CVEs published November 4, 2019
43 CVEs were published on November 4, 2019: 0 critical, 0 high.
- Published
- 43
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 43
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- Cryptocat
- 6
- Debian icoutils
- 3
- typo3/cms-backend
- 3
- 360 Security Technology 360 Safe Router
- 1
- CloudForms
- 1
- JBoss AeroGear
- 1
- php-gettext
- 1
- Python Software Foundation; Beanbag Djblets · Python Sof… +2
- 1
- Red Hat shadow · Red Hat sudo
- 1
- RedHat vdsm
- 1
Medium, low and unrated 43
- CVE-2010-3669TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS and Open Redirection in the frontend login box.
- CVE-2010-3668TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Header Injection in the secure download feature j
- CVE-2010-3667TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Spam Abuse in the native form content element.typo3/cms-frontend
- CVE-2010-3666TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness in the uniqid function.typo3/cms-install
- CVE-2010-3665TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the Extension Manager.
- CVE-2010-3664TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Information Disclosure on the backend.typo3/cms-backend
- CVE-2010-3663TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDtypo3/cms-backend
- CVE-2013-4374An insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25 when unpacking zipped files.RHQ Mongo DB Drift Server
- CVE-2010-3662TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend.typo3/cms-backend
- CVE-2013-4409An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requestPython Software Foundation; Beanbag Djblets · Python Sof… +2
- CVE-2015-8980The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code.php-gettext
- CVE-2017-5332The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local useDebian icoutils
- CVE-2017-5331Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of serDebian icoutils
- CVE-2017-5333Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to Debian icoutils
- CVE-2019-17210A denial-of-service issue was discovered in the MQTT library in Arm Mbed OS 2017-11-02.
- CVE-2019-18178Real Time Engineers FreeRTOS+FAT 160919a has a use after free.
- CVE-2013-4251The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories.SciPy
- CVE-2019-18663A SQL injection vulnerability in a /login/forgot1 POST request in ARP-GUARD 4.0.0-5 allows unauthenticated remote attackers to execute arbit
- CVE-2013-4280Insecure temporary file vulnerability in RedHat vsdm 4.9.6.RedHat vdsm
- CVE-2005-4890There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program".Red Hat shadow · Red Hat sudo
- CVE-2019-13497One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows CSRF for logout requests.
- CVE-2019-13496One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows OTP bypass via vectors involving a man in the middle, the One Identity Defend
- CVE-2013-2257Cryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force WeaknessCryptocat
- CVE-2013-2258Cryptocat before 2.0.22 has Nickname User ImpersonationCryptocat
- CVE-2013-2259Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation OverviewCryptocat
- CVE-2013-4105Cryptocat before 2.0.22 has Multiparty Encryption Scheme Information DisclosureCryptocat
- CVE-2013-2260Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy WeaknessCryptocat
- CVE-2019-18684Sudo through 1.8.29 allows local users to escalate to root if they have write access to file descriptor 3 of the sudo process.
- CVE-2013-2262Cryptocat strophe.js before 2.0.22 has information disclosureCryptocat
- CVE-2013-2261Cryptocat before 2.0.22 Chrome Extension 'img/keygen.gif' has Information Disclosure
- CVE-2013-4104Cryptocat before 2.0.22 has weak encryption in the Socialist Millionnaire Protocol
- CVE-2019-18683An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8.
- CVE-2013-4100Cryptocat before 2.0.22 has Remote Denial of Service via username
- CVE-2013-4101Cryptocat before 2.0.22 Link Markup Decorator HTML Handling Weakness
- CVE-2013-4102Cryptocat before 2.0.22 strophe.js Math.random() Random Number Generator Weakness
- CVE-2018-19031A command injection vulnerability exists when the authorized user passes crafted parameter to background process in the router.360 Security Technology 360 Safe Router
- CVE-2013-4103Cryptocat before 2.0.22 has Remote Script Injection due to improperly sanitizing user input
- CVE-2019-0350SAP HANA Database, versions 1.0, 2.0, allows an unauthorized attacker to send a malformed connection request, which crashes the indexserver SAP SE SAP HANA Database
- CVE-2019-18680An issue was discovered in the Linux kernel 4.4.x before 4.4.195.
- CVE-2014-3649JBoss AeroGear has reflected XSS via the password fieldJBoss AeroGear
- CVE-2013-4518RHUI (Red Hat Update Infrastructure) 2.1.3 has world readable PKI entitlement certificatesRHUI
- CVE-2013-4423CloudForms stores user passwords in recoverable formatCloudForms
- CVE-2013-4412slim has NULL pointer dereference when using crypt() method from glibc 2.17slim