# CVEs published 2019-11-18

77 CVEs were published on November 18, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-12422](https://cve.now/CVE-2019-12422.md): Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack. (no CVSS, Apache Shiro · org.apache.shiro:shiro-core)
- [CVE-2014-5118](https://cve.now/CVE-2014-5118.md): Trusted Boot (tboot) before 1.8.2 has a 'loader.c' Security Bypass Vulnerability (no CVSS)
- [CVE-2019-10764](https://cve.now/CVE-2019-10764.md): In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private ke (no CVSS, simplito/elliptic-php)
- [CVE-2008-7273](https://cve.now/CVE-2008-7273.md): A symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling. (no CVSS)
- [CVE-2012-4441](https://cve.now/CVE-2012-4441.md): Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTM (no CVSS, jenkins · org.jenkins-ci.plugins:ci-game)
- [CVE-2019-19117](https://cve.now/CVE-2019-19117.md): /usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2(PSG1218) V22.5.9.163 devices allows remote authenticated users to execute a (no CVSS)
- [CVE-2012-4440](https://cve.now/CVE-2012-4440.md): Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTM (no CVSS, jenkins · org.jenkins-ci.plugins:violations)
- [CVE-2019-18373](https://cve.now/CVE-2019-18373.md): Norton App Lock, prior to 1.4.0.503, may be susceptible to a bypass exploit. (no CVSS, Symantec Norton AppLock)
- [CVE-2012-4439](https://cve.now/CVE-2012-4439.md): Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTM (no CVSS, jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2019-12409](https://cve.now/CVE-2019-12409.md): The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE\_REMOTE\_JMX\_OPTS configuration option in the default s (no CVSS, Apache Solr · org.apache.solr:solr-core)
- [CVE-2012-4438](https://cve.now/CVE-2012-4438.md): Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data a (no CVSS, jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2019-15054](https://cve.now/CVE-2019-15054.md): Multiple cross-site scripting (XSS) vulnerabilities in Mailbird before 2.7.5.0 r allow remote attackers to execute arbitrary JavaScript in a (no CVSS)
- [CVE-2019-17085](https://cve.now/CVE-2019-17085.md): XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11. (no CVSS, Micro Focus International Operations Agent)
- [CVE-2019-10070](https://cve.now/CVE-2019-10070.md): Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality (no CVSS, Apache Atlas · org.apache.atlas:apache-atlas)
- [CVE-2019-18215](https://cve.now/CVE-2019-18215.md): An issue was discovered in signmgr.dll 6.5.0.819 in Comodo Internet Security through 12.0. (no CVSS)
- [CVE-2019-10763](https://cve.now/CVE-2019-10763.md): pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. (no CVSS, pimcore/pimcore)
- [CVE-2019-12311](https://cve.now/CVE-2019-12311.md): Sandline Centraleyezer (On Premises) allows Unrestricted File Upload leading to Stored XSS. (no CVSS)
- [CVE-2019-12299](https://cve.now/CVE-2019-12299.md): Sandline Centraleyezer (On Premises) allows Stored XSS using HTML entities in the name field of the Category section. (no CVSS)
- [CVE-2019-3424](https://cve.now/CVE-2019-3424.md): authentication issues vulnerability, which exists in V2.1.14 and below versions of C520V21 smart camera devices. (no CVSS, ZTE C520V21)
- [CVE-2019-3423](https://cve.now/CVE-2019-3423.md): permission and access control vulnerability, which exists in V2.1.14 and below versions of C520V21 smart camera devices. (no CVSS, ZTE C520V21)
- [CVE-2019-12271](https://cve.now/CVE-2019-12271.md): Sandline Centraleyezer (On Premises) allows unrestricted File Upload with a dangerous type, because the feature of adding ".jpg" to any uplo (no CVSS)
- [CVE-2018-20687](https://cve.now/CVE-2018-20687.md): An XML external entity (XXE) vulnerability in CommandCenterWebServices/.\*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows r (no CVSS)
- [CVE-2019-5102](https://cve.now/CVE-2019-5102.md): An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. (CVSS 4.0, OpenWRT)
- [CVE-2019-5101](https://cve.now/CVE-2019-5101.md): An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. (CVSS 4.0, OpenWRT)
- [CVE-2019-5688](https://cve.now/CVE-2019-5688.md): NVIDIA NVFlash, NVUFlash Tool prior to v5.588.0 and GPUModeSwitch Tool prior to 2019-11, NVIDIA kernel mode driver (nvflash.sys, nvflsh32.sy (no CVSS, NVIDIA NVFlash, NVUFlash, GPUModeSwitch Tool)
- [CVE-2011-5331](https://cve.now/CVE-2011-5331.md): Distributed Ruby (aka DRuby) 1.8 mishandles instance\_eval. (no CVSS)
- [CVE-2011-5330](https://cve.now/CVE-2011-5330.md): Distributed Ruby (aka DRuby) 1.8 mishandles the sending of syscalls. (no CVSS)
- [CVE-2019-19113](https://cve.now/CVE-2019-19113.md): main/resources/mapper/NewBeeMallGoodsMapper.xml in newbee-mall (aka New Bee) before 2019-10-23 allows search?goodsCategoryId=&keyword= SQL I (no CVSS)
- [CVE-2018-21031](https://cve.now/CVE-2018-21031.md): Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token i (no CVSS)
- [CVE-2019-10172](https://cve.now/CVE-2019-10172.md): A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. (CVSS 5.9, Redhat jackson-mapper-asl · org.codehaus.jackson:jackson-ma…)
- [CVE-2019-19085](https://cve.now/CVE-2019-19085.md): A persistent cross-site scripting (XSS) vulnerability in Octopus Server 3.4.0 through 2019.10.5 allows remote authenticated attackers to inj (no CVSS)
- [CVE-2019-19084](https://cve.now/CVE-2019-19084.md): In Octopus Deploy 3.3.0 through 2019.10.4, an authenticated user with PackagePush permission to upload packages could upload a maliciously c (no CVSS)
- [CVE-2018-13257](https://cve.now/CVE-2018-13257.md): The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central (no CVSS)
- [CVE-2019-14467](https://cve.now/CVE-2019-14467.md): The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in th (no CVSS)
- [CVE-2019-17058](https://cve.now/CVE-2019-17058.md): Footy Tipping Software AFL Web Edition 2019 allows arbitrary file upload and resultant remote code execution because a whitelist can be bypa (no CVSS)
- [CVE-2019-17057](https://cve.now/CVE-2019-17057.md): Footy Tipping Software AFL Web Edition 2019 allows XSS. (no CVSS)
- [CVE-2019-19083](https://cve.now/CVE-2019-19083.md): Memory leaks in \*clock\_source\_create() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to ca (no CVSS)
- [CVE-2019-19082](https://cve.now/CVE-2019-19082.md): Memory leaks in \*create\_resource\_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.11 allow attackers to (no CVSS)
- [CVE-2019-19081](https://cve.now/CVE-2019-19081.md): A memory leak in the nfp\_flower\_spawn\_vnic\_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5 (no CVSS)
- [CVE-2019-19080](https://cve.now/CVE-2019-19080.md): Four memory leaks in the nfp\_flower\_spawn\_phy\_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel befor (no CVSS)
- [CVE-2019-19079](https://cve.now/CVE-2019-19079.md): A memory leak in the qrtr\_tun\_write\_iter() function in net/qrtr/tun.c in the Linux kernel before 5.3 allows attackers to cause a denial of s (no CVSS)
- [CVE-2019-19078](https://cve.now/CVE-2019-19078.md): A memory leak in the ath10k\_usb\_hif\_tx\_sg() function in drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.3.11 allows atta (no CVSS)
- [CVE-2019-19077](https://cve.now/CVE-2019-19077.md): A memory leak in the bnxt\_re\_create\_srq() function in drivers/infiniband/hw/bnxt\_re/ib\_verbs.c in the Linux kernel through 5.3.11 allows att (no CVSS)
- [CVE-2019-19076](https://cve.now/CVE-2019-19076.md): A memory leak in the nfp\_abm\_u32\_knode\_replace() function in drivers/net/ethernet/netronome/nfp/abm/cls.c in the Linux kernel before 5.3.6 a (no CVSS)
- [CVE-2019-19075](https://cve.now/CVE-2019-19075.md): A memory leak in the ca8210\_probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel before 5.3.8 allows attackers to cause a (no CVSS)
- [CVE-2019-19074](https://cve.now/CVE-2019-19074.md): A memory leak in the ath9k\_wmi\_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to (no CVSS)
- [CVE-2019-19073](https://cve.now/CVE-2019-19073.md): Memory leaks in drivers/net/wireless/ath/ath9k/htc\_hst.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (me (no CVSS)
- [CVE-2019-19072](https://cve.now/CVE-2019-19072.md): A memory leak in the predicate\_parse() function in kernel/trace/trace\_events\_filter.c in the Linux kernel through 5.3.11 allows attackers to (no CVSS)
- [CVE-2019-19071](https://cve.now/CVE-2019-19071.md): A memory leak in the rsi\_send\_beacon() function in drivers/net/wireless/rsi/rsi\_91x\_mgmt.c in the Linux kernel through 5.3.11 allows attacke (no CVSS)
- [CVE-2019-19070](https://cve.now/CVE-2019-19070.md): A memory leak in the spi\_gpio\_probe() function in drivers/spi/spi-gpio.c in the Linux kernel through 5.3.11 allows attackers to cause a deni (no CVSS)
- [CVE-2019-19069](https://cve.now/CVE-2019-19069.md): A memory leak in the fastrpc\_dma\_buf\_attach() function in drivers/misc/fastrpc.c in the Linux kernel before 5.3.9 allows attackers to cause (no CVSS)
- [CVE-2019-19068](https://cve.now/CVE-2019-19068.md): A memory leak in the rtl8xxxu\_submit\_int\_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu\_core.c in the Linux kernel through (no CVSS)
- [CVE-2019-19067](https://cve.now/CVE-2019-19067.md): Four memory leaks in the acp\_hw\_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu\_acp.c in the Linux kernel before 5.3.8 allow attackers (no CVSS)
- [CVE-2019-19066](https://cve.now/CVE-2019-19066.md): A memory leak in the bfad\_im\_get\_stats() function in drivers/scsi/bfa/bfad\_attr.c in the Linux kernel through 5.3.11 allows attackers to cau (no CVSS)
- [CVE-2019-19065](https://cve.now/CVE-2019-19065.md): A memory leak in the sdma\_init() function in drivers/infiniband/hw/hfi1/sdma.c in the Linux kernel before 5.3.9 allows attackers to cause a (no CVSS)
- [CVE-2019-19064](https://cve.now/CVE-2019-19064.md): A memory leak in the fsl\_lpspi\_probe() function in drivers/spi/spi-fsl-lpspi.c in the Linux kernel through 5.3.11 allows attackers to cause (no CVSS)
- [CVE-2019-19063](https://cve.now/CVE-2019-19063.md): Two memory leaks in the rtl\_usb\_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the Linux kernel through 5.3.11 allow atta (no CVSS)
- [CVE-2019-19062](https://cve.now/CVE-2019-19062.md): A memory leak in the crypto\_report() function in crypto/crypto\_user\_base.c in the Linux kernel through 5.3.11 allows attackers to cause a de (no CVSS)
- [CVE-2019-19061](https://cve.now/CVE-2019-19061.md): A memory leak in the adis\_update\_scan\_mode\_burst() function in drivers/iio/imu/adis\_buffer.c in the Linux kernel before 5.3.9 allows attacke (no CVSS)
- [CVE-2019-19060](https://cve.now/CVE-2019-19060.md): A memory leak in the adis\_update\_scan\_mode() function in drivers/iio/imu/adis\_buffer.c in the Linux kernel before 5.3.9 allows attackers to (no CVSS)
- [CVE-2019-19059](https://cve.now/CVE-2019-19059.md): Multiple memory leaks in the iwl\_pcie\_ctxt\_info\_gen3\_init() function in drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c in the Linu (no CVSS)
- [CVE-2019-19058](https://cve.now/CVE-2019-19058.md): A memory leak in the alloc\_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c in the Linux kernel through 5.3.11 allows attac (no CVSS)
- [CVE-2019-19057](https://cve.now/CVE-2019-19057.md): Two memory leaks in the mwifiex\_pcie\_init\_evt\_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3 (no CVSS)
- [CVE-2019-19056](https://cve.now/CVE-2019-19056.md): A memory leak in the mwifiex\_pcie\_alloc\_cmdrsp\_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3 (no CVSS)
- [CVE-2019-19055](https://cve.now/CVE-2019-19055.md): A memory leak in the nl80211\_get\_ftm\_responder\_stats() function in net/wireless/nl80211.c in the Linux kernel through 5.3.11 allows attacker (no CVSS)
- [CVE-2019-19054](https://cve.now/CVE-2019-19054.md): A memory leak in the cx23888\_ir\_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through 5.3.11 allows attacke (no CVSS)
- [CVE-2019-19053](https://cve.now/CVE-2019-19053.md): A memory leak in the rpmsg\_eptdev\_write\_iter() function in drivers/rpmsg/rpmsg\_char.c in the Linux kernel through 5.3.11 allows attackers to (no CVSS)
- [CVE-2019-19052](https://cve.now/CVE-2019-19052.md): A memory leak in the gs\_can\_open() function in drivers/net/can/usb/gs\_usb.c in the Linux kernel before 5.3.11 allows attackers to cause a de (no CVSS)
- [CVE-2019-19051](https://cve.now/CVE-2019-19051.md): A memory leak in the i2400m\_op\_rfkill\_sw\_toggle() function in drivers/net/wimax/i2400m/op-rfkill.c in the Linux kernel before 5.3.11 allows (no CVSS)
- [CVE-2019-19050](https://cve.now/CVE-2019-19050.md): A memory leak in the crypto\_reportstat() function in crypto/crypto\_user\_stat.c in the Linux kernel through 5.3.11 allows attackers to cause (no CVSS)
- [CVE-2019-19049](https://cve.now/CVE-2019-19049.md): A memory leak in the unittest\_data\_add() function in drivers/of/unittest.c in the Linux kernel before 5.3.10 allows attackers to cause a den (no CVSS)
- [CVE-2019-19048](https://cve.now/CVE-2019-19048.md): A memory leak in the crypto\_reportstat() function in drivers/virt/vboxguest/vboxguest\_utils.c in the Linux kernel before 5.3.9 allows attack (no CVSS)
- [CVE-2019-19047](https://cve.now/CVE-2019-19047.md): A memory leak in the mlx5\_fw\_fatal\_reporter\_dump() function in drivers/net/ethernet/mellanox/mlx5/core/health.c in the Linux kernel before 5 (no CVSS)
- [CVE-2019-19046](https://cve.now/CVE-2019-19046.md): A memory leak in the \_\_ipmi\_bmc\_register() function in drivers/char/ipmi/ipmi\_msghandler.c in the Linux kernel through 5.3.11 allows attacke (no CVSS)
- [CVE-2019-19045](https://cve.now/CVE-2019-19045.md): A memory leak in the mlx5\_fpga\_conn\_create\_cq() function in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c in the Linux kernel before 5 (no CVSS)
- [CVE-2019-19044](https://cve.now/CVE-2019-19044.md): Two memory leaks in the v3d\_submit\_cl\_ioctl() function in drivers/gpu/drm/v3d/v3d\_gem.c in the Linux kernel before 5.3.11 allow attackers to (no CVSS)
- [CVE-2019-19043](https://cve.now/CVE-2019-19043.md): A memory leak in the i40e\_setup\_macvlans() function in drivers/net/ethernet/intel/i40e/i40e\_main.c in the Linux kernel through 5.3.11 allows (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-11-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.