CVEs published November 18, 2019
77 CVEs were published on November 18, 2019: 0 critical, 0 high.
- Published
- 77
- Critical
- 0
- High
- 0
- Medium
- 3
- Low
- 0
- Unrated
- 74
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- jenkins · org.jenkins-ci.main:jenkins-core
- 2
- OpenWRT
- 2
- ZTE C520V21
- 2
- Apache Atlas · org.apache.atlas:apache-atlas
- 1
- Apache Shiro · org.apache.shiro:shiro-core
- 1
- Apache Solr · org.apache.solr:solr-core
- 1
- jenkins · org.jenkins-ci.plugins:ci-game
- 1
- jenkins · org.jenkins-ci.plugins:violations
- 1
- Micro Focus International Operations Agent
- 1
- NVIDIA NVFlash, NVUFlash, GPUModeSwitch Tool
- 1
Medium, low and unrated 77
- CVE-2019-12422Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.Apache Shiro · org.apache.shiro:shiro-core
- CVE-2014-5118Trusted Boot (tboot) before 1.8.2 has a 'loader.c' Security Bypass Vulnerability
- CVE-2019-10764In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private kesimplito/elliptic-php
- CVE-2008-7273A symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling.
- CVE-2012-4441Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTMjenkins · org.jenkins-ci.plugins:ci-game
- CVE-2019-19117/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2(PSG1218) V22.5.9.163 devices allows remote authenticated users to execute a
- CVE-2012-4440Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTMjenkins · org.jenkins-ci.plugins:violations
- CVE-2019-18373Norton App Lock, prior to 1.4.0.503, may be susceptible to a bypass exploit.Symantec Norton AppLock
- CVE-2012-4439Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTMjenkins · org.jenkins-ci.main:jenkins-core
- CVE-2019-12409The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default sApache Solr · org.apache.solr:solr-core
- CVE-2012-4438Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data ajenkins · org.jenkins-ci.main:jenkins-core
- CVE-2019-15054Multiple cross-site scripting (XSS) vulnerabilities in Mailbird before 2.7.5.0 r allow remote attackers to execute arbitrary JavaScript in a
- CVE-2019-17085XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11.Micro Focus International Operations Agent
- CVE-2019-10070Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionalityApache Atlas · org.apache.atlas:apache-atlas
- CVE-2019-18215An issue was discovered in signmgr.dll 6.5.0.819 in Comodo Internet Security through 12.0.
- CVE-2019-10763pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection.pimcore/pimcore
- CVE-2019-12311Sandline Centraleyezer (On Premises) allows Unrestricted File Upload leading to Stored XSS.
- CVE-2019-12299Sandline Centraleyezer (On Premises) allows Stored XSS using HTML entities in the name field of the Category section.
- CVE-2019-3424authentication issues vulnerability, which exists in V2.1.14 and below versions of C520V21 smart camera devices.ZTE C520V21
- CVE-2019-3423permission and access control vulnerability, which exists in V2.1.14 and below versions of C520V21 smart camera devices.ZTE C520V21
- CVE-2019-12271Sandline Centraleyezer (On Premises) allows unrestricted File Upload with a dangerous type, because the feature of adding ".jpg" to any uplo
- CVE-2018-20687An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows r
- CVE-2019-5102An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1.OpenWRT
- CVE-2019-5101An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1.OpenWRT
- CVE-2019-5688NVIDIA NVFlash, NVUFlash Tool prior to v5.588.0 and GPUModeSwitch Tool prior to 2019-11, NVIDIA kernel mode driver (nvflash.sys, nvflsh32.syNVIDIA NVFlash, NVUFlash, GPUModeSwitch Tool
- CVE-2011-5331Distributed Ruby (aka DRuby) 1.8 mishandles instance_eval.
- CVE-2011-5330Distributed Ruby (aka DRuby) 1.8 mishandles the sending of syscalls.
- CVE-2019-19113main/resources/mapper/NewBeeMallGoodsMapper.xml in newbee-mall (aka New Bee) before 2019-10-23 allows search?goodsCategoryId=&keyword= SQL I
- CVE-2018-21031Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token i
- CVE-2019-10172A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries.Redhat jackson-mapper-asl · org.codehaus.jackson:jackson-ma…
- CVE-2019-19085A persistent cross-site scripting (XSS) vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authenticated attackers to inj
- CVE-2019-19084In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously c
- CVE-2018-13257The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central
- CVE-2019-14467The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in th
- CVE-2019-17058Footy Tipping Software AFL Web Edition 2019 allows arbitrary file upload and resultant remote code execution because a whitelist can be bypa
- CVE-2019-17057Footy Tipping Software AFL Web Edition 2019 allows XSS.
- CVE-2019-19083Memory leaks in *clock_source_create() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to ca
- CVE-2019-19082Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.11 allow attackers to
- CVE-2019-19081A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5
- CVE-2019-19080Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel befor
- CVE-2019-19079A memory leak in the qrtr_tun_write_iter() function in net/qrtr/tun.c in the Linux kernel before 5.3 allows attackers to cause a denial of s
- CVE-2019-19078A memory leak in the ath10k_usb_hif_tx_sg() function in drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.3.11 allows atta
- CVE-2019-19077A memory leak in the bnxt_re_create_srq() function in drivers/infiniband/hw/bnxt_re/ib_verbs.c in the Linux kernel through 5.3.11 allows att
- CVE-2019-19076A memory leak in the nfp_abm_u32_knode_replace() function in drivers/net/ethernet/netronome/nfp/abm/cls.c in the Linux kernel before 5.3.6 a
- CVE-2019-19075A memory leak in the ca8210_probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel before 5.3.8 allows attackers to cause a
- CVE-2019-19074A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to
- CVE-2019-19073Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (me
- CVE-2019-19072A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to
- CVE-2019-19071A memory leak in the rsi_send_beacon() function in drivers/net/wireless/rsi/rsi_91x_mgmt.c in the Linux kernel through 5.3.11 allows attacke
- CVE-2019-19070A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c in the Linux kernel through 5.3.11 allows attackers to cause a deni
- CVE-2019-19069A memory leak in the fastrpc_dma_buf_attach() function in drivers/misc/fastrpc.c in the Linux kernel before 5.3.9 allows attackers to cause
- CVE-2019-19068A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the Linux kernel through
- CVE-2019-19067Four memory leaks in the acp_hw_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c in the Linux kernel before 5.3.8 allow attackers
- CVE-2019-19066A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cau
- CVE-2019-19065A memory leak in the sdma_init() function in drivers/infiniband/hw/hfi1/sdma.c in the Linux kernel before 5.3.9 allows attackers to cause a
- CVE-2019-19064A memory leak in the fsl_lpspi_probe() function in drivers/spi/spi-fsl-lpspi.c in the Linux kernel through 5.3.11 allows attackers to cause
- CVE-2019-19063Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the Linux kernel through 5.3.11 allow atta
- CVE-2019-19062A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a de
- CVE-2019-19061A memory leak in the adis_update_scan_mode_burst() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attacke
- CVE-2019-19060A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to
- CVE-2019-19059Multiple memory leaks in the iwl_pcie_ctxt_info_gen3_init() function in drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c in the Linu
- CVE-2019-19058A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c in the Linux kernel through 5.3.11 allows attac
- CVE-2019-19057Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3
- CVE-2019-19056A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3
- CVE-2019-19055A memory leak in the nl80211_get_ftm_responder_stats() function in net/wireless/nl80211.c in the Linux kernel through 5.3.11 allows attacker
- CVE-2019-19054A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through 5.3.11 allows attacke
- CVE-2019-19053A memory leak in the rpmsg_eptdev_write_iter() function in drivers/rpmsg/rpmsg_char.c in the Linux kernel through 5.3.11 allows attackers to
- CVE-2019-19052A memory leak in the gs_can_open() function in drivers/net/can/usb/gs_usb.c in the Linux kernel before 5.3.11 allows attackers to cause a de
- CVE-2019-19051A memory leak in the i2400m_op_rfkill_sw_toggle() function in drivers/net/wimax/i2400m/op-rfkill.c in the Linux kernel before 5.3.11 allows
- CVE-2019-19050A memory leak in the crypto_reportstat() function in crypto/crypto_user_stat.c in the Linux kernel through 5.3.11 allows attackers to cause
- CVE-2019-19049A memory leak in the unittest_data_add() function in drivers/of/unittest.c in the Linux kernel before 5.3.10 allows attackers to cause a den
- CVE-2019-19048A memory leak in the crypto_reportstat() function in drivers/virt/vboxguest/vboxguest_utils.c in the Linux kernel before 5.3.9 allows attack
- CVE-2019-19047A memory leak in the mlx5_fw_fatal_reporter_dump() function in drivers/net/ethernet/mellanox/mlx5/core/health.c in the Linux kernel before 5
- CVE-2019-19046A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c in the Linux kernel through 5.3.11 allows attacke
- CVE-2019-19045A memory leak in the mlx5_fpga_conn_create_cq() function in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c in the Linux kernel before 5
- CVE-2019-19044Two memory leaks in the v3d_submit_cl_ioctl() function in drivers/gpu/drm/v3d/v3d_gem.c in the Linux kernel before 5.3.11 allow attackers to
- CVE-2019-19043A memory leak in the i40e_setup_macvlans() function in drivers/net/ethernet/intel/i40e/i40e_main.c in the Linux kernel through 5.3.11 allows