CVE-2019-15252

Cisco SPA100 Series Analog Telephone Adapters Remote Code Execution Vulnerabilities

Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Spa112 Spa112 Firmware Spa122 and 1 more

CVE-2019-15251

Cisco SPA100 Series Analog Telephone Adapters Remote Code Execution Vulnerabilities

Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Spa112 Spa112 Firmware Spa122 and 1 more

CVE-2019-15250

Cisco SPA100 Series Analog Telephone Adapters Remote Code Execution Vulnerabilities

Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Spa112 Spa112 Firmware Spa122 and 1 more

CVE-2019-15249

Cisco SPA100 Series Analog Telephone Adapters Remote Code Execution Vulnerabilities

Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Spa112 Spa112 Firmware Spa122 and 1 more

CVE-2019-15248

Cisco SPA100 Series Analog Telephone Adapters Remote Code Execution Vulnerabilities

Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Spa112 Spa112 Firmware Spa122 and 1 more

CVE-2019-15247

Cisco SPA100 Series Analog Telephone Adapters Remote Code Execution Vulnerabilities

Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Spa112 Spa112 Firmware Spa122 and 1 more

CVE-2019-15246

Cisco SPA100 Series Analog Telephone Adapters Remote Code Execution Vulnerabilities

Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Spa112 Spa112 Firmware Spa122 and 1 more

CVE-2019-15245

Cisco SPA100 Series Analog Telephone Adapters Remote Code Execution Vulnerabilities

Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Spa112 Spa112 Firmware Spa122 and 1 more

CVE-2019-15244

Cisco SPA100 Series Analog Telephone Adapters Remote Code Execution Vulnerabilities

Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Spa112 Spa112 Firmware Spa122 and 1 more

CVE-2019-15243

Cisco SPA100 Series Analog Telephone Adapters Remote Code Execution Vulnerabilities

Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Spa112 Spa112 Firmware Spa122 and 1 more

CVE-2019-15242

Cisco SPA100 Series Analog Telephone Adapters Remote Code Execution Vulnerabilities

Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Spa112 Spa112 Firmware Spa122 and 1 more

CVE-2019-15241

Cisco SPA100 Series Analog Telephone Adapters Remote Code Execution Vulnerabilities

Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Spa112 Spa112 Firmware Spa122 and 1 more

CVE-2019-15240

Cisco SPA100 Series Analog Telephone Adapters Remote Code Execution Vulnerabilities

Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated, adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.

CVSS 3.1 · 8.0 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Spa112 Spa112 Firmware Spa122 and 1 more

CVE-2019-15223

kernel: Null pointer dereference in the sound/usb/line6/driver.c

An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/driver.c driver.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Linux Netapp and 1 more

Products

Ubuntu Linux Linux Kernel Active Iq Unified Manager and 6 more

CVE-2019-15222

kernel: Null pointer dereference in the sound/usb/helper.c

An issue was discovered in the Linux kernel before 5.2.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/helper.c (motu_microbookii) driver.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Opensuse

Products

Linux Kernel Active Iq Unified Manager Data Availability Services and 5 more

CVE-2019-15221

kernel: Null pointer dereference in the sound/usb/line6/pcm.c

An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/pcm.c driver.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 3 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 9 more

CVE-2019-15220

kernel: Use-after-free in drivers/net/wireless/intersil/p54/p54usb.c

An issue was discovered in the Linux kernel before 5.2.1. There is a use-after-free caused by a malicious USB device in the drivers/net/wireless/intersil/p54/p54usb.c driver.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 2 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 7 more

CVE-2019-15163

libpcap: Null pointer dereference in rpcapd/daemon.c

rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daemon crash) if a crypt() call fails.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed

Vendors

Tcpdump

Products

Libpcap

CVE-2019-15141

ImageMagick: heap-based buffer overflow in WriteTIFFImage in coders/tiff.c

WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed

Vendors

Imagemagick Opensuse Redhat

Products

Imagemagick Leap Enterprise Linux

CVE-2019-15117

kernel: out of bounds memory access in parse_audio_mixer_unit in sound/usb/mixer.c

parse_audio_mixer_unit in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles a short descriptor, leading to out-of-bounds memory access.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel