CVEs published November 7, 2019
65 CVEs were published on November 7, 2019: 0 critical, 0 high.
- Published
- 65
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 64
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- drupal6
- 3
- Google Chrome
- 3
- Atlassian Jira Service Desk Server · Atlassian Jira Service…
- 2
- linux-2.6
- 2
- clamav
- 1
- frysk
- 1
- gambas3
- 1
- Google Chrome on 64-bit platforms
- 1
- HP OfficeJet Pro 8210 Printer series,HP PageWide 352dw Prin…
- 1
- HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All…
- 1
Medium, low and unrated 65
- CVE-2008-7291gri before 2.12.18 generates temporary files in an insecure way.
- CVE-2008-7272FireGPG before 0.6 handle user’s passphrase and decrypted cleartext insecurely by writing pre-encrypted cleartext and the user's passphrase
- CVE-2008-5083In JON 2.1.x before 2.1.2 SP1, users can obtain unauthorized security information about private resources managed by JBoss ON.JON
- CVE-2019-18835Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs.matrix-synapse
- CVE-2008-3278frysk packages through 2008-08-05 as shipped in Red Hat Enterprise Linux 5 are built with an insecure RPATH set in the ELF header of multiplfrysk
- CVE-2013-1811An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New".mantis
- CVE-2013-1809Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to the creation of insecgambas3
- CVE-2007-6745clamav 0.91.2 suffers from a floating point exception when using ScanOLE2.clamav
- CVE-2013-1771The web server Monkeyd produces a world-readable log (/var/log/monkeyd/master.log) on gentoo.monkey
- CVE-2007-5743viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option.
- CVE-2013-1751TWiki before 5.1.4 allows remote attackers to execute arbitrary shell commands by sending a crafted '%MAKETEXT{}%' parameter value containin
- CVE-2013-1429Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks.lintian
- CVE-2007-3915Mondo 2.24 has insecure handling of temporary files.
- CVE-2007-3732In Linux 2.6 before 2.6.23, the TRACE_IRQS_ON function in iret_exc calls a C function without ensuring that the segments are set properly.linux-2.6
- CVE-2019-18818strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-pstrapi
- CVE-2018-18674GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board tail contents" parameter, aka t
- CVE-2013-1426Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via mahara
- CVE-2019-18819Eximious Logo Designer 3.82 has a User Mode Write AV starting at ExiVectorRender!StrokeText_Blend+0x00000000000003a7.
- CVE-2019-18821Eximious Logo Designer 3.82 has a User Mode Write AV starting at ExiCustomPathLib!ExiCustomPathLib::CGradientColorsProfile::BuildGradientCol
- CVE-2019-18820Eximious Logo Designer 3.82 has Heap Corruption starting at ntdll!RtlpNtMakeTemporaryKey+0x0000000000001a78.
- CVE-2013-1425ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions.ldap-git-backup
- CVE-2010-2476syscp 1.4.2.1 allows attackers to add arbitrary paths via the documentroot of a domain by appending a colon to it and setting the open basedsyscp
- CVE-2010-2450The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which i
- CVE-2010-2449Gource through 0.26 logs to a predictable file name (/tmp/gource-$UID.tmp), enabling attackers to overwrite an arbitrary file via a symlink
- CVE-2010-2447gitolite before 1.4.1 does not filter src/ or hooks/ from path names.
- CVE-2019-3422The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019.ZTE MF910S
- CVE-2019-3465Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographicRob Richards XmlSecLibs · robrichards/xmlseclibs
- CVE-2019-11996Potential security vulnerabilities have been identified with HPE Nimble Storage systems in multi array group configurations.HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All…
- CVE-2010-2473Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances.drupal6
- CVE-2019-3764Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an impropeIntegrated Dell Remote Access Controller
- CVE-2010-2472Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of languagdrupal6
- CVE-2010-2250Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL andrupal6
- CVE-2011-2336An issue exists in WebKit in Google Chrome before Blink M12.Google Chrome
- CVE-2012-0051Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval.tahoe-lafs
- CVE-2012-0049OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server.openttd
- CVE-2011-2337A wrong type is used for a return value from strlen in WebKit in Google Chrome before Blink M12 on 64-bit platforms.Google Chrome on 64-bit platforms
- CVE-2010-2243A vulnerability exists in kernel/time/clocksource.c in the Linux kernel before 2.6.34 where on non-GENERIC_TIME systems (GENERIC_TIME=n), aclinux-2.6
- CVE-2011-2353Use after free vulnerability in documentloader in WebKit in Google Chrome before Blink M13 in DocumentWriter::replaceDocument function.Google Chrome
- CVE-2011-2807Incorrect handling of timer information in Timer.cpp in WebKit in Google Chrome before Blink M13.Google Chrome
- CVE-2019-18815PopojiCMS 2.0.1 allows refer= Open Redirection.
- CVE-2019-18816po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post[1][content]= stored XSS.
- CVE-2019-18806A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c in the Linux kernel before 5.3.5 allows loca
- CVE-2019-18807Two memory leaks in the sja1105_static_config_upload() function in drivers/net/dsa/sja1105/sja1105_spi.c in the Linux kernel before 5.3.5 al
- CVE-2019-18808A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel through 5.3.9 allows attackers to cause
- CVE-2019-18809A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attacke
- CVE-2019-18810A memory leak in the komeda_wb_connector_add() function in drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c in the Linux kernel befo
- CVE-2019-18811A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cau
- CVE-2019-18812A memory leak in the sof_dfsentry_write() function in sound/soc/sof/debug.c in the Linux kernel through 5.3.9 allows attackers to cause a de
- CVE-2019-18813A memory leak in the dwc3_pci_probe() function in drivers/usb/dwc3/dwc3-pci.c in the Linux kernel through 5.3.9 allows attackers to cause a
- CVE-2019-18814An issue was discovered in the Linux kernel through 5.3.9.
- CVE-2019-17604An Insecure Direct Object Reference (IDOR) vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to change other candidat
- CVE-2019-17605A mass assignment vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to take over another candidate's account (by also
- CVE-2019-16877Portainer before 1.22.1 has Incorrect Access Control (issue 4 of 4).
- CVE-2019-16878Portainer before 1.22.1 has XSS (issue 2 of 2).
- CVE-2019-16876Portainer before 1.22.1 allows Directory Traversal.
- CVE-2019-16872Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4).
- CVE-2019-17222An issue was discovered on Intelbras WRN 150 1.0.17 devices.
- CVE-2019-16874Portainer before 1.22.1 has Incorrect Access Control (issue 2 of 4).
- CVE-2019-16873Portainer before 1.22.1 has XSS (issue 1 of 2).
- CVE-2019-6337For the printers listed a maliciously crafted print file might cause certain HP Inkjet printers to assert.HP OfficeJet Pro 8210 Printer series,HP PageWide 352dw Prin…
- CVE-2019-12331PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue.phpoffice/phpspreadsheet · phpoffice/phpexcel
- CVE-2019-18805An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11.
- CVE-2019-18804DjVuLibre 3.5.27 has a NULL pointer dereference in the function DJVU::filter_fv at IW44EncodeCodec.cpp.
- CVE-2019-15004The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.1Atlassian Jira Service Desk Server · Atlassian Jira Service…
- CVE-2019-15003The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.1Atlassian Jira Service Desk Server · Atlassian Jira Service…