Browse CVE records published in July 2019, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 1520 matching CVEs · Page 25 of 31.
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a type confusion vulnerability. Successful exploitation could lead to information disclosure.
Published Jul 6, 2020 · Updated Aug 4, 2024
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
Published Jul 6, 2020 · Updated Aug 4, 2024
Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .
Published Jul 6, 2020 · Updated Aug 4, 2024
Adobe Experience Manager version 6.4 and ealier have a Cross-Site Request Forgery vulnerability. Successful exploitation could lead to Sensitive Information disclosure in the context of the current user.
Published Jul 18, 2019 · Updated Aug 4, 2024
Adobe Bridge CC version 9.0.2 and earlier versions have an out of bound read vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
Published Jul 18, 2019 · Updated Aug 4, 2024
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Information Exposure Through an Error Message vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
Published Jul 18, 2019 · Updated Aug 4, 2024
Adobe Experience Manager version 6.4 and ealier have a Stored Cross-site Scripting vulnerability. Successful exploitation could lead to Sensitive Information disclosure in the context of the current user.
Published Jul 18, 2019 · Updated Aug 4, 2024
Adobe Experience Manager version 6.4 and ealier have a Reflected Cross-site Scripting vulnerability. Successful exploitation could lead to Sensitive Information disclosure in the context of the current user.
Published Jul 18, 2019 · Updated Aug 4, 2024
Adobe Dreamweaver direct download installer versions 19.0 and below, 18.0 and below have an Insecure Library Loading (DLL hijacking) vulnerability. Successful exploitation could lead to Privilege Escalation in the context of the current user.
Published Jul 18, 2019 · Updated Aug 4, 2024
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper Restriction of XML External Entity Reference ('XXE') vulnerability. Successful exploitation could lead to Arbitrary read access to the file system in the context of the current user.
Published Jul 18, 2019 · Updated Aug 4, 2024
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Insufficient input validation vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
Published Jul 18, 2019 · Updated Aug 4, 2024
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Inadequate access control vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
Published Jul 18, 2019 · Updated Aug 4, 2024
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
Published Jul 18, 2019 · Updated Aug 4, 2024
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper error handling vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
Published Jul 18, 2019 · Updated Aug 4, 2024
Prima Systems FlexAir, Versions 2.3.38 and prior. The application generates database backup files with a predictable name, and an attacker can use brute force to identify the database backup file name. A malicious actor can exploit this issue to download the database file and disclose login information, which can allow the attacker to bypass authentication and have full access to the system.
Published Jul 1, 2019 · Updated Aug 4, 2024
Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer. An attacker with administrative Kibana access could set the timelion:graphite.url configuration option to an arbitrary URL. This could possibly lead to an attacker accessing external URL resources as the Kibana process on the host system.
Published Jul 30, 2019 · Updated Aug 4, 2024
Prima Systems FlexAir devices have Default Credentials.
Published Jul 1, 2019 · Updated Aug 4, 2024
Prima Systems FlexAir, Versions 2.3.38 and prior. Improper validation of file extensions when uploading files could allow a remote authenticated attacker to upload and execute malicious applications within the application’s web root with root privileges.
Published Jul 1, 2019 · Updated Aug 4, 2024
Prima Systems FlexAir, Versions 2.3.38 and prior. The application incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component, which could allow attackers to execute commands directly on the operating system.
Published Jul 1, 2019 · Updated Aug 4, 2024
Prima Systems FlexAir, Versions 2.3.38 and prior. The application allows improper authentication using the MD5 hash value of the password, which may allow an attacker with access to the database to login as admin without decrypting the password.
Published Jul 1, 2019 · Updated Aug 4, 2024
A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user.
Published Jul 30, 2019 · Updated Aug 4, 2024
A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the 'server_ca_cert' setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the middle style attack against the Ruby agent.
Published Jul 30, 2019 · Updated Aug 4, 2024
Linear eMerge E3-Series devices have Hard-coded Credentials.
Published Jul 2, 2019 · Updated Aug 4, 2024
Linear eMerge 50P/5000P devices allow Cross-Site Request Forgery (CSRF).
Published Jul 2, 2019 · Updated Aug 4, 2024
Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution.
Published Jul 2, 2019 · Updated Aug 4, 2024
Optergy Proton/Enterprise devices have an Unauthenticated SMS Sending Service.
Published Jul 1, 2019 · Updated Aug 4, 2024
Prima Systems FlexAir, Versions 2.3.38 and prior. The session-ID is of an insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session and bypass authentication.
Published Jul 1, 2019 · Updated Aug 4, 2024
Optergy Proton/Enterprise devices allow Cross-Site Request Forgery (CSRF).
Published Jul 1, 2019 · Updated Aug 4, 2024
Optergy Proton/Enterprise devices allow Authenticated File Upload with Code Execution as root.
Published Jul 1, 2019 · Updated Aug 4, 2024
Optergy Proton/Enterprise devices have Hard-coded Credentials.
Published Jul 1, 2019 · Updated Aug 4, 2024
Optergy Proton/Enterprise devices allow Username Disclosure.
Published Jul 1, 2019 · Updated Aug 4, 2024
Linear eMerge E3-Series devices have Cleartext Credentials in a Database.
Published Jul 2, 2019 · Updated Aug 4, 2024
Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console.
Published Jul 1, 2019 · Updated Aug 4, 2024
Linear eMerge E3-Series devices allow Authorization Bypass with Information Disclosure.
Published Jul 2, 2019 · Updated Aug 4, 2024
Optergy Proton/Enterprise devices allow Unauthenticated Internal Network Information Disclosure.
Published Jul 1, 2019 · Updated Aug 4, 2024
Linear eMerge E3-Series devices allow File Inclusion.
Published Jul 2, 2019 · Updated Aug 4, 2024
Linear eMerge 50P/5000P devices allow Unauthenticated File Upload.
Published Jul 2, 2019 · Updated Aug 4, 2024
Linear eMerge E3-Series devices allow Unrestricted File Upload.
Published Jul 2, 2019 · Updated Aug 4, 2024
Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH).
Published Jul 2, 2019 · Updated Aug 4, 2024
Prima Systems FlexAir, Versions 2.3.38 and prior. An unauthenticated user can send unverified HTTP requests, which may allow the attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious website.
Published Jul 1, 2019 · Updated Aug 4, 2024
Linear eMerge 50P/5000P devices allow Authentication Bypass.
Published Jul 2, 2019 · Updated Aug 4, 2024
Optergy Proton/Enterprise devices allow Open Redirect.
Published Jul 1, 2019 · Updated Aug 4, 2024
Linear eMerge E3-Series devices allow a Stack-based Buffer Overflow on the ARM platform.
Published Jul 2, 2019 · Updated Aug 4, 2024
Linear eMerge 50P/5000P devices allow Cookie Path Traversal.
Published Jul 2, 2019 · Updated Aug 4, 2024
Linear eMerge E3-Series devices allow XSS.
Published Jul 2, 2019 · Updated Aug 4, 2024
Linear eMerge E3-Series devices have Default Credentials.
Published Jul 2, 2019 · Updated Aug 4, 2024
Linear eMerge E3-Series devices have a Version Control Failure.
Published Jul 2, 2019 · Updated Aug 4, 2024
Nortek Linear eMerge 50P/5000P devices have Default Credentials.
Published Jul 1, 2019 · Updated Aug 4, 2024
Linear eMerge E3-Series devices allow Privilege Escalation.
Published Jul 2, 2019 · Updated Aug 4, 2024
Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).
Published Jul 2, 2019 · Updated Aug 4, 2024
