CVEs published November 12, 2019
138 CVEs were published on November 12, 2019: 0 critical, 7 high. 4 are now in CISA KEV.
- Published
- 138
- Critical
- 0
- High
- 7
- Medium
- 3
- Low
- 0
- Unrated
- 128
- Now in CISA KEV
- 4
- Fix available
- 8
Most affected products
- Microsoft Windows
- 48
- Microsoft Windows Server · Microsoft Windows
- 5
- Google Chrome
- 4
- Microsoft Office
- 3
- Lenovo ThinkPad
- 2
- mailscanner
- 2
- Microsoft Internet Explorer
- 2
- Microsoft Office Online Server
- 2
- P30
- 2
- TIBCO Software TIBCO EBX Add-ons
- 2
High 7
- CVE-2019-17332TIBCO EBX Add-on For Digital Asset Manager Cross-Site Scripting VulnerabilitiesTIBCO Software TIBCO EBX Add-ons
- CVE-2019-17331TIBCO EBX Add-on For Data Exchange Cross-Site Scripting VulnerabilitiesTIBCO Software TIBCO EBX Add-ons
- CVE-2019-17330TIBCO EBX Exposes Multiple Cross-Site Scripting VulnerabilitiesTIBCO Software TIBCO EBX
- CVE-2019-1429A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2019-1405An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creationMicrosoft Windows
- CVE-2019-1385An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resultiMicrosoft Windows
- CVE-2019-1388An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'WinMicrosoft Windows
Medium, low and unrated 131
- CVE-2019-5246Smartphones with software of ELLE-AL00B 9.1.0.109(C00E106R1P21), 9.1.0.113(C00E110R1P21), 9.1.0.125(C00E120R1P21), 9.1.0.135(C00E130R1P21), ELLE-AL00B
- CVE-2019-5233Huawei smartphones with versions earlier than Taurus-AL00B 10.0.0.41(SP2C00E41R3P2) have an improper authentication vulnerability.Taurus-AL00B
- CVE-2019-5231P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.186(C00E180R2P1) have an improper authorization vulnerability.P30
- CVE-2019-5230P20 Pro, P20, Mate RS smartphones with versions earlier than Charlotte-AL00A 9.1.0.321(C00E320R1P1T8), versions earlier than Emily-AL00A 9.1P20 Pro, P20, Mate RS
- CVE-2019-5229P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1) have an insufficient verification vulnerability.P30
- CVE-2019-5213Honor play smartphones with versions earlier than Cornell-AL00A 9.1.0.321(C00E320R1P1T8) have an insufficient authentication vulnerability.Honor play
- CVE-2019-5228Certain detection module of P30, P30 Pro, Honor V20 smartphone whith Versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), Versions earlP30, P30 Pro, Honor
- CVE-2010-4177mysql-gui-tools (mysql-query-browser and mysql-admin) before 5.0r14+openSUSE-2.3 exposes the password of a user connected to the MySQL servemysql-gui-tools
- CVE-2010-3857JBoss BRMS before 5.1.0 has a XSS vulnerability via asset=UUID parameter.JBoss BRMS
- CVE-2017-17224Some Huawei smart phones with versions earlier than Harry-AL00C 9.1.0.206(C00E205R3P1) have a null pointer dereference vulnerability.Huawei HG655m
- CVE-2010-3844An unchecked sscanf() call in ettercap before 0.7.5 allows an insecure temporary settings file to overflow a static-sized buffer on the stacettercap
- CVE-2011-1802WebKit in Google Chrome before Blink M11 and M12 does not properly handle counter nodes, which allows remote attackers to cause a denial of Google Chrome
- CVE-2010-3440babiloo 2.0.9 before 2.0.11 creates temporary files with predictable names when downloading and unpacking dictionary files, allowing a localbabiloo
- CVE-2011-1803An issue exists in third_party/WebKit/Source/WebCore/svg/animation/SVGSMILElement.h in WebKit in Google Chrome before Blink M11 and M12 whenGoogle Chrome
- CVE-2010-3305Cross-site request forgery (CSRF) vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password.pixelpost
- CVE-2011-2334Use after free vulnerability exists in WebKit in Google Chrome before Blink M12 in RenderLayerwhen removing elements with reflections.Google Chrome
- CVE-2010-3299The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.rails
- CVE-2019-14365The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code.
- CVE-2019-14366WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code.
- CVE-2019-14367Slack-Chat through 1.5.5 leaks a Slack Access Token in source code.
- CVE-2019-6188ThinkPad T460p and T470p BIOS Tamper MechanismLenovo ThinkPad T470p · Lenovo ThinkPad T460p
- CVE-2019-6170A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some Lenovo ThinkPad
- CVE-2019-6172A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad
- CVE-2010-3292The update{_bad,}_phishing_sites scripts in mailscanner 4.79.11-2 downloads files and trusts them without using encryption (e.g., https) or mailscanner
- CVE-2010-3095mailscanner before 4.79.11-2.1 might allow local users to overwrite arbitrary files via a symlink attack on certain temporary files.mailscanner
- CVE-2019-5695NVIDIA GeForce Experience (prior to 3.20.1) and Windows GPU Display Driver (all versions) contains a vulnerability in the local service provNVIDIA GeForce Experience · NVIDIA Windows GPU Display Driv…
- CVE-2010-3439It is possible to cause a DoS condition by causing the server to crash in alien-arena 7.33 by supplying various invalid parameters to the doalien-arena
- CVE-2011-2335A double-free vulnerability exists in WebKit in Google Chrome before Blink M12 in the WebCore::CSSSelector function.Google Chrome
- CVE-2010-2488NULL pointer dereference vulnerability in ZNC before 0.092 caused by traffic stats when there are unauthenticated connections.znc
- CVE-2010-3438libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds.libpoe-component-irc-perl
- CVE-2019-1456A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially cMicrosoft Windows
- CVE-2019-1457A security feature bypass vulnerability exists in Microsoft Office software by not enforcing macro settings on an Excel document, aka 'MicroMicrosoft Office
- CVE-2019-1448A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel · Microsoft Office
- CVE-2019-1449A security feature bypass vulnerability exists in the way that Office Click-to-Run (C2R) components handle a specially crafted file, which cMicrosoft Office
- CVE-2019-1446An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel InMicrosoft Excel · Microsoft Office +2
- CVE-2019-1447A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'MicrosofMicrosoft Office Online Server
- CVE-2019-1443An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint SMicrosoft SharePoint Foundation · Microsoft SharePoint E… +1
- CVE-2019-1445A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'MicrosofMicrosoft Office Online Server
- CVE-2019-1441A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k Microsoft Windows
- CVE-2019-1442A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafMicrosoft SharePoint Server
- CVE-2019-1439An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-1440An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information DisMicrosoft Windows
- CVE-2019-1437An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows GraphiMicrosoft Windows
- CVE-2019-1438An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows GraphiMicrosoft Windows
- CVE-2019-1435An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows GraphiMicrosoft Windows
- CVE-2019-1436An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information DisMicrosoft Windows
- CVE-2019-1432An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite InformatioMicrosoft Windows
- CVE-2019-1433An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows GraphiMicrosoft Windows
- CVE-2019-1434An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, akMicrosoft Windows
- CVE-2019-1430A remote code execution vulnerability exists when Windows Media Foundation improperly parses specially crafted QuickTime media files.An attaMicrosoft Windows
- CVE-2019-1428A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), Microsoft Edge (EdgeHTML-based) on Windows Server · Micr… +1
- CVE-2019-1426A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit… +3
- CVE-2019-1427A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), Microsoft Edge (EdgeHTML-based) on Windows · Microsoft Chak…
- CVE-2019-1424A security feature bypass vulnerability exists when Windows Netlogon improperly handles a secure communications channel, aka 'NetLogon SecurMicrosoft Windows
- CVE-2019-1425An elevation of privilege vulnerability exists when Visual Studio fails to properly validate hardlinks while extracting archived files, aka Microsoft Visual Studio
- CVE-2019-1422An elevation of privilege vulnerability exists in the way that the iphlpsvc.dll handles file creation allowing for a file overwrite, aka 'WiMicrosoft Windows
- CVE-2019-1423An elevation of privilege vulnerability exists in the way that the StartTileData.dll handles file creation in protected locations, aka 'WindMicrosoft Windows
- CVE-2019-1419A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially cMicrosoft Windows
- CVE-2019-1420An elevation of privilege vulnerability exists in the way that the dssvc.dll handles file creation allowing for a file overwrite or creationMicrosoft Windows
- CVE-2019-1417An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka 'Windows Data SMicrosoft Windows
- CVE-2019-1418An information vulnerability exists when Windows Modules Installer Service improperly discloses file information, aka 'Windows Modules InstaMicrosoft Windows
- CVE-2019-1415An elevation of privilege vulnerability exists in Windows Installer because of the way Windows Installer handles certain filesystem operatioMicrosoft Windows
- CVE-2019-1416An elevation of privilege vulnerability exists due to a race condition in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux ElevMicrosoft Windows
- CVE-2019-1412An information disclosure vulnerability exists in Windows Adobe Type Manager Font Driver (ATMFD.dll) when it fails to properly handle objectMicrosoft Windows
- CVE-2019-1413A security feature bypass vulnerability exists when Microsoft Edge improperly handles extension requests and fails to request host permissioMicrosoft Edge (EdgeHTML-based) on Windows Server · Microso…
- CVE-2019-1408An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-1409An information disclosure vulnerability exists when the Windows Remote Procedure Call (RPC) runtime improperly initializes objects in memoryMicrosoft Windows
- CVE-2019-1411An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite InformatioMicrosoft Windows
- CVE-2019-1406A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnMicrosoft Windows
- CVE-2019-1407An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows GraphiMicrosoft Windows
- CVE-2019-1402An information disclosure vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, akMicrosoft Office
- CVE-2019-1398A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usMicrosoft Windows
- CVE-2019-1399A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on Microsoft Windows
- CVE-2019-1396An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-1397A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usMicrosoft Windows
- CVE-2019-1394An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-1395An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-1392An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel ElevaMicrosoft Windows Server · Microsoft Windows
- CVE-2019-1393An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-1390A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code ExecutMicrosoft Internet Explorer
- CVE-2019-1391A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.Microsoft Windows
- CVE-2019-1389A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usMicrosoft Windows
- CVE-2019-1383An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka 'Windows Data SMicrosoft Windows
- CVE-2019-1384A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.To exploit this Microsoft Windows
- CVE-2019-1381An information disclosure vulnerability exists when the Windows Servicing Stack allows access to unprivileged file locations, aka 'MicrosoftMicrosoft Windows Server · Microsoft Windows
- CVE-2019-1382An elevation of privilege vulnerability exists when ActiveX Installer service may allow access to files without proper authentication, aka 'Microsoft Windows
- CVE-2019-1379An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka 'Windows Data SMicrosoft Windows
- CVE-2019-1380A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of PrivilegMicrosoft Windows Server · Microsoft Windows
- CVE-2019-1373A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft ExMicrosoft Exchange Server
- CVE-2019-1374An information disclosure vulnerability exists in the way Windows Error Reporting (WER) handles objects in memory, aka 'Windows Error ReportMicrosoft Windows Server · Microsoft Windows
- CVE-2019-1324An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles IPv6 flowlabel filled in packets, aka 'WindoMicrosoft Windows
- CVE-2019-1370An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory, aka 'Open EnclavMicrosoft Open Enclave SDK
- CVE-2019-1309A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privMicrosoft Windows
- CVE-2019-1310A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privMicrosoft Windows
- CVE-2019-0719A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an aMicrosoft Windows Server · Microsoft Windows
- CVE-2019-0721A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an aMicrosoft Windows
- CVE-2019-1234A spoofing vulnerability exists when Azure Stack fails to validate certain requests, aka 'Azure Stack Spoofing Vulnerability'.Microsoft Azure Stack
- CVE-2019-0712A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privMicrosoft Windows
- CVE-2010-3359If LD_LIBRARY_PATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory.
- CVE-2019-12720AUO SunVeillance Monitoring System before v1.1.9e is vulnerable to mvc_send_mail.aspx (MailAdd parameter) SQL Injection.
- CVE-2019-12719An issue was discovered in Picture_Manage_mvc.aspx in AUO SunVeillance Monitoring System before v1.1.9e.
- CVE-2018-21026A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.6.5-00 allows an unauthenticated remote user to read internal information.
- CVE-2019-17360A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.7.0-00 allows an unauthenticated remote user to trigger a denial of service (D
- CVE-2019-15815ZyXEL P-1302-T10D v3 devices with firmware version 2.00(ABBX.3) and earlier do not properly enforce access control and could allow an unauth
- CVE-2019-17237includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF.
- CVE-2019-17236includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS.
- CVE-2019-17235includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure.
- CVE-2019-17234includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.
- CVE-2012-1572OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack spaceKeystone
- CVE-2019-18925Systematic IRIS WebForms 5.4 and its functionalities can be accessed and used without any form of authentication.
- CVE-2019-18926Systematic IRIS Standards Management (ISM) v2.1 SP1 89 is vulnerable to unauthenticated reflected Cross Site Scripting (XSS).
- CVE-2019-18924Systematic IRIS WebForms 5.4 is vulnerable to directory traversal.
- CVE-2019-18655File Sharing Wizard version 1.5.0 build 2008 is affected by a Structured Exception Handler based buffer overflow vulnerability.
- CVE-2019-4652IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could alloIBM Spectrum Protect Plus
- CVE-2012-1109mwlib 0.13 through 0.13.4 has a denial of service vulnerability when parsing #iferror magic functionsPython mwlib
- CVE-2011-3618atop: symlink attack possible due to insecure tempfile handlingatop
- CVE-2019-18848The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.json-jwt
- CVE-2019-18817Istio 1.3.x before 1.3.5 allows Denial of Service because continue_on_listener_filters_timeout is set to True, a related issue to CVE-2019-1istio.io/istio
- CVE-2011-3370statusnet before 0.9.9 has XSSstatusnet
- CVE-2018-18819A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 S
- CVE-2011-2936Elgg through 1.7.10 has a SQL injection vulnerabilityElgg
- CVE-2011-2935Elgg through 1.7.10 has XSSElgg · elgg/elgg
- CVE-2011-2897gdk-pixbuf through 2.31.1 has GIF loader buffer overflow when initializing decompression tables due to an input validation flawgdk-pixbuf
- CVE-2014-3599HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasyHornetQ REST · org.hornetq.rest:hornetq-rest
- CVE-2019-18658In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciouhelm.sh/helm
- CVE-2011-5271Pacemaker before 1.1.6 configure script creates temporary files insecurely
- CVE-2014-7143Python Twisted 14.0 trustRoot is not respected in HTTP clienttwisted
- CVE-2019-18881WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.
- CVE-2019-18882WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled.
- CVE-2019-18874psutil (aka python-psutil) through 5.6.5 can have a double free.psutil
- CVE-2019-18873FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header.