CVE Vulnerability

NVD-CWE-noinfo

CVE-2019-15009

by

The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user’s favourite setting for a project via an improper authorization vulnerability.

CVE-2019-14920

by

Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an authenticated attacker to gain root execution privileges over the device via a hidden etc_ro/web/adm/system_command.asp shell feature.

CVE-2019-14936

by

Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash).

CVE-2019-14939

by

An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default.

CVE-2019-14940

by

In Storage Performance Development Kit (SPDK) before 19.07, a user of a vhost can cause a crash if the target is sent invalid input.

CVE-2019-1488

by

A security feature bypass vulnerability exists when Microsoft Defender improperly handles specific buffers, aka ‘Microsoft Defender Security Feature Bypass Vulnerability’.