CVEs published December 10, 2019
100 CVEs were published on December 10, 2019: 1 critical, 3 high. 1 is now in CISA KEV.
- Published
- 100
- Critical
- 1
- High
- 3
- Medium
- 5
- Low
- 0
- Unrated
- 91
- Now in CISA KEV
- 1
- Fix available
- 49
Most affected products
- Google Chrome
- 40
- Microsoft Windows
- 18
- IBM Cloud Pak System
- 2
- Microsoft Office
- 2
- monkey
- 2
- python-keystoneclient
- 2
- Red Hat samba
- 2
- dietlibc
- 1
- IBM SmartCloud Analytics
- 1
- IBM WebSphere Application Server
- 1
Critical 1
High 3
- CVE-2019-1458An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-4521Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection.IBM Cloud Pak System
- CVE-2019-14889A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8.Red Hat libssh
Medium, low and unrated 96
- CVE-2019-19604Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x…
- CVE-2019-14861All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver…Red Hat samba
- CVE-2019-1490A spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for…Microsoft Skype for Business Server 2019 CU2
- CVE-2019-1487An information disclosure vulnerability in Android Apps using Microsoft Authentication Library (MSAL) 0.3.1-Alpha or later exists under…Microsoft Authentication Library (MSAL) for Android
- CVE-2019-1488A security feature bypass vulnerability exists when Microsoft Defender improperly handles specific buffers, aka 'Microsoft Defender…Microsoft Windows
- CVE-2019-1489An information disclosure vulnerability exists when the Windows Remote Desktop Protocol (RDP) fails to properly handle objects in memory…Microsoft Windows XP Service Pack
- CVE-2019-1485A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code…Microsoft Internet Explorer
- CVE-2019-1486A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary…Microsoft Visual Studio
- CVE-2019-1481An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows…Microsoft Windows
- CVE-2019-1483An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this…Microsoft Windows
- CVE-2019-1484A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote…Microsoft Windows
- CVE-2019-1478An elevation of privilege vulnerability exists when Windows improperly handles COM object creation, aka 'Windows COM Server Elevation of…Microsoft Windows
- CVE-2019-1480An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows…Microsoft Windows
- CVE-2019-1476An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows…Microsoft Windows
- CVE-2019-1477An elevation of privilege vulnerability exists when the Windows Printer Service improperly validates file paths while loading printer…Microsoft Windows
- CVE-2019-1471A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated…Microsoft Windows
- CVE-2019-1472An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel…Microsoft Windows
- CVE-2019-1474An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel…Microsoft Windows
- CVE-2019-1469An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information…Microsoft Windows
- CVE-2019-1470An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an…Microsoft Windows
- CVE-2019-1467An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka…Microsoft Windows Server, · Microsoft Windows
- CVE-2019-1468A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka…Microsoft Windows
- CVE-2019-1464An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel…Microsoft Office · Microsoft Excel
- CVE-2019-1465An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka…Microsoft Windows
- CVE-2019-1466An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka…Microsoft Windows
Show all 96 entriesShow fewer entries
- CVE-2019-1462A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in…Microsoft Office · Microsoft PowerPoint
- CVE-2019-1463An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory…Microsoft Office
- CVE-2019-1461A denial of service vulnerability exists in Microsoft Word software when the software fails to properly handle objects in memory, aka…Microsoft Office · Microsoft Word
- CVE-2019-1332A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a…Microsoft SQL Server 2017 Reporting Services · Microsoft… +1
- CVE-2019-1400An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory…Microsoft Office
- CVE-2019-1453A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and…Microsoft Windows
- CVE-2019-13762Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof…Google Chrome
- CVE-2019-13763Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the…Google Chrome
- CVE-2019-13764Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2019-13759Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a…Google Chrome
- CVE-2019-13761Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN…Google Chrome
- CVE-2019-13757Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN…Google Chrome
- CVE-2019-13758Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass…Google Chrome
- CVE-2019-13755Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a…Google Chrome
- CVE-2019-13756Incorrect security UI in printing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a…Google Chrome
- CVE-2019-13753Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information…Google Chrome
- CVE-2019-13754Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation…Google Chrome
- CVE-2019-13750Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth…Google Chrome
- CVE-2019-13751Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information…Google Chrome
- CVE-2019-13752Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information…Google Chrome
- CVE-2019-13748Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially…Google Chrome
- CVE-2019-13749Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the…Google Chrome
- CVE-2019-13746Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the…Google Chrome
- CVE-2019-13747Uninitialized data in rendering in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap…Google Chrome
- CVE-2019-13743Incorrect security UI in external protocol handling in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof security UI…Google Chrome
- CVE-2019-13744Insufficient policy enforcement in cookies in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via…Google Chrome
- CVE-2019-13745Insufficient policy enforcement in audio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a…Google Chrome
- CVE-2019-13741Insufficient validation of untrusted input in Blink in Google Chrome prior to 79.0.3945.79 allowed a local attacker to bypass same origin…Google Chrome
- CVE-2019-13742Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the…Google Chrome
- CVE-2019-13739Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via…Google Chrome
- CVE-2019-13740Incorrect security UI in sharing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted…Google Chrome
- CVE-2019-13737Insufficient policy enforcement in autocomplete in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially…Google Chrome
- CVE-2019-13738Insufficient policy enforcement in navigation in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass site isolation…Google Chrome
- CVE-2019-13734Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via…Google Chrome
- CVE-2019-13735Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a…Google Chrome
- CVE-2019-13736Integer overflow in PDFium in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2019-13730Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2019-13732Use-after-free in WebAudio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2019-13728Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption…Google Chrome
- CVE-2019-13729Use-after-free in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2019-13726Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a…Google Chrome
- CVE-2019-13727Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin…Google Chrome
- CVE-2019-13725Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML…Google Chrome
- CVE-2019-17270Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the…
- CVE-2019-5841Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap…Google Chrome
- CVE-2019-5843Out of bounds memory access in JavaScript in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap…Google Chrome
- CVE-2019-13672Incorrect security UI in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially spoof the contents of the…Google Chrome
- CVE-2019-19703In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.io.ktor:ktor-client-core
- CVE-2019-19702The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.modoboa-dmarc
- CVE-2012-1577lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0.dietlibc
- CVE-2019-6192A potential vulnerability has been reported in Lenovo Power Management Driver versions prior to 1.67.17.48 leading to a buffer overflow…Lenovo Power Management driver
- CVE-2019-6183A denial of service vulnerability has been reported in Lenovo Energy Management Driver for Windows 10 versions prior to 15.11.29.7 that…Lenovo Energy Management driver
- CVE-2013-1689Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), related to event handling with frames.Mozilla Firefox
- CVE-2016-1000107inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of…
- CVE-2019-4663IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting.IBM WebSphere Application Server
- CVE-2019-4095IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized…IBM Cloud Pak System
- CVE-2016-1000108yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications…
- CVE-2013-4133kde-workspace before 4.10.5 has a memory leak in plasma desktopkde-workspace
- CVE-2013-4120Katello has a Denial of Service vulnerability in API OAuth authenticationKatello
- CVE-2013-2183Monkey HTTP Daemon has local security bypassmonkey
- CVE-2019-19251The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS.
- CVE-2013-2167python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypasspython-keystoneclient
- CVE-2013-2166python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypasspython-keystoneclient
- CVE-2013-2159Monkey HTTP Daemon: broken user name authenticationmonkey
- CVE-2013-2095rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injectionrubygem-openshift-origin-controller · openshift-origin-cont…
- CVE-2013-1793openstack-utils openstack-db has insecure password creationopenstack-utils openstack-db program
- CVE-2013-0293oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalationoVirt Node
- CVE-2014-3656JBoss KeyCloak: XSS in login-status-iframe.htmlJBoss KeyCloak · org.keycloak:keycloak-core
- CVE-2019-19698marc-q libwav through 2017-04-20 has a NULL pointer dereference in wav_content_read() at libwav.c.
- CVE-2013-4184Perl module Data::UUID from CPAN version 1.219 vulnerable to symlink attackslibdata-uuid-perl
- CVE-2019-14870All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos…Red Hat samba