CVEs published November 11, 2019
10 CVEs were published on November 11, 2019: 0 critical, 0 high.
- Published
- 10
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 10
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- chartkick
- 1
- enshrined/svg-sanitize
- 1
Medium, low and unrated 10
- CVE-2019-18862maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode.
- CVE-2019-18853ImageMagick before 7.0.9-0 allows remote attackers to cause a denial of service because XML_PARSE_HUGE is not properly restricted in coders/
- CVE-2019-18854A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion f
- CVE-2019-18855A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted
- CVE-2019-18856A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to external resources
- CVE-2019-18857darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as inenshrined/svg-sanitize
- CVE-2019-18852Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/image_sign or /etc/alpha_config
- CVE-2019-18849In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winma
- CVE-2019-18836Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep
- CVE-2019-18841Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution.chartkick