# CVEs published 2019-12-17

71 CVEs were published on December 17, 2019: 0 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-18257](https://cve.now/CVE-2019-18257.md): In Advantech DiagAnywhere Server, Versions 3.07.11 and prior, multiple stack-based buffer overflow vulnerabilities exist in the file… (no CVSS, Advantech DiagAnywhere Server)
- [CVE-2019-7481](https://cve.now/CVE-2019-7481.md): Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. (CVSS 7.5, KEV, SonicWall SMA100)
- [CVE-2019-11657](https://cve.now/CVE-2019-11657.md): Cross-Site Request Forgery vulnerability in all Micro Focus ArcSight Logger affecting all product versions below version 7.0. (no CVSS, Micro Focus International ArcSight Logger)
- [CVE-2019-3996](https://cve.now/CVE-2019-3996.md): ELOG 3.1.4-57bea22 and below can be used as an HTTP GET request proxy when unauthenticated remote attackers send crafted HTTP POST requests. (no CVSS, ELOG)
- [CVE-2019-3995](https://cve.now/CVE-2019-3995.md): ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference. (no CVSS, ELOG)
- [CVE-2019-3994](https://cve.now/CVE-2019-3994.md): ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a use after free. (no CVSS, ELOG)
- [CVE-2019-3993](https://cve.now/CVE-2019-3993.md): ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. (no CVSS, ELOG)
- [CVE-2019-3992](https://cve.now/CVE-2019-3992.md): ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. (no CVSS, ELOG)
- [CVE-2019-17337](https://cve.now/CVE-2019-17337.md): TIBCO Spotfire Server Library Vulnerable to Reflected Cross-Site Scripting (CVSS 8.1, TIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…)
- [CVE-2019-17336](https://cve.now/CVE-2019-17336.md): TIBCO Spotfire Web Player Potentially Exposes Credentials For Shared Data Sources (CVSS 7.7, TIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…)
- [CVE-2019-17335](https://cve.now/CVE-2019-17335.md): TIBCO Spotfire Server Exposes User-Specific Cached Data To Others Users (CVSS 5.3, TIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…)
- [CVE-2019-17334](https://cve.now/CVE-2019-17334.md): TIBCO Spotfire Analyst and Desktop Remote Code Execution Via Shared Files (CVSS 7.6, TIBCO Software TIBCO Spotfire Analyst · TIBCO Software T… +2)
- [CVE-2019-0384](https://cve.now/CVE-2019-0384.md): Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions… (no CVSS, SAP SE SAP Treasury and Risk Management)
- [CVE-2019-0383](https://cve.now/CVE-2019-0383.md): Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions… (no CVSS, SAP SE SAP Treasury and Risk Management)
- [CVE-2019-19241](https://cve.now/CVE-2019-19241.md): In the Linux kernel before 5.4.2, the io\_uring feature leads to requests that inadvertently have UID 0 and full capabilities, aka… (no CVSS)
- [CVE-2019-19497](https://cve.now/CVE-2019-19497.md): MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message. (no CVSS)
- [CVE-2019-19634](https://cve.now/CVE-2019-19634.md): class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other… (no CVSS, verot/class.upload.php)
- [CVE-2019-19849](https://cve.now/CVE-2019-19849.md): An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. (CVSS 8.8, typo3/cms-core · typo3/cms)
- [CVE-2019-19850](https://cve.now/CVE-2019-19850.md): An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. (CVSS 5.5, typo3/cms · typo3/cms-core)
- [CVE-2019-19848](https://cve.now/CVE-2019-19848.md): An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. (CVSS 6.8, typo3/cms-core · typo3/cms)
- [CVE-2019-14782](https://cve.now/CVE-2019-14782.md): CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the… (no CVSS)
- [CVE-2019-15235](https://cve.now/CVE-2019-15235.md): CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from… (no CVSS)
- [CVE-2019-18670](https://cve.now/CVE-2019-18670.md): In the Quick Access Service (QAAdminAgent.exe) in Acer Quick Access V2.01.3000 through 2.01.3027 and V3.00.3000 through V3.00.3008, a… (no CVSS)
- [CVE-2019-18956](https://cve.now/CVE-2019-18956.md): Divisa Proxia Suite 9 \< 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 \< 10.0.32, and 10.1 \< 10.1.5, SparkSpace 1.0 \< 1.0.30… (no CVSS)
- [CVE-2019-19847](https://cve.now/CVE-2019-19847.md): Libspiro through 20190731 has a stack-based buffer overflow in the spiro\_to\_bpath0() function in spiro.c. (no CVSS)
- [CVE-2019-19315](https://cve.now/CVE-2019-19315.md): NLSSRV32.EXE in Nalpeiron Licensing Service 7.3.4.0, as used with Nitro PDF and other products, allows Elevation of Privilege via the… (no CVSS)
- [CVE-2019-19675](https://cve.now/CVE-2019-19675.md): In Ivanti Workspace Control before 10.3.180.0. (no CVSS)
- [CVE-2019-16576](https://cve.now/CVE-2019-16576.md): A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to… (no CVSS, Jenkins project Jenkins Alauda Kubernetes Suport Plugin · i…)
- [CVE-2019-16574](https://cve.now/CVE-2019-16574.md): A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to… (no CVSS, Jenkins project Jenkins Alauda DevOps Pipeline Plugin · com…)
- [CVE-2019-16575](https://cve.now/CVE-2019-16575.md): A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an… (no CVSS, Jenkins project Jenkins Alauda Kubernetes Suport Plugin · i…)
- [CVE-2019-16571](https://cve.now/CVE-2019-16571.md): A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an… (no CVSS, Jenkins project Jenkins RapidDeploy Plugin · org.jenkins-ci…)
- [CVE-2019-16572](https://cve.now/CVE-2019-16572.md): Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they… (no CVSS, Jenkins project Jenkins Weibo Plugin · org.jenkins-ci.plugi…)
- [CVE-2019-16573](https://cve.now/CVE-2019-16573.md): A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an… (no CVSS, Jenkins project Jenkins Alauda DevOps Pipeline Plugin · com…)
- [CVE-2019-16569](https://cve.now/CVE-2019-16569.md): A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to connect to an attacker-specified… (no CVSS, Jenkins project Jenkins Mantis Plugin · org.jenkins-ci.plug…)
- [CVE-2019-16570](https://cve.now/CVE-2019-16570.md): A cross-site request forgery vulnerability in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers to connect to an… (no CVSS, Jenkins project Jenkins RapidDeploy Plugin · org.jenkins-ci…)
- [CVE-2019-16567](https://cve.now/CVE-2019-16567.md): A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access… (no CVSS, Jenkins project Jenkins Team Concert Plugin · org.jenkins-c…)
- [CVE-2019-16568](https://cve.now/CVE-2019-16568.md): Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global… (no CVSS, Jenkins project Jenkins SCTMExecutor Plugin · hudson.plugin…)
- [CVE-2019-16565](https://cve.now/CVE-2019-16565.md): A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an… (no CVSS, Jenkins project Jenkins Team Concert Plugin · org.jenkins-c…)
- [CVE-2019-16566](https://cve.now/CVE-2019-16566.md): A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an… (no CVSS, Jenkins project Jenkins Team Concert Plugin · org.jenkins-c…)
- [CVE-2019-16563](https://cve.now/CVE-2019-16563.md): Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a… (no CVSS, Jenkins project Jenkins Mission Control Plugin · tech.andre…)
- [CVE-2019-16564](https://cve.now/CVE-2019-16564.md): Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a stored XSS… (no CVSS, Jenkins project Jenkins Pipeline Aggregator View Plugin · c…)
- [CVE-2019-16560](https://cve.now/CVE-2019-16560.md): A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection… (no CVSS, Jenkins project Jenkins WebSphere Deployer Plugin · org.jen…)
- [CVE-2019-16561](https://cve.now/CVE-2019-16561.md): Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname… (no CVSS, Jenkins project Jenkins WebSphere Deployer Plugin · org.jen…)
- [CVE-2019-16562](https://cve.now/CVE-2019-16562.md): Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored XSS… (no CVSS, Jenkins project Jenkins buildgraph-view Plugin · org.jenkin…)
- [CVE-2019-16558](https://cve.now/CVE-2019-16558.md): Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM. (no CVSS, Jenkins project Jenkins Spira Importer Plugin · com.inflect…)
- [CVE-2019-16559](https://cve.now/CVE-2019-16559.md): A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform… (no CVSS, Jenkins project Jenkins WebSphere Deployer Plugin · org.jen…)
- [CVE-2019-16556](https://cve.now/CVE-2019-16556.md): Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on… (no CVSS, Jenkins project Jenkins Rundeck Plugin · org.jenkins-ci.plu…)
- [CVE-2019-16557](https://cve.now/CVE-2019-16557.md): Jenkins Redgate SQL Change Automation Plugin 2.0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins… (no CVSS, Jenkins project Jenkins Redgate SQL Change Automation Plugi…)
- [CVE-2019-16554](https://cve.now/CVE-2019-16554.md): A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to… (no CVSS, Jenkins project Jenkins Build Failure Analyzer Plugin · com…)
- [CVE-2019-16555](https://cve.now/CVE-2019-16555.md): A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't… (no CVSS, Jenkins project Jenkins Build Failure Analyzer Plugin · com…)
- [CVE-2019-16552](https://cve.now/CVE-2019-16552.md): A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to… (no CVSS, Jenkins project Jenkins Gerrit Trigger Plugin · com.sonyeri…)
- [CVE-2019-16553](https://cve.now/CVE-2019-16553.md): A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins… (no CVSS, Jenkins project Jenkins Build Failure Analyzer Plugin · com…)
- [CVE-2019-16549](https://cve.now/CVE-2019-16549.md): Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing… (no CVSS, Jenkins project Jenkins Maven Release Plugin · org.jenkins-…)
- [CVE-2019-16550](https://cve.now/CVE-2019-16550.md): A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows… (no CVSS, Jenkins project Jenkins Maven Release Plugin · org.jenkins-…)
- [CVE-2019-16551](https://cve.now/CVE-2019-16551.md): A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an… (no CVSS, Jenkins project Jenkins Gerrit Trigger Plugin · com.sonyeri…)
- [CVE-2019-19745](https://cve.now/CVE-2019-19745.md): Contao 4.0 through 4.8.5 allows PHP local file inclusion. (no CVSS, contao/core-bundle · contao/contao)
- [CVE-2019-19714](https://cve.now/CVE-2019-19714.md): Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. (no CVSS, contao/core-bundle · contao/contao)
- [CVE-2019-19712](https://cve.now/CVE-2019-19712.md): Contao 4.0 through 4.8.5 has Insecure Permissions. (no CVSS, contao/core-bundle · contao/contao)
- [CVE-2019-19264](https://cve.now/CVE-2019-19264.md): In Simplifile RecordFusion through 2019-11-25, the logs and hist parameters allow remote attackers to access local files via a… (no CVSS)
- [CVE-2019-18833](https://cve.now/CVE-2019-18833.md): Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information exposure (issue 2 of 2).. (no CVSS)
- [CVE-2019-18832](https://cve.now/CVE-2019-18832.md): Barco ClickShare Button R9861500D01 devices before 1.9.0 have incorrect Credentials Management. (no CVSS)
- [CVE-2019-18829](https://cve.now/CVE-2019-18829.md): Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. (no CVSS)
- [CVE-2019-18825](https://cve.now/CVE-2019-18825.md): Barco ClickShare Huddle CS-100 devices before 1.9.0 and CSE-200 devices before 1.9.0 have incorrect Credentials Management. (no CVSS)
- [CVE-2019-18824](https://cve.now/CVE-2019-18824.md): Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. (no CVSS)
- [CVE-2019-19815](https://cve.now/CVE-2019-19815.md): In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause a NULL pointer dereference in f2fs\_recover\_fsync\_data in… (no CVSS)
- [CVE-2019-19816](https://cve.now/CVE-2019-19816.md): In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write… (no CVSS)
- [CVE-2019-19813](https://cve.now/CVE-2019-19813.md): In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call… (no CVSS)
- [CVE-2019-19814](https://cve.now/CVE-2019-19814.md): In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause \_\_remove\_dirty\_segment slab-out-of-bounds write access… (no CVSS)
- [CVE-2019-19830](https://cve.now/CVE-2019-19830.md): \_core\_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database. (no CVSS)
- [CVE-2019-15011](https://cve.now/CVE-2019-15011.md): The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version… (no CVSS, Atlassian Application Links)
- [CVE-2017-18107](https://cve.now/CVE-2017-18107.md): Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and… (no CVSS, Atlassian Crowd)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2019-12-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.