| CVE-2019-0859 Known exploited | High 7.8 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. Assigned by microsoft | Apr 9, 2019 |
| CVE-2019-3398 Known exploited | High 8.8 | Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. Assigned by atlassian | Apr 18, 2019 |
| CVE-2019-2616 Known exploited | High 7.2 | Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Assigned by oracle | Apr 23, 2019 |
| CVE-2019-11539 Known exploited | High 8.0 | In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX b… Assigned by mitre | Apr 26, 2019 |
| CVE-2019-2725 Known exploited | High 7.5 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Assigned by oracle | Apr 26, 2019 |
| CVE-2019-9621 Known exploited | High 7.5 | Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component. Assigned by mitre | Apr 30, 2019 |
| CVE-2019-3929 Known exploited | Critical 9.8 | The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 fir… Assigned by tenable | Apr 30, 2019 |
| CVE-2017-18368 Known exploited | Critical 9.8 | The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is access… Assigned by mitre | May 2, 2019 |
| CVE-2018-4063 Known exploited | High 8.8 | An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. Assigned by talos | May 6, 2019 |
| CVE-2019-11510 Known exploited | Critical 9.9 | In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary… Assigned by mitre | May 8, 2019 |
| CVE-2019-3568 Known exploited | Critical 9.8 | A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. Assigned by facebook | May 14, 2019 |
| CVE-2018-14839 Known exploited | Critical 9.8 | LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. Assigned by mitre | May 14, 2019 |
| CVE-2019-0863 Known exploited | High 7.8 | An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'. Assigned by microsoft | May 16, 2019 |
| CVE-2019-0708 Known exploited Healthcare | Critical 9.8 | A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends speciall… Assigned by microsoft | May 16, 2019 |
| CVE-2019-0903 Known exploited | High 8.8 | A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'. Assigned by microsoft | May 16, 2019 |
| CVE-2019-11634 Known exploited | Critical 9.8 | Citrix Workspace App before 1904 for Windows has Incorrect Access Control. Assigned by mitre | May 22, 2019 |
| CVE-2018-7841 Known exploited | Critical 9.8 | A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered. Assigned by schneider | May 22, 2019 |
| CVE-2018-13383 Known exploited | Medium 4.3 | A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may ca… Assigned by fortinet | May 29, 2019 |
| CVE-2019-9670 Known exploited | Critical 9.8 | mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml. Assigned by mitre | May 29, 2019 |
| CVE-2019-9874 Known exploited | Critical 9.8 | Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrar… Assigned by mitre | May 31, 2019 |
| CVE-2019-9875 Known exploited | High 8.8 | Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parame… Assigned by mitre | May 31, 2019 |
| CVE-2019-11580 Known exploited | Critical 9.8 | Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Assigned by atlassian | Jun 3, 2019 |
| CVE-2018-13379 Known exploited | Critical 9.1 | An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to… Assigned by fortinet | Jun 4, 2019 |
| CVE-2018-13382 Known exploited | Critical 9.1 | An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web p… Assigned by fortinet | Jun 4, 2019 |
| CVE-2019-10149 Known exploited | Critical 9.0 | A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Assigned by redhat | Jun 5, 2019 |
| CVE-2010-5330 Known exploited | Critical 9.8 | On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. Assigned by mitre | Jun 11, 2019 |
| CVE-2019-1069 Known exploited | High 7.8 | Task Scheduler Elevation of Privilege Vulnerability Assigned by microsoft | Jun 12, 2019 |
| CVE-2019-1064 Known exploited | High 7.8 | Windows Elevation of Privilege Vulnerability Assigned by microsoft | Jun 12, 2019 |
| CVE-2019-5786 Known exploited | Medium 6.5 | Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Assigned by Chrome | Jun 27, 2019 |
| CVE-2019-7256 Known exploited | Critical 9.8 | Linear eMerge E3-Series devices allow Command Injections. Assigned by mitre | Jul 2, 2019 |
| CVE-2018-15811 Known exploited | High 7.5 | DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters. Assigned by mitre | Jul 3, 2019 |
| CVE-2018-18325 Known exploited | High 7.5 | DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. Assigned by mitre | Jul 3, 2019 |
| CVE-2019-0880 Known exploited | High 7.8 | A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'. Assigned by microsoft | Jul 15, 2019 |
| CVE-2019-1068 Known exploited | High 8.8 | A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'. Assigned by microsoft | Jul 15, 2019 |
| CVE-2019-12991 Known exploited | High 8.8 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6). Assigned by mitre | Jul 16, 2019 |
| CVE-2019-12989 Known exploited | Critical 9.8 | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection. Assigned by mitre | Jul 16, 2019 |
| CVE-2019-13272 Known exploited | High 7.8 | In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obta… Assigned by mitre | Jul 17, 2019 |
| CVE-2019-1579 Known exploited | High 8.1 | Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauth… Assigned by palo_alto | Jul 19, 2019 |
| CVE-2019-11708 Known exploited | Critical 10.0 | Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromise… Assigned by mozilla | Jul 23, 2019 |
| CVE-2019-11707 Known exploited | High 8.8 | A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. Assigned by mozilla | Jul 23, 2019 |
| CVE-2019-1129 Known exploited | High 7.8 | An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. Assigned by microsoft | Jul 29, 2019 |
| CVE-2019-1130 Known exploited | High 7.8 | An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. Assigned by microsoft | Jul 29, 2019 |
| CVE-2019-1132 Known exploited | High 7.8 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. Assigned by microsoft | Jul 29, 2019 |
| CVE-2019-0193 Known exploited | High 7.2 | In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "d… Assigned by apache | Aug 1, 2019 |
| CVE-2019-11581 Known exploited | Critical 9.8 | There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. Assigned by atlassian | Aug 9, 2019 |
| CVE-2019-0344 Known exploited | Critical 9.8 | Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hyb… Assigned by sap | Aug 14, 2019 |
| CVE-2019-15107 Known exploited | Critical 9.8 | An issue was discovered in Webmin <=1.920. Assigned by mitre | Aug 16, 2019 |
| CVE-2019-15752 Known exploited | High 7.8 | Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low… Assigned by mitre | Aug 28, 2019 |
| CVE-2019-13608 Known exploited | High 7.5 | Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks. Assigned by mitre | Aug 29, 2019 |
| CVE-2019-15949 Known exploited | High 8.8 | Nagios XI before 5.6.6 allows remote command execution as root. Assigned by mitre | Sep 5, 2019 |
