CVE-2019-1297

CVE-2019-1297 is a Microsoft Excel remote code execution vulnerability caused by improper handling of memory objects. An attacker can exploit it by convincing a user to open a specially crafted file, executing arbitrary code in the user’s context (higher impact if admin). The vulnerability is add...

CVE-2019-1278

Technical details about CVE-2019-1278 (affected product, vulnerable component, impact, exploitability) are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2019-1253

CVE-2019-1253 describes a local privilege-escalation in Microsoft Windows AppX Deployment Server caused by improper handling of junctions. The vulnerability allows an attacker who already has code execution on the target system to elevate privileges (local attack, low integrity/login requirements...

CVE-2019-1214

CVE-2019-1214 is a Windows privilege-escalation vulnerability in the Windows Common Log File System (CLFS) Driver. It stems from improper handling of objects in memory, enabling a local attacker to escalate privileges on a vulnerable system. Public references consistently describe the CLFS driver...

CVE-2019-1221

CVE-2019-1221 is a remote code execution in the Internet Explorer scripting engine memory handling, leading to arbitrary code execution when an attacker can cause memory corruption. Affected software includes Internet Explorer 11 and related scripting components (including Chakra/VBScript-based p...

CVE-2019-1215

CVE-2019-1215 describes a local privilege-escalation in Windows via ws2ifsl.sys (Winsock) where improper handling of memory-resident objects enables code execution with elevated privileges. Affected component is Winsock’s ws2ifsl.sys; root cause is memory handling of objects within the Winsock su...

CVE-2019-16098

CVE-2019-16098 affects the Micro‑Star MSI Afterburner driver (RTCore64.sys/RTCore32.sys). The connected documents confirm an arbitrary read/write primitive in the vulnerable driver that allows a local authenticated user to read/write arbitrary memory, I/O ports and MSRs, enabling privilege escala...

CVE-2019-8451

CVE-2019-8451 affects Jira Server before 8.4.0 with an SSRF in the /plugins/servlet/gadgets/makeRequest endpoint due to a logic bug in JiraWhitelist. An attacker can cause Jira to fetch internal resources and return their responses, enabling access to internal network content. The weakness is pre...

CVE-2019-10891

CVE-2019-10891 affects D-Link DIR-806 devices. The issue is a command injection in the hnap_main function where system() is called with a parameter controllable by the user, enabling remote attackers to execute arbitrary shell commands via a special HTTP header. The CVE is rated critical (CVSS 3....

CVE-2019-14223

Summary: Alfresco Share (Community Edition) before 5.2.6, 6.0.N and 6.1.N is affected by an Open Redirect vulnerability. The issue allows an attacker to trigger redirects via a crafted POST request by manipulating POST parameters, potentially steering victims to malicious sites. Affected componen...

CVE-2019-15846

Exim CVE-2019-15846 affects Exim 4.92.x prior to 4.92.2, where a trailing backslash in SMTP processing enables remote code execution as root. Published advisories (e.g., ALAS-2019-1277/1310) confirm the issue and urge upgrading to Exim 4.92.2 or newer. Remediation: upgrade Exim to 4.92.2+ or appl...

CVE-2019-15949

Nagios XI

CVE-2019-13608

Citrix StoreFront Server is affected by CVE-2019-13608: XML External Entity (XXE) processing vulnerability present in StoreFront versions before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000). The issue enables XXE attacks, with potential impact including reading arbit...

CVE-2019-11248

CVE-2019-11248 describes exposure of the Go pprof debugging endpoint at /debug/pprof on the unauthenticated Kubelet healthz port. The connected nuclei template confirms the issue: the pprof endpoint is exposed via the Kubelet healthz port, potentially leaking internal Kubelet memory addresses and...

CVE-2019-15752

CVE-2019-15752 affects Docker Desktop Community Edition prior to 2.1.0.1. A local attacker can escalate privileges by placing a Trojan horse docker-credential-wincred.exe in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, then rely on an admin/service user authenticating with Do...

CVE-2019-15642

CVE-2019-15642 : Webmin

CVE-2019-8446

CVE-2019-8446 affects Atlassian Jira prior to 8.3.2. The flaw is an incorrect authorization check on the /rest/issueNav/1/issueTable API, allowing remote/anonymous attackers to enumerate usernames and perform information disclosure. The issue is documented in multiple sources (Talos advisory TALO...

CVE-2019-5039

CVE-2019-5039 describes an exploitable heap-based buffer overflow in the Openweave-core ASN1Writer PutValue path (Nest Nest Cam IQ Indoor, Openweave-core 4.0.2). TALOS details show an overflow in ASN1Writer::EncodeHead/PutValue when processing crafted Weave certificates, enabling code execution. ...

CVE-2019-15107

Webmin vulnerability CVE-2019-15107 affects Webmin

CVE-2019-1182

CVE-2019-1182 is a remote code execution vulnerability in Microsoft Windows Remote Desktop Services (RDS) caused by a heap overflow in the server’s dynamic channel handling when processing RDP requests. The flaw is pre-authentication and exploitable by an unauthenticated attacker who connects to ...