# CVEs published 2019-11-04

43 CVEs were published on November 4, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2010-3669](https://cve.now/CVE-2010-3669.md): TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS and Open Redirection in the frontend login box. (no CVSS)
- [CVE-2010-3668](https://cve.now/CVE-2010-3668.md): TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Header Injection in the secure download feature j (no CVSS)
- [CVE-2010-3667](https://cve.now/CVE-2010-3667.md): TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Spam Abuse in the native form content element. (no CVSS, typo3/cms-frontend)
- [CVE-2010-3666](https://cve.now/CVE-2010-3666.md): TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness in the uniqid function. (no CVSS, typo3/cms-install)
- [CVE-2010-3665](https://cve.now/CVE-2010-3665.md): TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the Extension Manager. (no CVSS)
- [CVE-2010-3664](https://cve.now/CVE-2010-3664.md): TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Information Disclosure on the backend. (no CVSS, typo3/cms-backend)
- [CVE-2010-3663](https://cve.now/CVE-2010-3663.md): TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileD (no CVSS, typo3/cms-backend)
- [CVE-2013-4374](https://cve.now/CVE-2013-4374.md): An insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25 when unpacking zipped files. (no CVSS, RHQ Mongo DB Drift Server)
- [CVE-2010-3662](https://cve.now/CVE-2010-3662.md): TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend. (no CVSS, typo3/cms-backend)
- [CVE-2013-4409](https://cve.now/CVE-2013-4409.md): An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON request (no CVSS, Python Software Foundation; Beanbag Djblets · Python Sof… +2)
- [CVE-2015-8980](https://cve.now/CVE-2015-8980.md): The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code. (no CVSS, php-gettext)
- [CVE-2017-5332](https://cve.now/CVE-2017-5332.md): The extract\_group\_icon\_cursor\_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local use (no CVSS, Debian icoutils)
- [CVE-2017-5331](https://cve.now/CVE-2017-5331.md): Integer overflow in the check\_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of ser (no CVSS, Debian icoutils)
- [CVE-2017-5333](https://cve.now/CVE-2017-5333.md): Integer overflow in the extract\_group\_icon\_cursor\_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to (no CVSS, Debian icoutils)
- [CVE-2019-17210](https://cve.now/CVE-2019-17210.md): A denial-of-service issue was discovered in the MQTT library in Arm Mbed OS 2017-11-02. (no CVSS)
- [CVE-2019-18178](https://cve.now/CVE-2019-18178.md): Real Time Engineers FreeRTOS+FAT 160919a has a use after free. (no CVSS)
- [CVE-2013-4251](https://cve.now/CVE-2013-4251.md): The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories. (no CVSS, SciPy)
- [CVE-2019-18663](https://cve.now/CVE-2019-18663.md): A SQL injection vulnerability in a /login/forgot1 POST request in ARP-GUARD 4.0.0-5 allows unauthenticated remote attackers to execute arbit (no CVSS)
- [CVE-2013-4280](https://cve.now/CVE-2013-4280.md): Insecure temporary file vulnerability in RedHat vsdm 4.9.6. (no CVSS, RedHat vdsm)
- [CVE-2005-4890](https://cve.now/CVE-2005-4890.md): There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". (no CVSS, Red Hat shadow · Red Hat sudo)
- [CVE-2019-13497](https://cve.now/CVE-2019-13497.md): One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows CSRF for logout requests. (no CVSS)
- [CVE-2019-13496](https://cve.now/CVE-2019-13496.md): One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows OTP bypass via vectors involving a man in the middle, the One Identity Defend (no CVSS)
- [CVE-2013-2257](https://cve.now/CVE-2013-2257.md): Cryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force Weakness (no CVSS, Cryptocat)
- [CVE-2013-2258](https://cve.now/CVE-2013-2258.md): Cryptocat before 2.0.22 has Nickname User Impersonation (no CVSS, Cryptocat)
- [CVE-2013-2259](https://cve.now/CVE-2013-2259.md): Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation Overview (no CVSS, Cryptocat)
- [CVE-2013-4105](https://cve.now/CVE-2013-4105.md): Cryptocat before 2.0.22 has Multiparty Encryption Scheme Information Disclosure (no CVSS, Cryptocat)
- [CVE-2013-2260](https://cve.now/CVE-2013-2260.md): Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy Weakness (no CVSS, Cryptocat)
- [CVE-2019-18684](https://cve.now/CVE-2019-18684.md): Sudo through 1.8.29 allows local users to escalate to root if they have write access to file descriptor 3 of the sudo process. (no CVSS)
- [CVE-2013-2262](https://cve.now/CVE-2013-2262.md): Cryptocat strophe.js before 2.0.22 has information disclosure (no CVSS, Cryptocat)
- [CVE-2013-2261](https://cve.now/CVE-2013-2261.md): Cryptocat before 2.0.22 Chrome Extension 'img/keygen.gif' has Information Disclosure (no CVSS)
- [CVE-2013-4104](https://cve.now/CVE-2013-4104.md): Cryptocat before 2.0.22 has weak encryption in the Socialist Millionnaire Protocol (no CVSS)
- [CVE-2019-18683](https://cve.now/CVE-2019-18683.md): An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. (no CVSS)
- [CVE-2013-4100](https://cve.now/CVE-2013-4100.md): Cryptocat before 2.0.22 has Remote Denial of Service via username (no CVSS)
- [CVE-2013-4101](https://cve.now/CVE-2013-4101.md): Cryptocat before 2.0.22 Link Markup Decorator HTML Handling Weakness (no CVSS)
- [CVE-2013-4102](https://cve.now/CVE-2013-4102.md): Cryptocat before 2.0.22 strophe.js Math.random() Random Number Generator Weakness (no CVSS)
- [CVE-2018-19031](https://cve.now/CVE-2018-19031.md): A command injection vulnerability exists when the authorized user passes crafted parameter to background process in the router. (no CVSS, 360 Security Technology 360 Safe Router)
- [CVE-2013-4103](https://cve.now/CVE-2013-4103.md): Cryptocat before 2.0.22 has Remote Script Injection due to improperly sanitizing user input (no CVSS)
- [CVE-2019-0350](https://cve.now/CVE-2019-0350.md): SAP HANA Database, versions 1.0, 2.0, allows an unauthorized attacker to send a malformed connection request, which crashes the indexserver (no CVSS, SAP SE SAP HANA Database)
- [CVE-2019-18680](https://cve.now/CVE-2019-18680.md): An issue was discovered in the Linux kernel 4.4.x before 4.4.195. (no CVSS)
- [CVE-2014-3649](https://cve.now/CVE-2014-3649.md): JBoss AeroGear has reflected XSS via the password field (no CVSS, JBoss AeroGear)
- [CVE-2013-4518](https://cve.now/CVE-2013-4518.md): RHUI (Red Hat Update Infrastructure) 2.1.3 has world readable PKI entitlement certificates (no CVSS, RHUI)
- [CVE-2013-4423](https://cve.now/CVE-2013-4423.md): CloudForms stores user passwords in recoverable format (no CVSS, CloudForms)
- [CVE-2013-4412](https://cve.now/CVE-2013-4412.md): slim has NULL pointer dereference when using crypt() method from glibc 2.17 (no CVSS, slim)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-11-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.