CVEs published November 8, 2019
26 CVEs were published on November 8, 2019: 0 critical, 4 high.
- Published
- 26
- Critical
- 0
- High
- 4
- Medium
- 6
- Low
- 0
- Unrated
- 16
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Brocade Communications Systems Brocade SANnav
- 6
- Apache Software Foundation Apache Arrow · pyarrow +1
- 2
- Medtronic Valleylab Exchange Client · Medtronic Valleyla… +1
- 2
- Medtronic Valleylab FT10 Energy Platform · Medtronic Valley…
- 2
- ZTE ZXUPN-9000E
- 2
- [UNKNOWN] 389-ds-base
- 1
- [UNKNOWN] openstack-mistral
- 1
- [UNKNOWN] syndesis
- 1
- Atlassian Bitbucket Server · Atlassian Jira Server +5
- 1
- hibernate-validator · org.hibernate.validator:hibernate-… +1
- 1
High 4
- CVE-2019-13539Medtronic Valleylab FT10 and FX8 Reversible One-way HashMedtronic Valleylab Exchange Client · Medtronic Valleyla… +1
- CVE-2019-17661A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control
- CVE-2019-14860It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins.[UNKNOWN] syndesis
- CVE-2019-10222A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests.The Ceph Project ceph
Medium, low and unrated 22
- CVE-2019-13531Medtronic Valleylab FT10 and LS10 Improper AuthenticationMedtronic Valleylab FT10 Energy Platform · Medtronic Valley…
- CVE-2019-13535Medtronic Valleylab FT10 and LS10 Protection Mechanism FailureMedtronic Valleylab FT10 Energy Platform · Medtronic Valley…
- CVE-2019-13543Medtronic Valleylab FT10 and FX8 Use of Hard-coded CredentialsMedtronic Valleylab Exchange Client · Medtronic Valleyla… +1
- CVE-2019-3426The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by the input validation vulnerability.ZTE ZXUPN-9000E
- CVE-2019-3425The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by vulnerability of permission and access contrZTE ZXUPN-9000E
- CVE-2019-12408It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had Apache Software Foundation Apache Arrow · pyarrow +1
- CVE-2019-12410While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, leftApache Software Foundation Apache Arrow · pyarrow +1
- CVE-2019-17327JEUS 7 Fix#0~5 and JEUS 8Fix#0~1 versions contains a directory traversal vulnerability caused by improper input parameter check when uploadiTmaxSoft JEUS
- CVE-2019-18623Escalation of privileges in EnergyCAP 7 through 7.5.6 allows an attacker to access data.
- CVE-2019-13557In Tasy EMR, Tasy WebPortal Versions 3.02.1757 and prior, there is an information exposure vulnerability which may allow a remote attacker tTasy EMR
- CVE-2019-16209A vulnerability, in The ReportsTrustManager class of Brocade SANnav versions before v2.0, could allow an attacker to perform a man-in-the-miBrocade Communications Systems Brocade SANnav
- CVE-2019-16206The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’ and the 'debug' loggBrocade Communications Systems Brocade SANnav
- CVE-2019-16205A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID.Brocade Communications Systems Brocade SANnav
- CVE-2019-16210Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save.Brocade Communications Systems Brocade SANnav
- CVE-2019-16208Password-based encryption (PBE) algorithm, of Brocade SANnav versions before v2.0, has a weakness in generating cryptographic keys that may Brocade Communications Systems Brocade SANnav
- CVE-2019-16207Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end databaseBrocade Communications Systems Brocade SANnav
- CVE-2013-1889mod_ruid2 before 0.9.8 improperly handles file descriptors which allows remote attackers to bypass security using a CGI script to break out libapache2-mod-ruid2
- CVE-2019-10219A vulnerability was found in Hibernate-Validator.hibernate-validator · org.hibernate.validator:hibernate-… +1
- CVE-2019-3866An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were m[UNKNOWN] openstack-mistral
- CVE-2019-14824A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values.[UNKNOWN] 389-ds-base
- CVE-2013-1820tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service.tuned
- CVE-2019-15005The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans anAtlassian Bitbucket Server · Atlassian Jira Server +5