# CVEs published 2019-11-12

138 CVEs were published on November 12, 2019: 0 critical, 7 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2019-5246](https://cve.now/CVE-2019-5246.md): Smartphones with software of ELLE-AL00B 9.1.0.109(C00E106R1P21), 9.1.0.113(C00E110R1P21), 9.1.0.125(C00E120R1P21), 9.1.0.135(C00E130R1P21), (no CVSS, ELLE-AL00B)
- [CVE-2019-5233](https://cve.now/CVE-2019-5233.md): Huawei smartphones with versions earlier than Taurus-AL00B 10.0.0.41(SP2C00E41R3P2) have an improper authentication vulnerability. (no CVSS, Taurus-AL00B)
- [CVE-2019-5231](https://cve.now/CVE-2019-5231.md): P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.186(C00E180R2P1) have an improper authorization vulnerability. (no CVSS, P30)
- [CVE-2019-5230](https://cve.now/CVE-2019-5230.md): P20 Pro, P20, Mate RS smartphones with versions earlier than Charlotte-AL00A 9.1.0.321(C00E320R1P1T8), versions earlier than Emily-AL00A 9.1 (no CVSS, P20 Pro, P20, Mate RS)
- [CVE-2019-5229](https://cve.now/CVE-2019-5229.md): P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1) have an insufficient verification vulnerability. (no CVSS, P30)
- [CVE-2019-5213](https://cve.now/CVE-2019-5213.md): Honor play smartphones with versions earlier than Cornell-AL00A 9.1.0.321(C00E320R1P1T8) have an insufficient authentication vulnerability. (no CVSS, Honor play)
- [CVE-2019-5228](https://cve.now/CVE-2019-5228.md): Certain detection module of P30, P30 Pro, Honor V20 smartphone whith Versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), Versions earl (no CVSS, P30, P30 Pro, Honor)
- [CVE-2010-4177](https://cve.now/CVE-2010-4177.md): mysql-gui-tools (mysql-query-browser and mysql-admin) before 5.0r14+openSUSE-2.3 exposes the password of a user connected to the MySQL serve (no CVSS, mysql-gui-tools)
- [CVE-2010-3857](https://cve.now/CVE-2010-3857.md): JBoss BRMS before 5.1.0 has a XSS vulnerability via asset=UUID parameter. (no CVSS, JBoss BRMS)
- [CVE-2017-17224](https://cve.now/CVE-2017-17224.md): Some Huawei smart phones with versions earlier than Harry-AL00C 9.1.0.206(C00E205R3P1) have a null pointer dereference vulnerability. (no CVSS, Huawei HG655m)
- [CVE-2010-3844](https://cve.now/CVE-2010-3844.md): An unchecked sscanf() call in ettercap before 0.7.5 allows an insecure temporary settings file to overflow a static-sized buffer on the stac (no CVSS, ettercap)
- [CVE-2011-1802](https://cve.now/CVE-2011-1802.md): WebKit in Google Chrome before Blink M11 and M12 does not properly handle counter nodes, which allows remote attackers to cause a denial of (no CVSS, Google Chrome)
- [CVE-2010-3440](https://cve.now/CVE-2010-3440.md): babiloo 2.0.9 before 2.0.11 creates temporary files with predictable names when downloading and unpacking dictionary files, allowing a local (no CVSS, babiloo)
- [CVE-2011-1803](https://cve.now/CVE-2011-1803.md): An issue exists in third\_party/WebKit/Source/WebCore/svg/animation/SVGSMILElement.h in WebKit in Google Chrome before Blink M11 and M12 when (no CVSS, Google Chrome)
- [CVE-2010-3305](https://cve.now/CVE-2010-3305.md): Cross-site request forgery (CSRF) vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password. (no CVSS, pixelpost)
- [CVE-2011-2334](https://cve.now/CVE-2011-2334.md): Use after free vulnerability exists in WebKit in Google Chrome before Blink M12 in RenderLayerwhen removing elements with reflections. (no CVSS, Google Chrome)
- [CVE-2010-3299](https://cve.now/CVE-2010-3299.md): The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks. (no CVSS, rails)
- [CVE-2019-14365](https://cve.now/CVE-2019-14365.md): The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. (no CVSS)
- [CVE-2019-14366](https://cve.now/CVE-2019-14366.md): WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. (no CVSS)
- [CVE-2019-14367](https://cve.now/CVE-2019-14367.md): Slack-Chat through 1.5.5 leaks a Slack Access Token in source code. (no CVSS)
- [CVE-2019-6188](https://cve.now/CVE-2019-6188.md): ThinkPad T460p and T470p BIOS Tamper Mechanism (no CVSS, Lenovo ThinkPad T470p · Lenovo ThinkPad T460p)
- [CVE-2019-6170](https://cve.now/CVE-2019-6170.md): A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some (CVSS 6.4, Lenovo ThinkPad)
- [CVE-2019-6172](https://cve.now/CVE-2019-6172.md): A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some (CVSS 6.4, Lenovo ThinkPad)
- [CVE-2010-3292](https://cve.now/CVE-2010-3292.md): The update{\_bad,}\_phishing\_sites scripts in mailscanner 4.79.11-2 downloads files and trusts them without using encryption (e.g., https) or (no CVSS, mailscanner)
- [CVE-2010-3095](https://cve.now/CVE-2010-3095.md): mailscanner before 4.79.11-2.1 might allow local users to overwrite arbitrary files via a symlink attack on certain temporary files. (no CVSS, mailscanner)
- [CVE-2019-5695](https://cve.now/CVE-2019-5695.md): NVIDIA GeForce Experience (prior to 3.20.1) and Windows GPU Display Driver (all versions) contains a vulnerability in the local service prov (no CVSS, NVIDIA GeForce Experience · NVIDIA Windows GPU Display Driv…)
- [CVE-2010-3439](https://cve.now/CVE-2010-3439.md): It is possible to cause a DoS condition by causing the server to crash in alien-arena 7.33 by supplying various invalid parameters to the do (no CVSS, alien-arena)
- [CVE-2011-2335](https://cve.now/CVE-2011-2335.md): A double-free vulnerability exists in WebKit in Google Chrome before Blink M12 in the WebCore::CSSSelector function. (no CVSS, Google Chrome)
- [CVE-2010-2488](https://cve.now/CVE-2010-2488.md): NULL pointer dereference vulnerability in ZNC before 0.092 caused by traffic stats when there are unauthenticated connections. (no CVSS, znc)
- [CVE-2010-3438](https://cve.now/CVE-2010-3438.md): libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. (no CVSS, libpoe-component-irc-perl)
- [CVE-2019-17332](https://cve.now/CVE-2019-17332.md): TIBCO EBX Add-on For Digital Asset Manager Cross-Site Scripting Vulnerabilities (CVSS 7.3, TIBCO Software TIBCO EBX Add-ons)
- [CVE-2019-17331](https://cve.now/CVE-2019-17331.md): TIBCO EBX Add-on For Data Exchange Cross-Site Scripting Vulnerabilities (CVSS 7.3, TIBCO Software TIBCO EBX Add-ons)
- [CVE-2019-17330](https://cve.now/CVE-2019-17330.md): TIBCO EBX Exposes Multiple Cross-Site Scripting Vulnerabilities (CVSS 8.8, TIBCO Software TIBCO EBX)
- [CVE-2019-1456](https://cve.now/CVE-2019-1456.md): A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially c (no CVSS, Microsoft Windows)
- [CVE-2019-1457](https://cve.now/CVE-2019-1457.md): A security feature bypass vulnerability exists in Microsoft Office software by not enforcing macro settings on an Excel document, aka 'Micro (no CVSS, Microsoft Office)
- [CVE-2019-1448](https://cve.now/CVE-2019-1448.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka ' (no CVSS, Microsoft Excel · Microsoft Office)
- [CVE-2019-1449](https://cve.now/CVE-2019-1449.md): A security feature bypass vulnerability exists in the way that Office Click-to-Run (C2R) components handle a specially crafted file, which c (no CVSS, Microsoft Office)
- [CVE-2019-1446](https://cve.now/CVE-2019-1446.md): An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel In (no CVSS, Microsoft Excel · Microsoft Office +2)
- [CVE-2019-1447](https://cve.now/CVE-2019-1447.md): A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsof (no CVSS, Microsoft Office Online Server)
- [CVE-2019-1443](https://cve.now/CVE-2019-1443.md): An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint S (no CVSS, Microsoft SharePoint Foundation · Microsoft SharePoint E… +1)
- [CVE-2019-1445](https://cve.now/CVE-2019-1445.md): A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsof (no CVSS, Microsoft Office Online Server)
- [CVE-2019-1441](https://cve.now/CVE-2019-1441.md): A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k (no CVSS, Microsoft Windows)
- [CVE-2019-1442](https://cve.now/CVE-2019-1442.md): A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially craf (no CVSS, Microsoft SharePoint Server)
- [CVE-2019-1439](https://cve.now/CVE-2019-1439.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows (no CVSS, Microsoft Windows)
- [CVE-2019-1440](https://cve.now/CVE-2019-1440.md): An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Dis (no CVSS, Microsoft Windows)
- [CVE-2019-1437](https://cve.now/CVE-2019-1437.md): An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphi (no CVSS, Microsoft Windows)
- [CVE-2019-1438](https://cve.now/CVE-2019-1438.md): An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphi (no CVSS, Microsoft Windows)
- [CVE-2019-1435](https://cve.now/CVE-2019-1435.md): An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphi (no CVSS, Microsoft Windows)
- [CVE-2019-1436](https://cve.now/CVE-2019-1436.md): An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Dis (no CVSS, Microsoft Windows)
- [CVE-2019-1432](https://cve.now/CVE-2019-1432.md): An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Informatio (no CVSS, Microsoft Windows)
- [CVE-2019-1433](https://cve.now/CVE-2019-1433.md): An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphi (no CVSS, Microsoft Windows)
- [CVE-2019-1434](https://cve.now/CVE-2019-1434.md): An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, ak (no CVSS, Microsoft Windows)
- [CVE-2019-1430](https://cve.now/CVE-2019-1430.md): A remote code execution vulnerability exists when Windows Media Foundation improperly parses specially crafted QuickTime media files.An atta (no CVSS, Microsoft Windows)
- [CVE-2019-1428](https://cve.now/CVE-2019-1428.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), (no CVSS, Microsoft Edge (EdgeHTML-based) on Windows Server · Micr… +1)
- [CVE-2019-1429](https://cve.now/CVE-2019-1429.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip (CVSS 7.5, KEV, Microsoft Internet Explorer)
- [CVE-2019-1426](https://cve.now/CVE-2019-1426.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), (no CVSS, Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit… +3)
- [CVE-2019-1427](https://cve.now/CVE-2019-1427.md): A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), (no CVSS, Microsoft Edge (EdgeHTML-based) on Windows · Microsoft Chak…)
- [CVE-2019-1424](https://cve.now/CVE-2019-1424.md): A security feature bypass vulnerability exists when Windows Netlogon improperly handles a secure communications channel, aka 'NetLogon Secur (no CVSS, Microsoft Windows)
- [CVE-2019-1425](https://cve.now/CVE-2019-1425.md): An elevation of privilege vulnerability exists when Visual Studio fails to properly validate hardlinks while extracting archived files, aka (no CVSS, Microsoft Visual Studio)
- [CVE-2019-1422](https://cve.now/CVE-2019-1422.md): An elevation of privilege vulnerability exists in the way that the iphlpsvc.dll handles file creation allowing for a file overwrite, aka 'Wi (no CVSS, Microsoft Windows)
- [CVE-2019-1423](https://cve.now/CVE-2019-1423.md): An elevation of privilege vulnerability exists in the way that the StartTileData.dll handles file creation in protected locations, aka 'Wind (no CVSS, Microsoft Windows)
- [CVE-2019-1419](https://cve.now/CVE-2019-1419.md): A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially c (no CVSS, Microsoft Windows)
- [CVE-2019-1420](https://cve.now/CVE-2019-1420.md): An elevation of privilege vulnerability exists in the way that the dssvc.dll handles file creation allowing for a file overwrite or creation (no CVSS, Microsoft Windows)
- [CVE-2019-1417](https://cve.now/CVE-2019-1417.md): An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka 'Windows Data S (no CVSS, Microsoft Windows)
- [CVE-2019-1418](https://cve.now/CVE-2019-1418.md): An information vulnerability exists when Windows Modules Installer Service improperly discloses file information, aka 'Windows Modules Insta (no CVSS, Microsoft Windows)
- [CVE-2019-1415](https://cve.now/CVE-2019-1415.md): An elevation of privilege vulnerability exists in Windows Installer because of the way Windows Installer handles certain filesystem operatio (no CVSS, Microsoft Windows)
- [CVE-2019-1416](https://cve.now/CVE-2019-1416.md): An elevation of privilege vulnerability exists due to a race condition in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elev (no CVSS, Microsoft Windows)
- [CVE-2019-1412](https://cve.now/CVE-2019-1412.md): An information disclosure vulnerability exists in Windows Adobe Type Manager Font Driver (ATMFD.dll) when it fails to properly handle object (no CVSS, Microsoft Windows)
- [CVE-2019-1413](https://cve.now/CVE-2019-1413.md): A security feature bypass vulnerability exists when Microsoft Edge improperly handles extension requests and fails to request host permissio (no CVSS, Microsoft Edge (EdgeHTML-based) on Windows Server · Microso…)
- [CVE-2019-1408](https://cve.now/CVE-2019-1408.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k (no CVSS, Microsoft Windows)
- [CVE-2019-1409](https://cve.now/CVE-2019-1409.md): An information disclosure vulnerability exists when the Windows Remote Procedure Call (RPC) runtime improperly initializes objects in memory (no CVSS, Microsoft Windows)
- [CVE-2019-1411](https://cve.now/CVE-2019-1411.md): An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Informatio (no CVSS, Microsoft Windows)
- [CVE-2019-1406](https://cve.now/CVE-2019-1406.md): A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En (no CVSS, Microsoft Windows)
- [CVE-2019-1407](https://cve.now/CVE-2019-1407.md): An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphi (no CVSS, Microsoft Windows)
- [CVE-2019-1402](https://cve.now/CVE-2019-1402.md): An information disclosure vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, ak (no CVSS, Microsoft Office)
- [CVE-2019-1405](https://cve.now/CVE-2019-1405.md): An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2019-1398](https://cve.now/CVE-2019-1398.md): A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated us (no CVSS, Microsoft Windows)
- [CVE-2019-1399](https://cve.now/CVE-2019-1399.md): A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on (no CVSS, Microsoft Windows)
- [CVE-2019-1396](https://cve.now/CVE-2019-1396.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k (no CVSS, Microsoft Windows)
- [CVE-2019-1397](https://cve.now/CVE-2019-1397.md): A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated us (no CVSS, Microsoft Windows)
- [CVE-2019-1394](https://cve.now/CVE-2019-1394.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k (no CVSS, Microsoft Windows)
- [CVE-2019-1395](https://cve.now/CVE-2019-1395.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k (no CVSS, Microsoft Windows)
- [CVE-2019-1392](https://cve.now/CVE-2019-1392.md): An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Eleva (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-1393](https://cve.now/CVE-2019-1393.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k (no CVSS, Microsoft Windows)
- [CVE-2019-1390](https://cve.now/CVE-2019-1390.md): A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-1391](https://cve.now/CVE-2019-1391.md): A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'. (no CVSS, Microsoft Windows)
- [CVE-2019-1385](https://cve.now/CVE-2019-1385.md): An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulti (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2019-1388](https://cve.now/CVE-2019-1388.md): An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Win (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2019-1389](https://cve.now/CVE-2019-1389.md): A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated us (no CVSS, Microsoft Windows)
- [CVE-2019-1383](https://cve.now/CVE-2019-1383.md): An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka 'Windows Data S (no CVSS, Microsoft Windows)
- [CVE-2019-1384](https://cve.now/CVE-2019-1384.md): A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.To exploit this (no CVSS, Microsoft Windows)
- [CVE-2019-1381](https://cve.now/CVE-2019-1381.md): An information disclosure vulnerability exists when the Windows Servicing Stack allows access to unprivileged file locations, aka 'Microsoft (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-1382](https://cve.now/CVE-2019-1382.md): An elevation of privilege vulnerability exists when ActiveX Installer service may allow access to files without proper authentication, aka ' (no CVSS, Microsoft Windows)
- [CVE-2019-1379](https://cve.now/CVE-2019-1379.md): An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka 'Windows Data S (no CVSS, Microsoft Windows)
- [CVE-2019-1380](https://cve.now/CVE-2019-1380.md): A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privileg (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-1373](https://cve.now/CVE-2019-1373.md): A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Ex (no CVSS, Microsoft Exchange Server)
- [CVE-2019-1374](https://cve.now/CVE-2019-1374.md): An information disclosure vulnerability exists in the way Windows Error Reporting (WER) handles objects in memory, aka 'Windows Error Report (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-1324](https://cve.now/CVE-2019-1324.md): An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles IPv6 flowlabel filled in packets, aka 'Windo (no CVSS, Microsoft Windows)
- [CVE-2019-1370](https://cve.now/CVE-2019-1370.md): An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory, aka 'Open Enclav (no CVSS, Microsoft Open Enclave SDK)
- [CVE-2019-1309](https://cve.now/CVE-2019-1309.md): A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a priv (no CVSS, Microsoft Windows)
- [CVE-2019-1310](https://cve.now/CVE-2019-1310.md): A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a priv (no CVSS, Microsoft Windows)
- [CVE-2019-0719](https://cve.now/CVE-2019-0719.md): A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an a (no CVSS, Microsoft Windows Server · Microsoft Windows)
- [CVE-2019-0721](https://cve.now/CVE-2019-0721.md): A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an a (no CVSS, Microsoft Windows)
- [CVE-2019-1234](https://cve.now/CVE-2019-1234.md): A spoofing vulnerability exists when Azure Stack fails to validate certain requests, aka 'Azure Stack Spoofing Vulnerability'. (no CVSS, Microsoft Azure Stack)
- [CVE-2019-0712](https://cve.now/CVE-2019-0712.md): A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a priv (no CVSS, Microsoft Windows)
- [CVE-2010-3359](https://cve.now/CVE-2010-3359.md): If LD\_LIBRARY\_PATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory. (no CVSS)
- [CVE-2019-12720](https://cve.now/CVE-2019-12720.md): AUO SunVeillance Monitoring System before v1.1.9e is vulnerable to mvc\_send\_mail.aspx (MailAdd parameter) SQL Injection. (no CVSS)
- [CVE-2019-12719](https://cve.now/CVE-2019-12719.md): An issue was discovered in Picture\_Manage\_mvc.aspx in AUO SunVeillance Monitoring System before v1.1.9e. (no CVSS)
- [CVE-2018-21026](https://cve.now/CVE-2018-21026.md): A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.6.5-00 allows an unauthenticated remote user to read internal information. (no CVSS)
- [CVE-2019-17360](https://cve.now/CVE-2019-17360.md): A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.7.0-00 allows an unauthenticated remote user to trigger a denial of service (D (no CVSS)
- [CVE-2019-15815](https://cve.now/CVE-2019-15815.md): ZyXEL P-1302-T10D v3 devices with firmware version 2.00(ABBX.3) and earlier do not properly enforce access control and could allow an unauth (no CVSS)
- [CVE-2019-17237](https://cve.now/CVE-2019-17237.md): includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF. (no CVSS)
- [CVE-2019-17236](https://cve.now/CVE-2019-17236.md): includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS. (no CVSS)
- [CVE-2019-17235](https://cve.now/CVE-2019-17235.md): includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure. (no CVSS)
- [CVE-2019-17234](https://cve.now/CVE-2019-17234.md): includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion. (no CVSS)
- [CVE-2012-1572](https://cve.now/CVE-2012-1572.md): OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space (no CVSS, Keystone)
- [CVE-2019-18925](https://cve.now/CVE-2019-18925.md): Systematic IRIS WebForms 5.4 and its functionalities can be accessed and used without any form of authentication. (no CVSS)
- [CVE-2019-18926](https://cve.now/CVE-2019-18926.md): Systematic IRIS Standards Management (ISM) v2.1 SP1 89 is vulnerable to unauthenticated reflected Cross Site Scripting (XSS). (no CVSS)
- [CVE-2019-18924](https://cve.now/CVE-2019-18924.md): Systematic IRIS WebForms 5.4 is vulnerable to directory traversal. (no CVSS)
- [CVE-2019-18655](https://cve.now/CVE-2019-18655.md): File Sharing Wizard version 1.5.0 build 2008 is affected by a Structured Exception Handler based buffer overflow vulnerability. (no CVSS)
- [CVE-2019-4652](https://cve.now/CVE-2019-4652.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allo (CVSS 5.1, IBM Spectrum Protect Plus)
- [CVE-2012-1109](https://cve.now/CVE-2012-1109.md): mwlib 0.13 through 0.13.4 has a denial of service vulnerability when parsing #iferror magic functions (no CVSS, Python mwlib)
- [CVE-2011-3618](https://cve.now/CVE-2011-3618.md): atop: symlink attack possible due to insecure tempfile handling (no CVSS, atop)
- [CVE-2019-18848](https://cve.now/CVE-2019-18848.md): The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string. (no CVSS, json-jwt)
- [CVE-2019-18817](https://cve.now/CVE-2019-18817.md): Istio 1.3.x before 1.3.5 allows Denial of Service because continue\_on\_listener\_filters\_timeout is set to True, a related issue to CVE-2019-1 (no CVSS, istio.io/istio)
- [CVE-2011-3370](https://cve.now/CVE-2011-3370.md): statusnet before 0.9.9 has XSS (no CVSS, statusnet)
- [CVE-2018-18819](https://cve.now/CVE-2018-18819.md): A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 S (no CVSS)
- [CVE-2011-2936](https://cve.now/CVE-2011-2936.md): Elgg through 1.7.10 has a SQL injection vulnerability (no CVSS, Elgg)
- [CVE-2011-2935](https://cve.now/CVE-2011-2935.md): Elgg through 1.7.10 has XSS (no CVSS, Elgg · elgg/elgg)
- [CVE-2011-2897](https://cve.now/CVE-2011-2897.md): gdk-pixbuf through 2.31.1 has GIF loader buffer overflow when initializing decompression tables due to an input validation flaw (no CVSS, gdk-pixbuf)
- [CVE-2014-3599](https://cve.now/CVE-2014-3599.md): HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy (no CVSS, HornetQ REST · org.hornetq.rest:hornetq-rest)
- [CVE-2019-18658](https://cve.now/CVE-2019-18658.md): In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciou (no CVSS, helm.sh/helm)
- [CVE-2011-5271](https://cve.now/CVE-2011-5271.md): Pacemaker before 1.1.6 configure script creates temporary files insecurely (no CVSS)
- [CVE-2014-7143](https://cve.now/CVE-2014-7143.md): Python Twisted 14.0 trustRoot is not respected in HTTP client (no CVSS, twisted)
- [CVE-2019-18881](https://cve.now/CVE-2019-18881.md): WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile. (no CVSS)
- [CVE-2019-18882](https://cve.now/CVE-2019-18882.md): WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled. (no CVSS)
- [CVE-2019-18874](https://cve.now/CVE-2019-18874.md): psutil (aka python-psutil) through 5.6.5 can have a double free. (no CVSS, psutil)
- [CVE-2019-18873](https://cve.now/CVE-2019-18873.md): FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-11-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.