# CVEs published 2019-11-15

36 CVEs were published on November 15, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2019-16762](https://cve.now/CVE-2019-16762.md): Validator parsing discrepancy due to string encoding in NPM slpjs (CVSS 5.7, simpleledger slpjs · slpjs)
- [CVE-2019-16761](https://cve.now/CVE-2019-16761.md): Validator parsing discrepancy due to string encoding in NPM slp-validate 1.0.0 (CVSS 5.7, simpleledger slp-validate · slp-validate)
- [CVE-2019-6664](https://cve.now/CVE-2019-6664.md): On BIG-IP 15.0.0 and 14.1.0-14.1.0.6, under certain conditions, network protections on the management port do not follow current best practi (no CVSS, BIG-IP)
- [CVE-2019-6662](https://cve.now/CVE-2019-6662.md): On BIG-IP 13.1.0-13.1.1.4, sensitive information is logged into the local log files and/or remote logging targets when restjavad processes a (no CVSS, BIG-IP)
- [CVE-2019-6663](https://cve.now/CVE-2019-6663.md): The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, (no CVSS, BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager)
- [CVE-2019-6661](https://cve.now/CVE-2019-6661.md): When the BIG-IP APM 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.4.1, or 11.5.1-11.6.5 system processes certain requests, the (no CVSS, BIG-IP APM)
- [CVE-2019-6660](https://cve.now/CVE-2019-6660.md): On BIG-IP 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1, undisclosed HTTP requests may consume excessive amounts of systems resources whic (no CVSS, BIG-IP)
- [CVE-2019-13582](https://cve.now/CVE-2019-13582.md): An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March (no CVSS)
- [CVE-2019-6659](https://cve.now/CVE-2019-6659.md): On version 14.0.0-14.1.0.1, BIG-IP virtual servers with TLSv1.3 enabled may experience a denial of service due to undisclosed incoming messa (no CVSS, BIG-IP)
- [CVE-2019-13581](https://cve.now/CVE-2019-13581.md): An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March (no CVSS)
- [CVE-2019-18372](https://cve.now/CVE-2019-18372.md): Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereb (no CVSS, Symantec Endpoint Protection)
- [CVE-2019-12759](https://cve.now/CVE-2019-12759.md): Symantec Endpoint Protection Manager (SEPM) and Symantec Mail Security for MS Exchange (SMSMSE), prior to versions 14.2 RU2 and 7.5.x respec (no CVSS, Symantec Endpoint Protection Manager (SEPM), Symantec Mail…)
- [CVE-2019-12758](https://cve.now/CVE-2019-12758.md): Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to an unsigned code execution vulnerability, which may allow an individu (no CVSS, Symantec Endpoint Protection)
- [CVE-2019-12757](https://cve.now/CVE-2019-12757.md): Symantec Endpoint Protection (SEP), prior to 14.2 RU2 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition (SEP SBE) prio (no CVSS, Symantec Endpoint Protection (SEP), Symantec Endpoint Prote…)
- [CVE-2011-2916](https://cve.now/CVE-2011-2916.md): qtnx 0.9 stores non-custom SSH keys in a world-readable configuration file. (no CVSS, qtnx)
- [CVE-2019-12756](https://cve.now/CVE-2019-12756.md): Symantec Endpoint Protection (SEP), prior to 14.2 RU2 may be susceptible to a password protection bypass vulnerability whereby the secondary (no CVSS, Symantec Endpoint Protection)
- [CVE-2018-18368](https://cve.now/CVE-2018-18368.md): Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU1, may be susceptible to a privilege escalation vulnerability, which is a type (no CVSS, Symantec Endpoint Protection Manager)
- [CVE-2011-2910](https://cve.now/CVE-2011-2910.md): The AX.25 daemon (ax25d) in ax25-tools before 0.0.8-13 does not check the return value of a setuid call. (no CVSS, ax25-tools)
- [CVE-2011-2726](https://cve.now/CVE-2011-2726.md): An access bypass issue was found in Drupal 7.x before version 7.5. (no CVSS, drupal core)
- [CVE-2011-0703](https://cve.now/CVE-2011-0703.md): In gksu-polkit before 0.0.3, the source file for xauth may contain arbitrary commands that may allow an attacker to overtake an administrato (no CVSS, gksu-polkit)
- [CVE-2016-5285](https://cve.now/CVE-2016-5285.md): A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11\_SignWithSymKey / ss (no CVSS, Mozilla Network Security Services)
- [CVE-2014-0023](https://cve.now/CVE-2014-0023.md): OpenShift: Install script has temporary file creation vulnerability which can result in arbitrary code execution (no CVSS, OpenShift)
- [CVE-2014-0021](https://cve.now/CVE-2014-0021.md): Chrony before 1.29.1 has traffic amplification in cmdmon protocol (no CVSS, Chrony)
- [CVE-2013-7089](https://cve.now/CVE-2013-7089.md): ClamAV before 0.97.7: dbg\_printhex possible information leak (no CVSS)
- [CVE-2013-7088](https://cve.now/CVE-2013-7088.md): ClamAV before 0.97.7 has buffer overflow in the libclamav component (no CVSS)
- [CVE-2013-7087](https://cve.now/CVE-2013-7087.md): ClamAV before 0.97.7 has WWPack corrupt heap memory (no CVSS)
- [CVE-2013-4584](https://cve.now/CVE-2013-4584.md): Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP and POP server. (no CVSS, Perdition)
- [CVE-2019-14345](https://cve.now/CVE-2019-14345.md): TemaTres 3.0 allows remote unprivileged users to create an administrator account (no CVSS)
- [CVE-2019-14343](https://cve.now/CVE-2019-14343.md): TemaTres 3.0 has stored XSS via the value parameter to the vocab/admin.php?vocabulario\_id=list URI. (no CVSS)
- [CVE-2019-14869](https://cve.now/CVE-2019-14869.md): A flaw was found in all versions of ghostscript 9.x before 9.50, where the \`.charkeys\` procedure, where it did not properly secure its privi (CVSS 7.3, ghostscript)
- [CVE-2019-18987](https://cve.now/CVE-2019-18987.md): An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. (no CVSS)
- [CVE-2019-18981](https://cve.now/CVE-2019-18981.md): Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification. (no CVSS, pimcore/pimcore)
- [CVE-2019-18982](https://cve.now/CVE-2019-18982.md): bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window bec (no CVSS, pimcore/pimcore)
- [CVE-2019-18985](https://cve.now/CVE-2019-18985.md): Pimcore before 6.2.2 lacks brute force protection for the 2FA token. (no CVSS, pimcore/pimcore)
- [CVE-2019-18986](https://cve.now/CVE-2019-18986.md): Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns disti (no CVSS, pimcore/pimcore)
- [CVE-2019-18928](https://cve.now/CVE-2019-18928.md): Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentic (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-11-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.