CVEs published November 15, 2019
36 CVEs were published on November 15, 2019: 0 critical, 1 high.
- Published
- 36
- Critical
- 0
- High
- 1
- Medium
- 2
- Low
- 0
- Unrated
- 33
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- BIG-IP
- 4
- pimcore/pimcore
- 4
- Symantec Endpoint Protection
- 3
- ax25-tools
- 1
- BIG-IP APM
- 1
- BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager
- 1
- Chrony
- 1
- drupal core
- 1
- ghostscript
- 1
- gksu-polkit
- 1
High 1
Medium, low and unrated 35
- CVE-2019-16762Validator parsing discrepancy due to string encoding in NPM slpjssimpleledger slpjs · slpjs
- CVE-2019-16761Validator parsing discrepancy due to string encoding in NPM slp-validate 1.0.0simpleledger slp-validate · slp-validate
- CVE-2019-6664On BIG-IP 15.0.0 and 14.1.0-14.1.0.6, under certain conditions, network protections on the management port do not follow current best practiBIG-IP
- CVE-2019-6662On BIG-IP 13.1.0-13.1.1.4, sensitive information is logged into the local log files and/or remote logging targets when restjavad processes aBIG-IP
- CVE-2019-6663The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager
- CVE-2019-6661When the BIG-IP APM 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.4.1, or 11.5.1-11.6.5 system processes certain requests, the BIG-IP APM
- CVE-2019-6660On BIG-IP 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1, undisclosed HTTP requests may consume excessive amounts of systems resources whicBIG-IP
- CVE-2019-13582An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March
- CVE-2019-6659On version 14.0.0-14.1.0.1, BIG-IP virtual servers with TLSv1.3 enabled may experience a denial of service due to undisclosed incoming messaBIG-IP
- CVE-2019-13581An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March
- CVE-2019-18372Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to a privilege escalation vulnerability, which is a type of issue wherebSymantec Endpoint Protection
- CVE-2019-12759Symantec Endpoint Protection Manager (SEPM) and Symantec Mail Security for MS Exchange (SMSMSE), prior to versions 14.2 RU2 and 7.5.x respecSymantec Endpoint Protection Manager (SEPM), Symantec Mail…
- CVE-2019-12758Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to an unsigned code execution vulnerability, which may allow an individuSymantec Endpoint Protection
- CVE-2019-12757Symantec Endpoint Protection (SEP), prior to 14.2 RU2 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition (SEP SBE) prioSymantec Endpoint Protection (SEP), Symantec Endpoint Prote…
- CVE-2011-2916qtnx 0.9 stores non-custom SSH keys in a world-readable configuration file.qtnx
- CVE-2019-12756Symantec Endpoint Protection (SEP), prior to 14.2 RU2 may be susceptible to a password protection bypass vulnerability whereby the secondarySymantec Endpoint Protection
- CVE-2018-18368Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU1, may be susceptible to a privilege escalation vulnerability, which is a type Symantec Endpoint Protection Manager
- CVE-2011-2910The AX.25 daemon (ax25d) in ax25-tools before 0.0.8-13 does not check the return value of a setuid call.ax25-tools
- CVE-2011-2726An access bypass issue was found in Drupal 7.x before version 7.5.drupal core
- CVE-2011-0703In gksu-polkit before 0.0.3, the source file for xauth may contain arbitrary commands that may allow an attacker to overtake an administratogksu-polkit
- CVE-2016-5285A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssMozilla Network Security Services
- CVE-2014-0023OpenShift: Install script has temporary file creation vulnerability which can result in arbitrary code executionOpenShift
- CVE-2014-0021Chrony before 1.29.1 has traffic amplification in cmdmon protocolChrony
- CVE-2013-7089ClamAV before 0.97.7: dbg_printhex possible information leak
- CVE-2013-7088ClamAV before 0.97.7 has buffer overflow in the libclamav component
- CVE-2013-7087ClamAV before 0.97.7 has WWPack corrupt heap memory
- CVE-2013-4584Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP and POP server.Perdition
- CVE-2019-14345TemaTres 3.0 allows remote unprivileged users to create an administrator account
- CVE-2019-14343TemaTres 3.0 has stored XSS via the value parameter to the vocab/admin.php?vocabulario_id=list URI.
- CVE-2019-18987An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki.
- CVE-2019-18981Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.pimcore/pimcore
- CVE-2019-18982bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window becpimcore/pimcore
- CVE-2019-18985Pimcore before 6.2.2 lacks brute force protection for the 2FA token.pimcore/pimcore
- CVE-2019-18986Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distipimcore/pimcore
- CVE-2019-18928Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentic