CVEs published November 19, 2019
31 CVEs were published on November 19, 2019: 0 critical, 1 high.
- Published
- 31
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- cobbler
- 2
- foomatic-filters
- 2
- ktsuss
- 2
- AngularJS · angular
- 1
- Apache NiFi · org.apache.nifi:nifi-security +1
- 1
- Apache NiFi · org.apache.nifi:nifi-web-api +1
- 1
- Apache NiFi · org.apache.nifi:nifi-web-security +1
- 1
- Cloud Foundry Routing · code.cloudfoundry.org/gorouter +1
- 1
- cookie-signature
- 1
- falconpl
- 1
High 1
Medium, low and unrated 30
- CVE-2011-3352Zikula 1.3.0 build #3168 and probably prior has XSS flaw due to improper sanitization of the 'themename' parameter by setting default, modifZikula
- CVE-2011-3350masqmail 0.2.21 through 0.2.30 improperly calls seteuid() in src/log.c and src/masqmail.c that results in improper privilege dropping.masqmail
- CVE-2011-3349lightdm before 0.9.6 writes in .dmrc and Xauthority files using root permissions while the files are in user controlled folders.lightdm
- CVE-2019-10083When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the Apache NiFi · org.apache.nifi:nifi-web-api +1
- CVE-2019-12421When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the auApache NiFi · org.apache.nifi:nifi-web-security +1
- CVE-2019-10080The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file.Apache NiFi · org.apache.nifi:nifi-security +1
- CVE-2011-2924foomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of PostScript data by rendering the data when the foomatic-filters
- CVE-2011-2923foomatic-rip filter, all versions, used insecurely creates temporary files for storage of PostScript data by rendering the data when the debfoomatic-filters
- CVE-2019-10768In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__protoAngularJS · angular
- CVE-2019-10766Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.Pixie Query Builder · usmanhalalit/pixie
- CVE-2011-2922ktsuss versions 1.4 and prior spawns the GTK interface to run as root.ktsuss
- CVE-2019-18934Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially craf
- CVE-2016-1000236Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.cookie-signature
- CVE-2011-2921ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified commands, which can resktsuss
- CVE-2012-6135RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process.ruby-passenger · passenger
- CVE-2012-6071nuSOAP before 0.7.3-5 does not properly check the hostname of a cert.nusoap
- CVE-2012-6070Falconpl before 0.9.6.9-git20120606 misuses the libcurl API which may allow remote attackers to interfere with security checks.falconpl
- CVE-2012-0843uzbl: Information disclosure via world-readable cookies storage fileuzbl
- CVE-2012-0824gnusound 0.7.5 has format string issuegnusound
- CVE-2011-4954cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHEcobbler
- CVE-2011-4919mpack 1.6 has information disclosure via eavesdropping on mails sent by other usersmpack
- CVE-2011-4952cobbler: Web interface lacks CSRF protection when using Django frameworkcobbler
- CVE-2011-4968nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)nginx
- CVE-2011-4967tog-Pegasus has a package hash collision DoS vulnerabilitytog-pegasus
- CVE-2014-5439Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file that will bypass Non-
- CVE-2012-0842surf: cookie jar has read access from other local usersurf
- CVE-2016-1000006hhvm before 3.12.11 has a use-after-free in the serialize_memoize_param() and ResourceBundle::__construct() functions.
- CVE-2019-16861Code42 server through 7.0.2 for Windows has an Untrusted Search Path.
- CVE-2019-16860Code42 app through version 7.0.2 for Windows has an Untrusted Search Path.
- CVE-2019-19126On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable duri