| CVE-2019-17345 | Med | 0.42 | 6.5 | 0.00 | Oct 8, 2019 | An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed guest. | ||
| CVE-2019-17344 | Med | 0.42 | 6.5 | 0.00 | Oct 8, 2019 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service by leveraging a long-running operation that exists to support restartability of PTE updates. | ||
| CVE-2019-17343 | Med | 0.44 | 6.8 | 0.00 | Oct 8, 2019 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging incorrect use of the HVM physmap concept for PV domains. | ||
| CVE-2019-17342 | Hig | 0.46 | 7.0 | 0.00 | Oct 8, 2019 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a race condition that arose when XENMEM_exchange was introduced. | ||
| CVE-2019-17341 | Hig | 0.51 | 7.8 | 0.00 | Oct 8, 2019 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a page-writability race condition during addition of a passed-through PCI device. | ||
| CVE-2019-17340 | Hig | 0.57 | 8.8 | 0.00 | Oct 8, 2019 | An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or gain privileges because grant-table transfer requests are mishandled. | ||
| CVE-2019-17351 | Med | 0.42 | 6.5 | 0.00 | Oct 8, 2019 | An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of service because of unrestricted resource consumption during the mapping of guest memory, aka CID-6ef36ab967c7. | ||
| CVE-2019-17350 | Med | 0.36 | 5.5 | 0.00 | Oct 8, 2019 | An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a compare-and-exchange operation. | ||
| CVE-2019-17233 | Med | 0.40 | 6.1 | 0.02 | Oct 7, 2019 | Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. | ||
| CVE-2019-17232 | Hig | 0.49 | 7.5 | 0.04 | Oct 7, 2019 | Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import. | ||
| CVE-2019-17239 | Med | 0.40 | 6.1 | 0.01 | Oct 7, 2019 | includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues. | ||
| CVE-2019-16913 | Hig | 0.51 | 7.8 | 0.00 | Oct 7, 2019 | PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILES(X86)%\PCProtect with very weak folder permissions, granting any user full permission "Everyone: (F)" to the contents of the directory and its subfolders. In addition, the program installs a service called… | ||
| CVE-2019-13120 | Hig | 0.49 | 7.5 | 0.01 | Oct 7, 2019 | Amazon FreeRTOS up to and including v1.4.8 lacks length checking in prvProcessReceivedPublish, resulting in untargetable leakage of arbitrary memory contents on a device to an attacker. If an attacker has the authorization to send a malformed MQTT publish packet to an Amazon IoT… | ||
| CVE-2019-3745 | Hig | 0.47 | 7.3 | 0.00 | Oct 7, 2019 | The vulnerability is limited to the installers of Dell Encryption Enterprise versions prior to 10.4.0 and Dell Endpoint Security Suite Enterprise versions prior to 2.4.0. This issue is exploitable only during the installation of the product by an administrator. A local… | ||
| CVE-2019-17314 | Hig | 0.47 | 7.2 | 0.02 | Oct 7, 2019 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user. | ||
| CVE-2019-17313 | Hig | 0.57 | 8.8 | 0.02 | Oct 7, 2019 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user. | ||
| CVE-2019-17312 | Hig | 0.57 | 8.8 | 0.02 | Oct 7, 2019 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user. | ||
| CVE-2019-17311 | Hig | 0.57 | 8.8 | 0.02 | Oct 7, 2019 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user. | ||
| CVE-2019-17310 | Hig | 0.47 | 7.2 | 0.01 | Oct 7, 2019 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user. | ||
| CVE-2019-17309 | Hig | 0.47 | 7.2 | 0.01 | Oct 7, 2019 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user. | ||
| CVE-2019-17308 | Hig | 0.57 | 8.8 | 0.01 | Oct 7, 2019 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user. | ||
| CVE-2019-17307 | Hig | 0.47 | 7.2 | 0.01 | Oct 7, 2019 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user. | ||
| CVE-2019-17306 | Hig | 0.47 | 7.2 | 0.01 | Oct 7, 2019 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user. |
- risk 0.49cvss 7.5epss 0.02
In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place.
- risk 0.51cvss 7.8epss 0.00
XnView Classic 2.49.1 allows a User Mode Write AV starting at Xwsq+0x0000000000001fc0.
- risk 0.51cvss 7.8epss 0.00
XnView Classic 2.49.1 allows a User Mode Write AV starting at Xwsq+0x0000000000001e51.
- risk 0.51cvss 7.8epss 0.00
MPC-HC through 1.7.13 allows a Read Access Violation on a Block Data Move starting at mpc_hc!memcpy+0x000000000000004e.
- risk 0.51cvss 7.8epss 0.00
KMPlayer 4.2.2.31 allows a User Mode Write AV starting at utils!src_new+0x000000000014d6ee.
- risk 0.51cvss 7.8epss 0.02
IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at JPEG_LS+0x000000000000839c.
- risk 0.36cvss 5.5epss 0.01
IrfanView 4.53 allows a Exception Handler Chain to be Corrupted starting at EXR!ReadEXR+0x000000000002af80.
- risk 0.51cvss 7.8epss 0.01
IrfanView 4.53 allows a User Mode Write AV starting at DPX!ReadDPX_W+0x0000000000001203.
- risk 0.51cvss 7.8epss 0.01
IrfanView 4.53 allows a User Mode Write AV starting at EXR!ReadEXR+0x0000000000010836.
- risk 0.51cvss 7.8epss 0.02
IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at FORMATS!Read_BadPNG+0x0000000000000101.
- risk 0.51cvss 7.8epss 0.01
IrfanView 4.53 allows a User Mode Write AV starting at JPEG_LS+0x000000000000a6b8.
- risk 0.51cvss 7.8epss 0.03
IrfanView 4.53 allows a User Mode Write AV starting at FORMATS!Read_BadPNG+0x0000000000000115.
- risk 0.51cvss 7.8epss 0.01
IrfanView 4.53 allows a User Mode Write AV starting at FORMATS!GetPlugInInfo+0x0000000000007d43.
- risk 0.51cvss 7.8epss 0.02
IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x00000000000042f5.
- risk 0.51cvss 7.8epss 0.02
IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000d57b.
- risk 0.51cvss 7.8epss 0.02
IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x00000000000025b6.
- risk 0.51cvss 7.8epss 0.02
IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at JPEG_LS+0x0000000000007da8.
- risk 0.51cvss 7.8epss 0.02
IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000258c.
- risk 0.51cvss 7.8epss 0.01
IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x0000000000004359.
- risk 0.51cvss 7.8epss 0.02
IrfanView 4.53 allows Data from a Faulting Address to control Code Flow starting at JPEG_LS+0x0000000000001d8a.
- risk 0.51cvss 7.8epss 0.02
IrfanView 4.53 allows Data from a Faulting Address to control Code Flow starting at JPEG_LS+0x0000000000003155.
- risk 0.51cvss 7.8epss 0.01
IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000966f.
- risk 0.51cvss 7.8epss 0.01
IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000d563.
- risk 0.36cvss 5.5epss 0.00
An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a LoadExcl or StoreExcl operation.
- risk 0.42cvss 6.5epss 0.00
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service because of an incompatibility between Process Context Identifiers (PCID) and shadow-pagetable switching.
- risk 0.51cvss 7.8epss 0.00
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because a guest can manipulate its virtualised %cr4 in a way that is incompatible with Linux (and possibly other guest kernels).
- risk 0.57cvss 8.8epss 0.00
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because of an incompatibility between Process Context Identifiers (PCID) and TLB flushes.
- risk 0.42cvss 6.5epss 0.00
An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed guest.
- risk 0.42cvss 6.5epss 0.00
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service by leveraging a long-running operation that exists to support restartability of PTE updates.
- risk 0.44cvss 6.8epss 0.00
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging incorrect use of the HVM physmap concept for PV domains.
- risk 0.46cvss 7.0epss 0.00
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a race condition that arose when XENMEM_exchange was introduced.
- risk 0.51cvss 7.8epss 0.00
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a page-writability race condition during addition of a passed-through PCI device.
- risk 0.57cvss 8.8epss 0.00
An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or gain privileges because grant-table transfer requests are mishandled.
- risk 0.42cvss 6.5epss 0.00
An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of service because of unrestricted resource consumption during the mapping of guest memory, aka CID-6ef36ab967c7.
- risk 0.36cvss 5.5epss 0.00
An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a compare-and-exchange operation.
- risk 0.40cvss 6.1epss 0.02
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.
- risk 0.49cvss 7.5epss 0.04
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.
- risk 0.40cvss 6.1epss 0.01
includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues.
- risk 0.51cvss 7.8epss 0.00
PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILES(X86)%\PCProtect with very weak folder permissions, granting any user full permission "Everyone: (F)" to the contents of the directory and its subfolders. In addition, the program installs a service called…
- risk 0.49cvss 7.5epss 0.01
Amazon FreeRTOS up to and including v1.4.8 lacks length checking in prvProcessReceivedPublish, resulting in untargetable leakage of arbitrary memory contents on a device to an attacker. If an attacker has the authorization to send a malformed MQTT publish packet to an Amazon IoT…
- risk 0.47cvss 7.3epss 0.00
The vulnerability is limited to the installers of Dell Encryption Enterprise versions prior to 10.4.0 and Dell Endpoint Security Suite Enterprise versions prior to 2.4.0. This issue is exploitable only during the installation of the product by an administrator. A local…
- risk 0.47cvss 7.2epss 0.02
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user.
- risk 0.57cvss 8.8epss 0.02
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user.
- risk 0.57cvss 8.8epss 0.02
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user.
- risk 0.57cvss 8.8epss 0.02
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user.
- risk 0.47cvss 7.2epss 0.01
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user.
- risk 0.47cvss 7.2epss 0.01
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user.
- risk 0.57cvss 8.8epss 0.01
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user.
- risk 0.47cvss 7.2epss 0.01
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user.
- risk 0.47cvss 7.2epss 0.01
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user.