# CVEs published 2019-11-07

65 CVEs were published on November 7, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2008-7291](https://cve.now/CVE-2008-7291.md): gri before 2.12.18 generates temporary files in an insecure way. (no CVSS)
- [CVE-2008-7272](https://cve.now/CVE-2008-7272.md): FireGPG before 0.6 handle user’s passphrase and decrypted cleartext insecurely by writing pre-encrypted cleartext and the user's passphrase (no CVSS)
- [CVE-2008-5083](https://cve.now/CVE-2008-5083.md): In JON 2.1.x before 2.1.2 SP1, users can obtain unauthorized security information about private resources managed by JBoss ON. (no CVSS, JON)
- [CVE-2019-18835](https://cve.now/CVE-2019-18835.md): Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. (no CVSS, matrix-synapse)
- [CVE-2008-3278](https://cve.now/CVE-2008-3278.md): frysk packages through 2008-08-05 as shipped in Red Hat Enterprise Linux 5 are built with an insecure RPATH set in the ELF header of multipl (no CVSS, frysk)
- [CVE-2013-1811](https://cve.now/CVE-2013-1811.md): An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New". (no CVSS, mantis)
- [CVE-2013-1809](https://cve.now/CVE-2013-1809.md): Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to the creation of insec (no CVSS, gambas3)
- [CVE-2007-6745](https://cve.now/CVE-2007-6745.md): clamav 0.91.2 suffers from a floating point exception when using ScanOLE2. (no CVSS, clamav)
- [CVE-2013-1771](https://cve.now/CVE-2013-1771.md): The web server Monkeyd produces a world-readable log (/var/log/monkeyd/master.log) on gentoo. (no CVSS, monkey)
- [CVE-2007-5743](https://cve.now/CVE-2007-5743.md): viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option. (no CVSS)
- [CVE-2013-1751](https://cve.now/CVE-2013-1751.md): TWiki before 5.1.4 allows remote attackers to execute arbitrary shell commands by sending a crafted '%MAKETEXT{}%' parameter value containin (no CVSS)
- [CVE-2013-1429](https://cve.now/CVE-2013-1429.md): Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks. (no CVSS, lintian)
- [CVE-2007-3915](https://cve.now/CVE-2007-3915.md): Mondo 2.24 has insecure handling of temporary files. (no CVSS)
- [CVE-2007-3732](https://cve.now/CVE-2007-3732.md): In Linux 2.6 before 2.6.23, the TRACE\_IRQS\_ON function in iret\_exc calls a C function without ensuring that the segments are set properly. (no CVSS, linux-2.6)
- [CVE-2019-18818](https://cve.now/CVE-2019-18818.md): strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-p (no CVSS, strapi)
- [CVE-2018-18674](https://cve.now/CVE-2018-18674.md): GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board tail contents" parameter, aka t (no CVSS)
- [CVE-2013-1426](https://cve.now/CVE-2013-1426.md): Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via (no CVSS, mahara)
- [CVE-2019-18819](https://cve.now/CVE-2019-18819.md): Eximious Logo Designer 3.82 has a User Mode Write AV starting at ExiVectorRender!StrokeText\_Blend+0x00000000000003a7. (no CVSS)
- [CVE-2019-18821](https://cve.now/CVE-2019-18821.md): Eximious Logo Designer 3.82 has a User Mode Write AV starting at ExiCustomPathLib!ExiCustomPathLib::CGradientColorsProfile::BuildGradientCol (no CVSS)
- [CVE-2019-18820](https://cve.now/CVE-2019-18820.md): Eximious Logo Designer 3.82 has Heap Corruption starting at ntdll!RtlpNtMakeTemporaryKey+0x0000000000001a78. (no CVSS)
- [CVE-2013-1425](https://cve.now/CVE-2013-1425.md): ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions. (no CVSS, ldap-git-backup)
- [CVE-2010-2476](https://cve.now/CVE-2010-2476.md): syscp 1.4.2.1 allows attackers to add arbitrary paths via the documentroot of a domain by appending a colon to it and setting the open based (no CVSS, syscp)
- [CVE-2010-2450](https://cve.now/CVE-2010-2450.md): The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which i (no CVSS)
- [CVE-2010-2449](https://cve.now/CVE-2010-2449.md): Gource through 0.26 logs to a predictable file name (/tmp/gource-$UID.tmp), enabling attackers to overwrite an arbitrary file via a symlink (no CVSS)
- [CVE-2010-2447](https://cve.now/CVE-2010-2447.md): gitolite before 1.4.1 does not filter src/ or hooks/ from path names. (no CVSS)
- [CVE-2019-3422](https://cve.now/CVE-2019-3422.md): The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. (no CVSS, ZTE MF910S)
- [CVE-2019-3465](https://cve.now/CVE-2019-3465.md): Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic (no CVSS, Rob Richards XmlSecLibs · robrichards/xmlseclibs)
- [CVE-2019-11996](https://cve.now/CVE-2019-11996.md): Potential security vulnerabilities have been identified with HPE Nimble Storage systems in multi array group configurations. (no CVSS, HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All…)
- [CVE-2010-2473](https://cve.now/CVE-2010-2473.md): Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances. (no CVSS, drupal6)
- [CVE-2019-3764](https://cve.now/CVE-2019-3764.md): Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an imprope (CVSS 5.0, Integrated Dell Remote Access Controller)
- [CVE-2010-2472](https://cve.now/CVE-2010-2472.md): Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of languag (no CVSS, drupal6)
- [CVE-2010-2250](https://cve.now/CVE-2010-2250.md): Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL an (no CVSS, drupal6)
- [CVE-2011-2336](https://cve.now/CVE-2011-2336.md): An issue exists in WebKit in Google Chrome before Blink M12. (no CVSS, Google Chrome)
- [CVE-2012-0051](https://cve.now/CVE-2012-0051.md): Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval. (no CVSS, tahoe-lafs)
- [CVE-2012-0049](https://cve.now/CVE-2012-0049.md): OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server. (no CVSS, openttd)
- [CVE-2011-2337](https://cve.now/CVE-2011-2337.md): A wrong type is used for a return value from strlen in WebKit in Google Chrome before Blink M12 on 64-bit platforms. (no CVSS, Google Chrome on 64-bit platforms)
- [CVE-2010-2243](https://cve.now/CVE-2010-2243.md): A vulnerability exists in kernel/time/clocksource.c in the Linux kernel before 2.6.34 where on non-GENERIC\_TIME systems (GENERIC\_TIME=n), ac (no CVSS, linux-2.6)
- [CVE-2011-2353](https://cve.now/CVE-2011-2353.md): Use after free vulnerability in documentloader in WebKit in Google Chrome before Blink M13 in DocumentWriter::replaceDocument function. (no CVSS, Google Chrome)
- [CVE-2011-2807](https://cve.now/CVE-2011-2807.md): Incorrect handling of timer information in Timer.cpp in WebKit in Google Chrome before Blink M13. (no CVSS, Google Chrome)
- [CVE-2019-18815](https://cve.now/CVE-2019-18815.md): PopojiCMS 2.0.1 allows refer= Open Redirection. (no CVSS)
- [CVE-2019-18816](https://cve.now/CVE-2019-18816.md): po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post\[1\]\[content\]= stored XSS. (no CVSS)
- [CVE-2019-18806](https://cve.now/CVE-2019-18806.md): A memory leak in the ql\_alloc\_large\_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c in the Linux kernel before 5.3.5 allows loca (no CVSS)
- [CVE-2019-18807](https://cve.now/CVE-2019-18807.md): Two memory leaks in the sja1105\_static\_config\_upload() function in drivers/net/dsa/sja1105/sja1105\_spi.c in the Linux kernel before 5.3.5 al (no CVSS)
- [CVE-2019-18808](https://cve.now/CVE-2019-18808.md): A memory leak in the ccp\_run\_sha\_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel through 5.3.9 allows attackers to cause (no CVSS)
- [CVE-2019-18809](https://cve.now/CVE-2019-18809.md): A memory leak in the af9005\_identify\_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attacke (no CVSS)
- [CVE-2019-18810](https://cve.now/CVE-2019-18810.md): A memory leak in the komeda\_wb\_connector\_add() function in drivers/gpu/drm/arm/display/komeda/komeda\_wb\_connector.c in the Linux kernel befo (no CVSS)
- [CVE-2019-18811](https://cve.now/CVE-2019-18811.md): A memory leak in the sof\_set\_get\_large\_ctrl\_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cau (no CVSS)
- [CVE-2019-18812](https://cve.now/CVE-2019-18812.md): A memory leak in the sof\_dfsentry\_write() function in sound/soc/sof/debug.c in the Linux kernel through 5.3.9 allows attackers to cause a de (no CVSS)
- [CVE-2019-18813](https://cve.now/CVE-2019-18813.md): A memory leak in the dwc3\_pci\_probe() function in drivers/usb/dwc3/dwc3-pci.c in the Linux kernel through 5.3.9 allows attackers to cause a (no CVSS)
- [CVE-2019-18814](https://cve.now/CVE-2019-18814.md): An issue was discovered in the Linux kernel through 5.3.9. (no CVSS)
- [CVE-2019-17604](https://cve.now/CVE-2019-17604.md): An Insecure Direct Object Reference (IDOR) vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to change other candidat (no CVSS)
- [CVE-2019-17605](https://cve.now/CVE-2019-17605.md): A mass assignment vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to take over another candidate's account (by also (no CVSS)
- [CVE-2019-16877](https://cve.now/CVE-2019-16877.md): Portainer before 1.22.1 has Incorrect Access Control (issue 4 of 4). (no CVSS)
- [CVE-2019-16878](https://cve.now/CVE-2019-16878.md): Portainer before 1.22.1 has XSS (issue 2 of 2). (no CVSS)
- [CVE-2019-16876](https://cve.now/CVE-2019-16876.md): Portainer before 1.22.1 allows Directory Traversal. (no CVSS)
- [CVE-2019-16872](https://cve.now/CVE-2019-16872.md): Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4). (no CVSS)
- [CVE-2019-17222](https://cve.now/CVE-2019-17222.md): An issue was discovered on Intelbras WRN 150 1.0.17 devices. (no CVSS)
- [CVE-2019-16874](https://cve.now/CVE-2019-16874.md): Portainer before 1.22.1 has Incorrect Access Control (issue 2 of 4). (no CVSS)
- [CVE-2019-16873](https://cve.now/CVE-2019-16873.md): Portainer before 1.22.1 has XSS (issue 1 of 2). (no CVSS)
- [CVE-2019-6337](https://cve.now/CVE-2019-6337.md): For the printers listed a maliciously crafted print file might cause certain HP Inkjet printers to assert. (no CVSS, HP OfficeJet Pro 8210 Printer series,HP PageWide 352dw Prin…)
- [CVE-2019-12331](https://cve.now/CVE-2019-12331.md): PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. (no CVSS, phpoffice/phpspreadsheet · phpoffice/phpexcel)
- [CVE-2019-18805](https://cve.now/CVE-2019-18805.md): An issue was discovered in net/ipv4/sysctl\_net\_ipv4.c in the Linux kernel before 5.0.11. (no CVSS)
- [CVE-2019-18804](https://cve.now/CVE-2019-18804.md): DjVuLibre 3.5.27 has a NULL pointer dereference in the function DJVU::filter\_fv at IW44EncodeCodec.cpp. (no CVSS)
- [CVE-2019-15004](https://cve.now/CVE-2019-15004.md): The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.1 (no CVSS, Atlassian Jira Service Desk Server · Atlassian Jira Service…)
- [CVE-2019-15003](https://cve.now/CVE-2019-15003.md): The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.1 (no CVSS, Atlassian Jira Service Desk Server · Atlassian Jira Service…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-11-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.