CVEs published November 6, 2019
112 CVEs were published on November 6, 2019: 2 critical, 4 high.
- Published
- 112
- Critical
- 2
- High
- 4
- Medium
- 4
- Low
- 1
- Unrated
- 101
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 21
- TYPO3 · typo3/cms
- 9
- Adobe Systems Incorporated Magento · magento/community-edit…
- 6
- LEADTOOLS
- 4
- Computing For Good Basic Laboratory Information System
- 3
- Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…
- 3
- Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- 3
- samba
- 3
- TYPO3
- 3
- Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- 2
Critical 2
High 4
- CVE-2019-5100An exploitable integer overflow vulnerability exists in the BMP header parsing functionality of LEADTOOLS 20.LEADTOOLS
- CVE-2019-5125An exploitable heap overflow vulnerability exists in the JPEG2000 parsing functionality of LEADTOOLS 20.LEADTOOLS
- CVE-2019-5099An exploitable integer underflow vulnerability exists in the CMP-parsing functionality of LEADTOOLS 20.LEADTOOLS
- CVE-2019-5084An exploitable heap out-of-bounds write vulnerability exists in the TIF-parsing functionality of LEADTOOLS 20.LEADTOOLS
Medium, low and unrated 106
- CVE-2019-16401Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955U
- CVE-2019-16400Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955U
- CVE-2019-18411Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page.
- CVE-2014-9013The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to c
- CVE-2014-9014Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for Word
- CVE-2019-12419Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service.Apache CXF · org.apache.cxf:cxf
- CVE-2011-2808A stale layout root is set as an input element in WebKit in Google Chrome before Blink M13 when a child of a keygen with autofocus is accessGoogle Chrome
- CVE-2019-12406Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message.Apache CXF · org.apache.cxf:cxf +1
- CVE-2009-5046JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.
- CVE-2009-5045Dump Servlet information leak in jetty before 6.1.22.
- CVE-2014-3180In kernel/compat.c in the Linux kernel before 3.17, as used in Google Chrome OS and other products, there is a possible out-of-bounds read.Linux kernel
- CVE-2018-20853An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) plugin before 2.8.2 for WordPress.
- CVE-2009-5050konversation before 1.2.3 allows attackers to cause a denial of service.
- CVE-2011-1298An Integer Overflow exists in WebKit in Google Chrome before Blink M11 in the macOS WebCore::GraphicsContext::fillRect function.
- CVE-2009-5049WebApp JSP Snoop page XSS in jetty though 6.1.21.
- CVE-2009-5048Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20.
- CVE-2019-5643C4G BLIS Improper Access ControlComputing For Good Basic Laboratory Information System
- CVE-2019-5642MAGICKRapid7 Metasploit Pro
- CVE-2016-1000037Pagure: XSS possible in file attachment endpoint
- CVE-2010-4178MySQL-GUI-tools (mysql-administrator) leaks passwords into process list after with launch of mysql text consoleMySQL-GUI-tools
- CVE-2019-6122A Username Enumeration via Error Message issue was discovered in NiceHash Miner before 2.0.3.0 because an "EMAIL DOES NOT EXIST" error messa
- CVE-2019-6121An issue was discovered in NiceHash Miner before 2.0.3.0.
- CVE-2019-6120An issue was discovered in NiceHash Miner before 2.0.3.0.
- CVE-2019-2332Memory corruption while accessing the memory as payload size is not validated before access in Snapdragon Auto, Snapdragon Compute, SnapdragQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2325Out of boundary access due to token received from ADSP and is used without validation as an index into the array in Snapdragon Auto, SnapdraQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2331Possible Integer overflow because of subtracting two integers without checking if the result would overflow or not in Snapdragon Auto, SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2323Lack of check to ensure crypto engine data passed by user is initialized can result in bus error in Snapdragon Auto, Snapdragon Compute, SnaQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2324When ADSP is compromised, the audio port index that`s returned from ADSP might be out of the valid range and leads to out of boundary accessQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- CVE-2019-2285Out of bound write issue is observed while giving information about properties that have been set so far for playing video in Snapdragon AutQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2302While processing vendor command which contains corrupted channel count, an integer overflow occurs and finally will lead to heap overflow.Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…
- CVE-2019-2275While deserializing any key blob during key operations, buffer overflow could occur exposing partial key information if any key operations aQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2283Improper validation of read and write index of tx and rx fifo`s before calculating pointer can lead to out-of-bound access in Snapdragon AutQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2249Kernel can do a memory read from arbitrary address passed by user during execution of a syscall in Snapdragon Auto, Snapdragon Compute, SnapQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2258Improper validation of array index causes OOB write and then leads to memory corruption in MMCP in Snapdragon Auto, Snapdragon Compute, SnapQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10542Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t match the contents in SnQualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…
- CVE-2019-10565Double free issue can happen when sensor power settings is freed by some thread while another thread try to access.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2246Thread start can cause invalid memory writes to arbitrary memory location since the argument is passed by user to kernel in Snapdragon Auto,Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10534Null-pointer dereference can occur while accessing the super index entry when it is not been allocated in Snapdragon Auto, Snapdragon ComputQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10541Dereference on uninitialized buffer can happen when parsing FLV clip with corrupted codec specific data in Snapdragon Auto, Snapdragon CompuQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10531Incorrect reading of system image resulting in buffer overflow when size of system image is increased in Snapdragon Auto, Snapdragon Mobile,Qualcomm Snapdragon Auto, Snapdragon Mobile, Snapdragon Wea…
- CVE-2019-10533Out of bound access due to improper validation of array index cause the index table entry to get corrupt in Snapdragon Auto, Snapdragon CompQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10528Use after free issue in kernel while accessing freed mdlog session info and its attributes after closing the session in Snapdragon Auto, SnaQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- CVE-2019-10529Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function set_page_dirty() in SnaQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10522While playing the clip which is nonstandard buffer overflow can occur while parsing in Snapdragon Auto, Snapdragon Compute, Snapdragon ConsuQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10524Lack of check for a negative value returned for get_clk is wrongly interpreted as valid pointer and lead to use after free in clk driver in Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- CVE-2019-10505Out of bound access while processing a non-standard IE measurement request with length crossing past the size of frame in Snapdragon Auto, SQualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…
- CVE-2019-10512Payload size is not checked before using it as array index in audio in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, SnapdraQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10515DCI client which might be preemptively freed up might be accessed for transferring packets leading to kernel error in Snapdragon Auto, SnapdQualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- CVE-2019-10502Possible stack overflow when an index equal to io buffer size is accessed in camera module in Snapdragon Compute, Snapdragon Consumer IOT, SQualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…
- CVE-2019-10504Firmware not able to send EXT scan response to host within 1 sec due to resource consumption issue in Snapdragon Auto, Snapdragon Consumer IQualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- CVE-2019-10495Arbitrary buffer write issue while processing sequence header during HEVC or AVC encoding.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10496Lack of checking a variable received from driver and populating in Firmware data structure leads to buffer overflow in Snapdragon Auto, SnapQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10488Null pointer dereference can occur while parsing invalid chunks while playing the nonstandard clip in Snapdragon Auto, Snapdragon Compute, SQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10491ADSP can be compromised since it`s a general-purpose CPU processing untrusted data in Snapdragon Auto, Snapdragon Compute, Snapdragon ConsumQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2010-2471Drupal versions 5.x and 6.x has open redirectiondrupal6
- CVE-2011-4904TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve TYPO3 · typo3/cms
- CVE-2011-4903Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary weTYPO3 · typo3/cms
- CVE-2010-2247makepasswd 1.10 default settings generate insecure passwordsmakepasswd
- CVE-2011-4902TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.TYPO3 · typo3/cms
- CVE-2011-4901TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 dataTYPO3 · typo3/cms
- CVE-2011-4900TYPO3 before 4.5.4 allows Information Disclosure in the backend.TYPO3 · typo3/cms
- CVE-2011-4632Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary weTYPO3 · typo3/cms
- CVE-2011-4631Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary weTYPO3
- CVE-2011-4630Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary weTYPO3 · typo3/cms
- CVE-2011-4629Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary weTYPO3
- CVE-2011-4628TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend tTYPO3 · typo3/cms
- CVE-2010-2446Rbot Reaction plugin allows command execution
- CVE-2011-4627TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend.TYPO3 · typo3/cms
- CVE-2011-4626Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary weTYPO3
- CVE-2019-18800Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Vi
- CVE-2017-18639Progress Sitefinity CMS before 10.1 allows XSS via /Pages Parameter : Page Title, /Content/News Parameter : News Title, /Content/List Parame
- CVE-2019-18797LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operator()(Sass::Binary_Expression*) in eval.cpp.
- CVE-2019-18798LibSass before 3.6.3 allows a heap-based buffer over-read in Sass::weaveParents in ast_sel_weave.cpp.
- CVE-2019-18799LibSass before 3.6.3 allows a NULL pointer dereference in Sass::Parser::parseCompoundSelector in parser_selectors.cpp.
- CVE-2015-7276Technicolor C2000T and C2100T uses hard-coded cryptographic keys.Technicolor C2000T · Technicolor C2100T
- CVE-2019-13081Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the title field in the /common/ticket_associated
- CVE-2019-13080Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via an SVG image and HTML file) that allows an authe
- CVE-2011-4625simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decryptsimplesamlphp · simplesamlphp/simplesamlphp
- CVE-2019-13079Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection.
- CVE-2019-13078Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection.
- CVE-2019-13077Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the sam_detail_titled.php SAM_TYPE parameter) th
- CVE-2019-13076Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection.
- CVE-2014-8181The kernel in Red Hat Enterprise Linux 7 and MRG-2 does not clear garbage data for SG_IO buffer, which may leaking sensitive information to Red Hat Enterprise Linux
- CVE-2019-12918Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection.
- CVE-2019-12917A reflected XSS vulnerability exists in Quest KACE Systems Management Appliance Server Center 9.1.317 affecting the userui/software_library.
- CVE-2016-4401Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain database credentials.
- CVE-2007-0899There is a possible heap overflow in libclamav/fsg.c before 0.100.0.
- CVE-2006-4245archivemail 0.6.2 uses temporary files insecurely leading to a possible race condition.archivemail
- CVE-2006-4243linux vserver 2.6 before 2.6.17 suffers from privilege escalation in remount code.linux-2.6
- CVE-2006-3100termpkg 3.3 suffers from buffer overflow.
- CVE-2019-18786In the Linux kernel through 5.3.8, f->fmt.sdr.reserved is uninitialized in rcar_drif_g_fmt_sdr_cap in drivers/media/platform/rcar_drif.c, wh
- CVE-2019-18784SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection.
- CVE-2006-0062xlockmore 5.13 allows potential xlock bypass when FVWM switches to the same virtual desktop as a new Gaim window.
- CVE-2006-0061xlockmore 5.13 and 5.22 segfaults when using libpam-opensc and returns the underlying xsession.
- CVE-2019-18650An issue was discovered in Joomla! before 3.9.13.
- CVE-2019-18674An issue was discovered in Joomla! before 3.9.13.
- CVE-2019-8132A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.Adobe Systems Incorporated Magento · magento/community-edit…
- CVE-2019-8145A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.Adobe Systems Incorporated Magento · magento/community-edit…
- CVE-2019-8158An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.Adobe Systems Incorporated Magento · magento/community-edit…
- CVE-2019-8157A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.Adobe Systems Incorporated Magento · magento/community-edit…
- CVE-2019-8156A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.Adobe Systems Incorporated Magento · magento/community-edit…
- CVE-2019-8159A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.Adobe Systems Incorporated Magento · magento/community-edit…
- CVE-2019-8227In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitraryAdobe Systems Incorporated Magento · magento/core
- CVE-2019-10218A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathsamba
- CVE-2019-14833A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user samba
- CVE-2019-14847A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10.samba