Vulnerabilities (CVE)

CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2019-2285 1 Qualcomm 72 Msm8909w, Msm8909w Firmware, Msm8996au and 69 more 2019-11-08 10.0 HIGH 9.8 CRITICAL
Out of bound write issue is observed while giving information about properties that have been set so far for playing video in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130
CVE-2019-2323 1 Qualcomm 82 Mdm9150, Mdm9150 Firmware, Mdm9206 and 79 more 2019-11-08 10.0 HIGH 9.8 CRITICAL
Lack of check to ensure crypto engine data passed by user is initialized can result in bus error in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVE-2019-2325 1 Qualcomm 88 Mdm9150, Mdm9150 Firmware, Mdm9206 and 85 more 2019-11-08 10.0 HIGH 9.8 CRITICAL
Out of boundary access due to token received from ADSP and is used without validation as an index into the array in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVE-2019-2324 1 Qualcomm 66 Mdm9150, Mdm9150 Firmware, Mdm9206 and 63 more 2019-11-08 10.0 HIGH 9.8 CRITICAL
When ADSP is compromised, the audio port index that`s returned from ADSP might be out of the valid range and leads to out of boundary access in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 845 / SD 850, SD 855, SDX20, SDX24
CVE-2019-10531 1 Qualcomm 26 Mdm9607, Mdm9607 Firmware, Msm8909w and 23 more 2019-11-08 10.0 HIGH 9.8 CRITICAL
Incorrect reading of system image resulting in buffer overflow when size of system image is increased in Snapdragon Auto, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SDM439
CVE-2019-10533 1 Qualcomm 78 Mdm9206, Mdm9206 Firmware, Mdm9607 and 75 more 2019-11-08 10.0 HIGH 9.8 CRITICAL
Out of bound access due to improper validation of array index cause the index table entry to get corrupt in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20
CVE-2019-10534 1 Qualcomm 78 Mdm9206, Mdm9206 Firmware, Mdm9607 and 75 more 2019-11-08 10.0 HIGH 9.8 CRITICAL
Null-pointer dereference can occur while accessing the super index entry when it is not been allocated in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20
CVE-2019-10542 1 Qualcomm 58 Mdm9150, Mdm9150 Firmware, Mdm9206 and 55 more 2019-11-08 7.5 HIGH 9.8 CRITICAL
Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t match the contents in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SDX20
CVE-2013-1666 1 Foswiki 1 Foswiki 2019-11-08 6.8 MEDIUM 9.8 CRITICAL
Foswiki before 1.1.8 contains a code injection vulnerability in the MAKETEXT macro.
CVE-2019-10528 1 Qualcomm 56 Mdm9206, Mdm9206 Firmware, Mdm9607 and 53 more 2019-11-08 7.5 HIGH 9.8 CRITICAL
Use after free issue in kernel while accessing freed mdlog session info and its attributes after closing the session in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 675, SD 730, SD 820, SD 820A, SD 835, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24
CVE-2019-8158 1 Magento 1 Magento 2019-11-08 7.5 HIGH 9.8 CRITICAL
An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data allows an attacker to limited access to underlying XML data.
CVE-2019-12918 1 Quest 1 Kace Systems Management Appliance 2019-11-07 7.5 HIGH 9.8 CRITICAL
Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is software_library.php and affected parameters are order[0][column] and order[0][dir].
CVE-2019-5049 1 Amd 6 Radeon 550, Radeon 550 Firmware, Radeon Rx 550 and 3 more 2019-11-07 7.5 HIGH 10.0 CRITICAL
An exploitable memory corruption vulnerability exists in AMD ATIDXX64.DLL driver, versions 25.20.15031.5004 and 25.20.15031.9002. A specially crafted pixel shader can cause an out-of-bounds memory write. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host.
CVE-2019-2331 1 Qualcomm 92 Mdm9150, Mdm9150 Firmware, Mdm9206 and 89 more 2019-11-07 10.0 HIGH 9.8 CRITICAL
Possible Integer overflow because of subtracting two integers without checking if the result would overflow or not in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVE-2019-10505 1 Qualcomm 88 Mdm9150, Mdm9150 Firmware, Mdm9206 and 85 more 2019-11-07 7.5 HIGH 9.8 CRITICAL
Out of bound access while processing a non-standard IE measurement request with length crossing past the size of frame in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVE-2019-10522 1 Qualcomm 84 Mdm9206, Mdm9206 Firmware, Mdm9607 and 81 more 2019-11-07 7.5 HIGH 9.8 CRITICAL
While playing the clip which is nonstandard buffer overflow can occur while parsing in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20
CVE-2019-8135 1 Magento 1 Magento 2019-11-07 7.5 HIGH 9.8 CRITICAL
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony framework allows service identifiers to be derived from user controlled data, which can lead to remote code execution.
CVE-2019-8121 1 Magento 1 Magento 2019-11-07 7.5 HIGH 9.8 CRITICAL
An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries (Bootstrap, jquery, Knockout) with known security vulnerabilities.
CVE-2009-5043 2 Burn Project, Debian 2 Burn, Debian Linux 2019-11-06 7.5 HIGH 9.8 CRITICAL
burn allows file names to escape via mishandled quotation marks
CVE-2009-5042 2 Debian, Python-docutils Project 2 Debian Linux, Python-docutils 2019-11-06 6.4 MEDIUM 9.1 CRITICAL
python-docutils allows insecure usage of temporary files
CVE-2019-17134 2 Canonical, Opendev 2 Ubuntu Linux, Octavia 2019-11-06 6.4 MEDIUM 9.1 CRITICAL
Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED.
CVE-2013-4103 1 Cryptocat Project 1 Cryptocat 2019-11-06 7.5 HIGH 9.8 CRITICAL
Cryptocat before 2.0.22 has Remote Script Injection due to improperly sanitizing user input
CVE-2006-0062 1 Sillycycle 1 Xlockmore 2019-11-06 7.5 HIGH 9.8 CRITICAL
xlockmore 5.13 allows potential xlock bypass when FVWM switches to the same virtual desktop as a new Gaim window.
CVE-2006-4243 1 Linux-vserver 1 Linux-vserver 2019-11-06 10.0 HIGH 9.8 CRITICAL
linux vserver 2.6 before 2.6.17 suffers from privilege escalation in remount code.
CVE-2019-18784 1 Salesagility 1 Suitecrm 2019-11-06 7.5 HIGH 9.8 CRITICAL
SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection.
CVE-2019-17266 2 Canonical, Gnome 2 Ubuntu Linux, Libsoup 2019-11-06 7.5 HIGH 9.8 CRITICAL
libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding with a memcpy.
CVE-2019-18464 1 Ipswitch 1 Moveit Transfer 2019-11-06 7.5 HIGH 9.8 CRITICAL
In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3), multiple SQL Injection vulnerabilities have been found in the REST API that could allow an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database or may be able to alter the database.
CVE-2013-2260 1 Cryptocat Project 1 Cryptocat 2019-11-06 5.0 MEDIUM 9.8 CRITICAL
Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy Weakness
CVE-2015-8980 4 Fedoraproject, Opensuse, Php-gettext Project and 1 more 4 Fedora, Leap, Php-gettext and 1 more 2019-11-06 7.5 HIGH 9.8 CRITICAL
The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code.
CVE-2009-5041 1 Debian 1 Overkill 2019-11-05 7.5 HIGH 9.8 CRITICAL
overkill has buffer overflow via long player names that can corrupt data on the server machine
CVE-2019-18189 1 Trendmicro 3 Apex One, Officescan, Worry-free Business Security 2019-11-05 10.0 HIGH 9.8 CRITICAL
A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (11.0, XG) and Worry-Free Business Security (9.5, 10.0) may allow an attacker to bypass authentication and log on to an affected product's management console as a root user. The vulnerability does not require authentication.
CVE-2019-17669 1 Wordpress 1 Wordpress 2019-11-05 7.5 HIGH 9.8 CRITICAL
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters.
CVE-2019-18663 1 Isl 1 Arp-guard 2019-11-05 7.5 HIGH 9.8 CRITICAL
A SQL injection vulnerability in a /login/forgot1 POST request in ARP-GUARD 4.0.0-5 allows unauthenticated remote attackers to execute arbitrary SQL commands via the user_id parameter.
CVE-2018-16659 1 Rausoft 1 Id.prove 2019-11-05 7.5 HIGH 9.8 CRITICAL
An issue was discovered in Rausoft ID.prove 2.95. The login page allows SQL injection via Microsoft SQL Server stacked queries in the Username POST parameter. Hypothetically, an attacker can utilize master..xp_cmdshell for the further privilege elevation.
CVE-2019-15683 1 Turbovnc 1 Turbovnc 2019-11-05 7.5 HIGH 9.8 CRITICAL
TurboVNC server code contains stack buffer overflow vulnerability in commit prior to cea98166008301e614e0d36776bf9435a536136e. This could possibly result into remote code execution, since stack frame is not protected with stack canary. This attack appear to be exploitable via network connectivity. To exploit this vulnerability authorization on server is required. These issues have been fixed in commit cea98166008301e614e0d36776bf9435a536136e.
CVE-2019-18632 1 Europa 1 Eidas-node Integration Package 2019-11-05 7.5 HIGH 9.8 CRITICAL
European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a manipulated SAML response with a forged certificate.
CVE-2019-18633 1 Europa 1 Eidas-node Integration Package 2019-11-05 7.5 HIGH 9.8 CRITICAL
European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain ExplicitKeyTrustEvaluator return value is not checked. NOTE: only 2.1 is confirmed to be affected.
CVE-2012-6125 1 Call-cc 1 Chicken 2019-11-05 7.5 HIGH 9.8 CRITICAL
Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions.
CVE-2019-12314 1 Deltek 1 Maconomy 2019-11-05 7.5 HIGH 9.8 CRITICAL
Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS/etc/passwd URI.
CVE-2005-3056 1 Twiki 1 Twiki 2019-11-05 7.5 HIGH 9.8 CRITICAL
TWiki allows arbitrary shell command execution via the Include function
CVE-2013-4102 1 Cryptocat Project 1 Cryptocat 2019-11-05 6.4 MEDIUM 9.1 CRITICAL
Cryptocat before 2.0.22 strophe.js Math.random() Random Number Generator Weakness
CVE-2013-2259 1 Cryptocat Project 1 Cryptocat 2019-11-05 7.5 HIGH 9.8 CRITICAL
Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation Overview
CVE-2013-2738 1 Readymedia Project 1 Readymedia 2019-11-04 7.5 HIGH 9.8 CRITICAL
minidlna has SQL Injection that may allow retrieval of arbitrary files
CVE-2013-2739 2 Debian, Readymedia Project 2 Debian Linux, Readymedia 2019-11-04 7.5 HIGH 9.8 CRITICAL
MiniDLNA has heap-based buffer overflow
CVE-2010-2548 1 Redhat 1 Icedtea6 2019-11-04 6.4 MEDIUM 9.1 CRITICAL
IcedTea6 before 1.7.4 does not properly check property access, which allows unsigned apps to read and write arbitrary files.
CVE-2010-2783 1 Redhat 1 Icedtea6 2019-11-04 6.4 MEDIUM 9.1 CRITICAL
IcedTea6 before 1.7.4 allow unsigned apps to read and write arbitrary files, related to Extended JNLP Services.
CVE-2019-18465 1 Ipswitch 1 Moveit Transfer 2019-11-04 6.8 MEDIUM 9.8 CRITICAL
In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without full credentials via the SSH (SFTP) interface. The vulnerability affects only certain SSH (SFTP) configurations, and is applicable only if the MySQL database is being used.
CVE-2019-18364 1 Jetbrains 1 Teamcity 2019-11-01 7.5 HIGH 9.8 CRITICAL
In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution.
CVE-2012-0694 1 Sugarcrm 1 Sugarcrm 2019-11-01 7.5 HIGH 9.8 CRITICAL
SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code.
CVE-2010-3375 1 Qtparted Project 1 Qtparted 2019-11-01 7.5 HIGH 9.8 CRITICAL
qtparted has insecure library loading which may allow arbitrary code execution