CVEs published November 21, 2019
105 CVEs were published on November 21, 2019: 1 critical, 5 high. 2 are now in CISA KEV.
- Published
- 105
- Critical
- 1
- High
- 5
- Medium
- 2
- Low
- 0
- Unrated
- 97
- Now in CISA KEV
- 2
- Fix available
- 23
Most affected products
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 13
- Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…
- 5
- Jenkins project Jenkins Google Compute Engine Plugin · org.…
- 3
- Activity
- 2
- Beckhoff TwinCAT
- 2
- Fortinet FortiClient for Mac OS
- 2
- Jenkins project Jenkins QMetry for JIRA - Test Management P…
- 2
- Jenkins project Jenkins Support Core Plugin · org.jenkins-c…
- 2
- NetApp ONTAP Select Deploy administration utility
- 2
- Tenda AC9
- 2
Critical 1
High 5
- CVE-2019-5637Beckhoff TwinCAT Profinet Driver Divide-by-Zero Denial of ServiceBeckhoff TwinCAT
- CVE-2019-5072An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart…Tenda AC9
- CVE-2019-5071An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart…Tenda AC9
- CVE-2019-5087An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools…xcftools
- CVE-2019-5086An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools…xcftools
Medium, low and unrated 99
- CVE-2012-2079A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal.Activity
- CVE-2012-2078Cross-site scripting (XSS) vulnerability in the Activity module 6.x-1.x for Drupal.Activity
- CVE-2012-1637Cross-site scripting vulnerability (XSS) in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before…Quick Tabs Quicktabs
- CVE-2019-18933In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account…
- CVE-2014-5255xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files.xcfa
- CVE-2014-5254xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files.xcfa
- CVE-2019-18889An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7.symfony/cache · symfony/symfony
- CVE-2019-18888An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7.symfony/http-foundation · symfony/mime +1
- CVE-2019-18887An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7.symfony/http-kernel · symfony/symfony
- CVE-2019-11325An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8.symfony/symfony · symfony/var-exporter
- CVE-2014-2904wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication.
- CVE-2014-2902wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates.
- CVE-2014-2901wolfssl before 3.2.0 does not properly issue certificates for a server's hostname.
- CVE-2012-1001Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary…
- CVE-2014-8356The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions…
- CVE-2015-3140Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7…
- CVE-2019-19207rConfig 3.9.2 allows devices.php?searchColumn= SQL injection.
- CVE-2019-19203An issue was discovered in Oniguruma 6.x before 6.9.4_rc2.
- CVE-2019-19204An issue was discovered in Oniguruma 6.x before 6.9.4_rc2.
- CVE-2019-19202In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role…
- CVE-2015-2793Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject…ikiwiki
- CVE-2013-3311Directory traversal vulnerability in the Loftek Nexus 543 IP Camera allows remote attackers to read arbitrary files via a ..
- CVE-2013-3312Multiple cross-site request forgery (CSRF) vulnerabilities in the Loftek Nexus 543 IP Camera allow remote attackers to hijack the…
- CVE-2013-3313The Loftek Nexus 543 IP Camera stores passwords in cleartext, which allows remote attackers to obtain sensitive information via an HTTP…
- CVE-2013-3314The Loftek Nexus 543 IP Camera allows remote attackers to obtain (1) IP addresses via a request to get_realip.cgi or (2) firmware versions…
Show all 99 entriesShow fewer entries
- CVE-2019-5636Beckhoff TwinCAT Discovery Service Denial of ServiceBeckhoff TwinCAT
- CVE-2019-19197IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escalation…
- CVE-2019-16758In Lexmark Services Monitor 2.27.4.0.39 (running on TCP port 2070), a remote attacker can use a directory traversal technique using…
- CVE-2019-18349HotkeyP through 4.9 r96 allows privilege escalation in the privilege function in Commands.cpp.
- CVE-2019-19033Jalios JCMS 10 allows attackers to access any part of the website and the WebDAV server with administrative privileges via a backdoor…
- CVE-2019-15511An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy.
- CVE-2019-18890A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a…
- CVE-2019-18886An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7.symfony/security-http · symfony/symfony
- CVE-2019-16406Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual machine) files…
- CVE-2019-16405Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an…centreon/centreon
- CVE-2019-19191Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service…
- CVE-2019-10767An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like…iobroker.js-controller
- CVE-2019-17272All versions of ONTAP Select Deploy administration utility are susceptible to a vulnerability which when successfully exploited could…NetApp ONTAP Select Deploy administration utility
- CVE-2019-5509ONTAP Select Deploy administration utility versions 2.11.2 through 2.12.2 are susceptible to a code injection vulnerability which when…NetApp ONTAP Select Deploy administration utility
- CVE-2018-8879Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for…
- CVE-2019-6693Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to theFortinet FortiGate
- CVE-2019-17650An Improper Neutralization of Special Elements used in a Command vulnerability in one of FortiClient for Mac OS root processes, may allow…Fortinet FortiClient for Mac OS
- CVE-2018-9195Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the…Fortinet FortiClient for Windows · Fortinet FortiOS +1
- CVE-2019-15704A clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a local attacker to read sensitive…Fortinet FortiClient for Mac OS
- CVE-2019-16340Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the…
- CVE-2019-10617Low privilege users can access service configuration which contains registry data that admins uses to create or delete entries in the…Qualcomm QCA6174_9377.WIN.1.0
- CVE-2019-10627Integer overflow to buffer overflow vulnerability in PostScript image handling code used by the PostScript- and PDF-compatible…Qualcomm PostScript and PDF printers that use IPS versions…
- CVE-2019-2251If a bitmap file is loaded from any un-authenticated source, there is a possibility that the bitmap can potentially cause stack buffer…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2266Possible double free issue in kernel while handling the camera sensor and its sub modules power sequence in Snapdragon Auto, Snapdragon…Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- CVE-2019-2268Possible OOB read issue in P2P action frames while handling WLAN management frame in Snapdragon Auto, Snapdragon Consumer Electronics…Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…
- CVE-2019-2271Buffer over read can happen while parsing downlink session management OTA messages if network sends un-intended values in Snapdragon Auto…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2289Lack of integrity check allows MODEM to accept any NAS messages which can result into authentication bypass of NAS in Snapdragon Auto…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2295Information disclosure due to lack of address range check done on the SysDBG buffers in SDI code.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2297Buffer overflow can occur while processing non-standard NAN message from user space.Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…
- CVE-2019-2303SNDCP module may access array out side its boundary when it receives malformed XID message.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2315While invoking the API to copy from fd or local buffer to the secure buffer, Parameters being populated are from non secure environment.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2318Non Secure Kernel can cause Trustzone to do an arbitrary memory read which will result into DOS in Snapdragon Auto, Snapdragon…Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- CVE-2019-2329Use after free issue in cleanup routine due to missing pointer sanitization for a failed start of a trusted application.Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…
- CVE-2019-2335While processing Attach Reject message, Valid exit condition is not met resulting into an infinite loop in Snapdragon Auto, Snapdragon…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2336Subsequent use of the CBO listener may result in further memory corruption due to use after free issue.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2339Out of bound access due to lack of check of whiltelist array size while reading the image elf segments.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2018-13916Out-of-bounds memory access in Qurt kernel function when using the identifier to access Qurt kernel buffer to retrieve thread data.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10486Race condition due to the lack of resource lock which will be concurrently modified in the memcpy statement leads to out of bound access…Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…
- CVE-2019-10490Use after free issue in Xtra daemon shutdown due to static object instance getting freed from a multiple places in Snapdragon Auto…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10503Out-of-bounds access can occur in camera driver due to improper validation of array index in Snapdragon Auto, Snapdragon Consumer…Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…
- CVE-2019-10535Improper validation for loop variable received from firmware can lead to out of bound access in WLAN function while iterating through loop…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10563Buffer over-read can occur in fast message handler due to improper input validation while processing a message from firmware in Snapdragon…Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…
- CVE-2019-10566Buffer overflow can occur in wlan module if supported rates or extended rates element length is greater than max rate set length in…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-17421Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072…
- CVE-2014-3700eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted dataeDeploy
- CVE-2014-1938python-rply before 0.7.4 insecurely creates temporary files.rply
- CVE-2014-1937Gamera before 3.4.1 insecurely creates temporary files.
- CVE-2014-1936rc before 1.7.1-5 insecurely creates temporary files.
- CVE-2014-19359base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames.
- CVE-2012-4524xlockmore before 5.43 'dclock' security bypass vulnerabilityxlockmore
- CVE-2019-16548A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision…Jenkins project Jenkins Google Compute Engine Plugin · org.…
- CVE-2019-16545Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration…Jenkins project Jenkins QMetry for JIRA - Test Management P…
- CVE-2019-16546Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin…Jenkins project Jenkins Google Compute Engine Plugin · org.…
- CVE-2019-16547Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with…Jenkins project Jenkins Google Compute Engine Plugin · org.…
- CVE-2019-16543Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master…Jenkins project Jenkins Spira Importer Plugin · com.inflect…
- CVE-2019-16544Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins…Jenkins project Jenkins QMetry for JIRA - Test Management P…
- CVE-2019-16541Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to…Jenkins project Jenkins JIRA Plugin · org.jenkins-ci.plugin…
- CVE-2019-16542Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins…Jenkins project Jenkins Anchore Container Image Scanner Plu…
- CVE-2019-16538A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions…Jenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2019-16539A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support…Jenkins project Jenkins Support Core Plugin · org.jenkins-c…
- CVE-2019-16540A path traversal vulnerability in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete…Jenkins project Jenkins Support Core Plugin · org.jenkins-c…
- CVE-2019-18958Nitro Pro before 13.2 creates a debug.log file in the directory where a .pdf file is located, if the .pdf document was produced by an OCR…
- CVE-2014-0084Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in…rubygem-openshift-origin-node · openshift-origin-node
- CVE-2012-3460cumin: At installation postgresql database user created without passwordcumin
- CVE-2012-3543mono 2.10.x ASP.NET Web Form Hash collision DoSmono
- CVE-2014-0083The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords.ruby-net-ldap · net-ldap
- CVE-2012-2350pam_shield before 0.9.4: Default configuration does not perform protective actionpam-shield
- CVE-2013-7172Slackware 13.1, 13.37, 14.0 and 14.1 contain world-writable permissions on the iodbctest and iodbctestw programs within the libiodbc…
- CVE-2012-2238trytond 2.4: ModelView.button fails to validate authorizationtrytond
- CVE-2013-7171Slackware 14.0 and 14.1, and Slackware LLVM 3.0-i486-2 and 3.3-i486-2, contain world-writable permissions on the /tmp directory which…
- CVE-2019-19037ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because…
- CVE-2019-19036btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because…
- CVE-2019-19039__btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which…
- CVE-2019-19221In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or…