CVEs

408,247 total · page 5695 of 8,165

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2019-8011	Adobe Inc. Acrobat	Hig	0.49	7.5	0.03	Aug 20, 2019	Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could…
CVE-2019-8010	Adobe Inc. Acrobat	Hig	0.49	7.5	0.03	Aug 20, 2019	Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could…
CVE-2019-8009	Adobe Inc. Acrobat	Cri	0.64	9.8	0.04	Aug 20, 2019	Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could…
CVE-2019-8008	Adobe Inc. Acrobat	Hig	0.57	8.8	0.04	Aug 20, 2019	Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could…
CVE-2019-8007	Adobe Inc. Acrobat	Hig	0.49	7.5	0.03	Aug 20, 2019	Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could…
CVE-2019-8006	Adobe Inc. Acrobat	Cri	0.64	9.8	0.04	Aug 20, 2019	Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an untrusted pointer dereference vulnerability. Successful…
CVE-2019-8005	Adobe Inc. Acrobat	Hig	0.49	7.5	0.04	Aug 20, 2019	Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could…
CVE-2019-8004	Adobe Inc. Acrobat	Hig	0.49	7.5	0.04	Aug 20, 2019	Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could…
CVE-2019-8003	Adobe Inc. Acrobat	Cri	0.64	9.8	0.05	Aug 20, 2019	Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead…
CVE-2019-8002	Adobe Inc. Acrobat	Hig	0.49	7.5	0.04	Aug 20, 2019	Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could…
CVE-2019-7965	Adobe Inc. Acrobat	Cri	0.64	9.8	0.04	Aug 20, 2019	Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could…
CVE-2019-4482	IBM Emptoris Spend Analysis	Med	0.35	5.4	0.01	Aug 20, 2019	IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2019-4437	IBM API Connect	Med	0.35	5.3	0.01	Aug 20, 2019	IBM API Connect 2018.1 through 2018.4.1.6 may inadvertently leak sensitive details about internal servers and network via API swagger. IBM X-force ID: 162947.
CVE-2019-4424	IBM Business Automation Workflow	Hig	0.53	8.2	0.02	Aug 20, 2019	IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory…
CVE-2019-4340	IBM Security Guardium Big Data Intelligence	Hig	0.53	8.2	0.02	Aug 20, 2019	IBM Security Guardium Big Data Intelligence 4.0 (SonarG) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID:…
CVE-2019-4338	IBM Security Guardium Big Data Intelligence	Hig	0.49	7.5	0.02	Aug 20, 2019	IBM Security Guardium Big Data Intelligence 4.0 (SonarG) does not properly restrict the size or amount of resources that are requested or influenced by an actor. This weakness can be used to consume more resources than intended. IBM X-Force ID: 161417.
CVE-2019-4167	IBM StoredIQ	Med	0.42	6.5	0.00	Aug 20, 2019	IBM StoredIQ 7.6.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158700.
CVE-2019-4120	IBM Cloud Private	Med	0.35	5.4	0.01	Aug 20, 2019	IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
CVE-2019-2137	Google Android	Med	0.36	5.5	0.00	Aug 20, 2019	In the endCall() function of TelecomManager.java, there is a possible Denial of Service due to a missing permission check. This could lead to local denial of access to Emergency Services with User execution privileges needed. User interaction is not needed for exploitation.…
CVE-2019-2136	Google Android	Med	0.36	5.5	0.00	Aug 20, 2019	In Status::readFromParcel of Status.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android.…
CVE-2019-2135	Google Android	Med	0.36	5.5	0.01	Aug 20, 2019	In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android.…
CVE-2019-2134	Google Android	Hig	0.51	7.8	0.01	Aug 20, 2019	In phFriNfc_ExtnsTransceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product:…
CVE-2019-2133	Google Android	Hig	0.51	7.8	0.01	Aug 20, 2019	In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android.…
CVE-2019-2132	Google Android	Hig	0.51	7.8	0.01	Aug 20, 2019	It is possible to overlay the VPN dialog by a malicious application. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2…
CVE-2019-2131	Google Android	Hig	0.51	7.8	0.01	Aug 20, 2019	An application with overlay permission can display overlays on top of settings UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1…
CVE-2019-2130	Google Android	Cri	0.64	9.8	0.02	Aug 20, 2019	In CompilationJob::FinalizeJob of compiler.cc, there is a possible remote code execution due to type confusion. This could lead to escalation of privilege from a malicious proxy configuration with no additional execution privileges needed. User interaction is not needed for…
CVE-2019-2129	Google Android	Med	0.42	6.5	0.01	Aug 20, 2019	In extract3GPPGlobalDescriptions of TextDescriptions.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product:…
CVE-2019-2128	Google Android	Hig	0.51	7.8	0.00	Aug 20, 2019	In ACELP_4t64_fx of c4t64fx.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions:…
CVE-2019-2127	Google Android	Hig	0.51	7.8	0.00	Aug 20, 2019	In AudioInputDescriptor::setClientActive of AudioInputDescriptor.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.…
CVE-2019-2126	Google Android	Hig	0.58	8.8	0.06	Aug 20, 2019	In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android.…
CVE-2019-2125	Google Android	Hig	0.47	7.3	0.00	Aug 20, 2019	In ChangeDefaultDialerDialog.java, there is a possible escalation of privilege due to an overlay attack. This could lead to local escalation of privilege, granting privileges to a local app without the user's informed consent, with no additional privileges needed. User…
CVE-2019-2122	Google Android	Hig	0.47	7.3	0.00	Aug 20, 2019	In LockTaskController.lockKeyguardIfNeeded of the LockTaskController.java, there was a difference in the handling of the default case between the WindowManager and the Settings. This could lead to a local escalation of privilege with no additional execution privileges needed.…
CVE-2019-2121	Google Android	Hig	0.46	7.0	0.00	Aug 20, 2019	In ActivityManagerService.attachApplication of ActivityManagerService, there is a possible race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android.…
CVE-2019-2120	Google Android	Hig	0.51	7.8	0.00	Aug 20, 2019	In OatFileAssistant::GenerateOatFile of oat_file_assistant.cc, there is a possible file corruption issue due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
CVE-2019-13520	Alpha5 Smart Loader	Hig	0.51	7.8	0.03	Aug 20, 2019	Multiple buffer overflow issues have been identified in Alpha5 Smart Loader: All versions prior to 4.2. An attacker could use specially crafted project files to overflow the buffer and execute code under the privileges of the application.
CVE-2019-11924	Facebook fizz	Hig	0.49	7.5	0.02	Aug 20, 2019	A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resulting in memory exhaustion. This issue affects versions v2019.01.28.00 and above of fizz, until v2019.08.05.00.
CVE-2019-7594	Johnson Controls Metasys	Med	0.44	6.8	0.01	Aug 20, 2019	Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP).
CVE-2019-7593	Johnson Controls Metasys	Med	0.44	6.8	0.01	Aug 20, 2019	Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP).
CVE-2019-4485	IBM Emptoris Spend Analysis	Med	0.28	4.3	0.01	Aug 20, 2019	IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force…
CVE-2019-4484	IBM Emptoris Spend Analysis	Med	0.28	4.3	0.01	Aug 20, 2019	IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force…
CVE-2019-4483	IBM Emptoris Spend Analysis	Cri	0.64	9.8	0.02	Aug 20, 2019	IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the…
CVE-2019-4481	IBM Emptoris Spend Analysis	Cri	0.64	9.8	0.02	Aug 20, 2019	IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the…
CVE-2019-4460	IBM API Connect	Hig	0.49	7.5	0.03	Aug 20, 2019	IBM API Connect 5.0.0.0 through 5.0.8.6 developer portal could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID:…
CVE-2019-4433	IBM Infosphere Global Name Management	Hig	0.54	8.2	0.04	Aug 20, 2019	IBM InfoSphere Global Name Management 5.0 and 6.0 and IBM InfoSphere Identity Insight 8.1 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or…
CVE-2019-4425	IBM Business Automation Workflow	Med	0.37	5.7	0.01	Aug 20, 2019	IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive information from another user by inserting links that would be clicked on by unsuspecting users. IBM X-Force ID: 162771.
CVE-2019-4420	IBM Intelligent Operations Center	Med	0.40	6.2	0.00	Aug 20, 2019	IBM Intelligent Operations Center V5.1.0 through V5.2.0 could disclose detailed error messages, revealing sensitive information that could aid in further attacks against the system. IBM X-Force ID: 162738.
CVE-2019-4419	IBM Intelligent Operations Center	Hig	0.53	8.2	0.02	Aug 20, 2019	IBM Intelligent Operations Center V5.1.0 through V5.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162737.
CVE-2019-4402	IBM API Connect	Hig	0.49	7.5	0.02	Aug 20, 2019	IBM API Connect 2018.1 through 2018.4.1.6 developer portal could allow an unauthorized user to cause a denial of service via an unprotected API. IBM X-Force ID: 162263.
CVE-2019-4310	IBM Security Guardium Big Data Intelligence	Hig	0.49	7.5	0.02	Aug 20, 2019	IBM Security Guardium Big Data Intelligence 4.0 (SonarG) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161036.
CVE-2019-4308	IBM Emptoris Spend Analysis	Med	0.28	4.3	0.01	Aug 20, 2019	IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-Force ID: 161034.

CVE-2019-8011HigAug 20, 2019
Adobe Inc.
Acrobat
risk 0.49cvss 7.5epss 0.03
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could…
CVE-2019-8010HigAug 20, 2019
Adobe Inc.
Acrobat
risk 0.49cvss 7.5epss 0.03
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could…
CVE-2019-8009CriAug 20, 2019
Adobe Inc.
Acrobat
risk 0.64cvss 9.8epss 0.04
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could…
CVE-2019-8008HigAug 20, 2019
Adobe Inc.
Acrobat
risk 0.57cvss 8.8epss 0.04
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could…
CVE-2019-8007HigAug 20, 2019
Adobe Inc.
Acrobat
risk 0.49cvss 7.5epss 0.03
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could…
CVE-2019-8006CriAug 20, 2019
Adobe Inc.
Acrobat
risk 0.64cvss 9.8epss 0.04
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an untrusted pointer dereference vulnerability. Successful…
CVE-2019-8005HigAug 20, 2019
Adobe Inc.
Acrobat
risk 0.49cvss 7.5epss 0.04
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could…
CVE-2019-8004HigAug 20, 2019
Adobe Inc.
Acrobat
risk 0.49cvss 7.5epss 0.04
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could…
CVE-2019-8003CriAug 20, 2019
Adobe Inc.
Acrobat
risk 0.64cvss 9.8epss 0.05
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead…
CVE-2019-8002HigAug 20, 2019
Adobe Inc.
Acrobat
risk 0.49cvss 7.5epss 0.04
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation could…
CVE-2019-7965CriAug 20, 2019
Adobe Inc.
Acrobat
risk 0.64cvss 9.8epss 0.04
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could…
CVE-2019-4482MedAug 20, 2019
IBM
Emptoris Spend Analysis
risk 0.35cvss 5.4epss 0.01
IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…
CVE-2019-4437MedAug 20, 2019
IBM
API Connect
risk 0.35cvss 5.3epss 0.01
IBM API Connect 2018.1 through 2018.4.1.6 may inadvertently leak sensitive details about internal servers and network via API swagger. IBM X-force ID: 162947.
CVE-2019-4424HigAug 20, 2019
IBM
Business Automation Workflow
risk 0.53cvss 8.2epss 0.02
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, and 19.0.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory…
CVE-2019-4340HigAug 20, 2019
IBM
Security Guardium Big Data Intelligence
risk 0.53cvss 8.2epss 0.02
IBM Security Guardium Big Data Intelligence 4.0 (SonarG) is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID:…
CVE-2019-4338HigAug 20, 2019
IBM
Security Guardium Big Data Intelligence
risk 0.49cvss 7.5epss 0.02
IBM Security Guardium Big Data Intelligence 4.0 (SonarG) does not properly restrict the size or amount of resources that are requested or influenced by an actor. This weakness can be used to consume more resources than intended. IBM X-Force ID: 161417.
CVE-2019-4167MedAug 20, 2019
IBM
StoredIQ
risk 0.42cvss 6.5epss 0.00
IBM StoredIQ 7.6.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158700.
CVE-2019-4120MedAug 20, 2019
IBM
Cloud Private
risk 0.35cvss 5.4epss 0.01
IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
CVE-2019-2137MedAug 20, 2019
Google
Android
risk 0.36cvss 5.5epss 0.00
In the endCall() function of TelecomManager.java, there is a possible Denial of Service due to a missing permission check. This could lead to local denial of access to Emergency Services with User execution privileges needed. User interaction is not needed for exploitation.…
CVE-2019-2136MedAug 20, 2019
Google
Android
risk 0.36cvss 5.5epss 0.00
In Status::readFromParcel of Status.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android.…
CVE-2019-2135MedAug 20, 2019
Google
Android
risk 0.36cvss 5.5epss 0.01
In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android.…
CVE-2019-2134HigAug 20, 2019
Google
Android
risk 0.51cvss 7.8epss 0.01
In phFriNfc_ExtnsTransceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product:…
CVE-2019-2133HigAug 20, 2019
Google
Android
risk 0.51cvss 7.8epss 0.01
In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android.…
CVE-2019-2132HigAug 20, 2019
Google
Android
risk 0.51cvss 7.8epss 0.01
It is possible to overlay the VPN dialog by a malicious application. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2…
CVE-2019-2131HigAug 20, 2019
Google
Android
risk 0.51cvss 7.8epss 0.01
An application with overlay permission can display overlays on top of settings UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1…
CVE-2019-2130CriAug 20, 2019
Google
Android
risk 0.64cvss 9.8epss 0.02
In CompilationJob::FinalizeJob of compiler.cc, there is a possible remote code execution due to type confusion. This could lead to escalation of privilege from a malicious proxy configuration with no additional execution privileges needed. User interaction is not needed for…
CVE-2019-2129MedAug 20, 2019
Google
Android
risk 0.42cvss 6.5epss 0.01
In extract3GPPGlobalDescriptions of TextDescriptions.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product:…
CVE-2019-2128HigAug 20, 2019
Google
Android
risk 0.51cvss 7.8epss 0.00
In ACELP_4t64_fx of c4t64fx.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions:…
CVE-2019-2127HigAug 20, 2019
Google
Android
risk 0.51cvss 7.8epss 0.00
In AudioInputDescriptor::setClientActive of AudioInputDescriptor.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.…
CVE-2019-2126HigAug 20, 2019
Google
Android
risk 0.58cvss 8.8epss 0.06
In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android.…
CVE-2019-2125HigAug 20, 2019
Google
Android
risk 0.47cvss 7.3epss 0.00
In ChangeDefaultDialerDialog.java, there is a possible escalation of privilege due to an overlay attack. This could lead to local escalation of privilege, granting privileges to a local app without the user's informed consent, with no additional privileges needed. User…
CVE-2019-2122HigAug 20, 2019
Google
Android
risk 0.47cvss 7.3epss 0.00
In LockTaskController.lockKeyguardIfNeeded of the LockTaskController.java, there was a difference in the handling of the default case between the WindowManager and the Settings. This could lead to a local escalation of privilege with no additional execution privileges needed.…
CVE-2019-2121HigAug 20, 2019
Google
Android
risk 0.46cvss 7.0epss 0.00
In ActivityManagerService.attachApplication of ActivityManagerService, there is a possible race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android.…
CVE-2019-2120HigAug 20, 2019
Google
Android
risk 0.51cvss 7.8epss 0.00
In OatFileAssistant::GenerateOatFile of oat_file_assistant.cc, there is a possible file corruption issue due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
CVE-2019-13520HigAug 20, 2019
Alpha5
Smart Loader
risk 0.51cvss 7.8epss 0.03
Multiple buffer overflow issues have been identified in Alpha5 Smart Loader: All versions prior to 4.2. An attacker could use specially crafted project files to overflow the buffer and execute code under the privileges of the application.
CVE-2019-11924HigAug 20, 2019
Facebook
fizz
risk 0.49cvss 7.5epss 0.02
A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resulting in memory exhaustion. This issue affects versions v2019.01.28.00 and above of fizz, until v2019.08.05.00.
CVE-2019-7594MedAug 20, 2019
Johnson Controls
Metasys
risk 0.44cvss 6.8epss 0.01
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP).
CVE-2019-7593MedAug 20, 2019
Johnson Controls
Metasys
risk 0.44cvss 6.8epss 0.01
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP).
CVE-2019-4485MedAug 20, 2019
IBM
Emptoris Spend Analysis
risk 0.28cvss 4.3epss 0.01
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force…
CVE-2019-4484MedAug 20, 2019
IBM
Emptoris Spend Analysis
risk 0.28cvss 4.3epss 0.01
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force…
CVE-2019-4483CriAug 20, 2019
IBM
Emptoris Spend Analysis
risk 0.64cvss 9.8epss 0.02
IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the…
CVE-2019-4481CriAug 20, 2019
IBM
Emptoris Spend Analysis
risk 0.64cvss 9.8epss 0.02
IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the…
CVE-2019-4460HigAug 20, 2019
IBM
API Connect
risk 0.49cvss 7.5epss 0.03
IBM API Connect 5.0.0.0 through 5.0.8.6 developer portal could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID:…
CVE-2019-4433HigAug 20, 2019
IBM
Infosphere Global Name Management
risk 0.54cvss 8.2epss 0.04
IBM InfoSphere Global Name Management 5.0 and 6.0 and IBM InfoSphere Identity Insight 8.1 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or…
CVE-2019-4425MedAug 20, 2019
IBM
Business Automation Workflow
risk 0.37cvss 5.7epss 0.01
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive information from another user by inserting links that would be clicked on by unsuspecting users. IBM X-Force ID: 162771.
CVE-2019-4420MedAug 20, 2019
IBM
Intelligent Operations Center
risk 0.40cvss 6.2epss 0.00
IBM Intelligent Operations Center V5.1.0 through V5.2.0 could disclose detailed error messages, revealing sensitive information that could aid in further attacks against the system. IBM X-Force ID: 162738.
CVE-2019-4419HigAug 20, 2019
IBM
Intelligent Operations Center
risk 0.53cvss 8.2epss 0.02
IBM Intelligent Operations Center V5.1.0 through V5.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 162737.
CVE-2019-4402HigAug 20, 2019
IBM
API Connect
risk 0.49cvss 7.5epss 0.02
IBM API Connect 2018.1 through 2018.4.1.6 developer portal could allow an unauthorized user to cause a denial of service via an unprotected API. IBM X-Force ID: 162263.
CVE-2019-4310HigAug 20, 2019
IBM
Security Guardium Big Data Intelligence
risk 0.49cvss 7.5epss 0.02
IBM Security Guardium Big Data Intelligence 4.0 (SonarG) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161036.
CVE-2019-4308MedAug 20, 2019
IBM
Emptoris Spend Analysis
risk 0.28cvss 4.3epss 0.01
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 could allow an authenticated user to obtain sensitive information from error messages IBM X-Force ID: 161034.