# CVEs published 2019-11-19

31 CVEs were published on November 19, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2011-3352](https://cve.now/CVE-2011-3352.md): Zikula 1.3.0 build #3168 and probably prior has XSS flaw due to improper sanitization of the 'themename' parameter by setting default, modif (no CVSS, Zikula)
- [CVE-2011-3350](https://cve.now/CVE-2011-3350.md): masqmail 0.2.21 through 0.2.30 improperly calls seteuid() in src/log.c and src/masqmail.c that results in improper privilege dropping. (no CVSS, masqmail)
- [CVE-2011-3349](https://cve.now/CVE-2011-3349.md): lightdm before 0.9.6 writes in .dmrc and Xauthority files using root permissions while the files are in user controlled folders. (no CVSS, lightdm)
- [CVE-2019-10083](https://cve.now/CVE-2019-10083.md): When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the (no CVSS, Apache NiFi · org.apache.nifi:nifi-web-api +1)
- [CVE-2019-12421](https://cve.now/CVE-2019-12421.md): When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the au (no CVSS, Apache NiFi · org.apache.nifi:nifi-web-security +1)
- [CVE-2019-10080](https://cve.now/CVE-2019-10080.md): The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. (no CVSS, Apache NiFi · org.apache.nifi:nifi-security +1)
- [CVE-2011-2924](https://cve.now/CVE-2011-2924.md): foomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of PostScript data by rendering the data when the (no CVSS, foomatic-filters)
- [CVE-2011-2923](https://cve.now/CVE-2011-2923.md): foomatic-rip filter, all versions, used insecurely creates temporary files for storage of PostScript data by rendering the data when the deb (no CVSS, foomatic-filters)
- [CVE-2019-10768](https://cve.now/CVE-2019-10768.md): In AngularJS before 1.7.9 the function \`merge()\` could be tricked into adding or modifying properties of \`Object.prototype\` using a \`\_\_proto (no CVSS, AngularJS · angular)
- [CVE-2019-10766](https://cve.now/CVE-2019-10766.md): Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization. (no CVSS, Pixie Query Builder · usmanhalalit/pixie)
- [CVE-2019-11289](https://cve.now/CVE-2019-11289.md): A forged route service request using an invalid nonce can cause the gorouter to panic and crash (CVSS 8.6, Cloud Foundry Routing · code.cloudfoundry.org/gorouter +1)
- [CVE-2011-2922](https://cve.now/CVE-2011-2922.md): ktsuss versions 1.4 and prior spawns the GTK interface to run as root. (no CVSS, ktsuss)
- [CVE-2019-18934](https://cve.now/CVE-2019-18934.md): Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially craf (no CVSS)
- [CVE-2016-1000236](https://cve.now/CVE-2016-1000236.md): Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used. (no CVSS, cookie-signature)
- [CVE-2011-2921](https://cve.now/CVE-2011-2921.md): ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified commands, which can res (no CVSS, ktsuss)
- [CVE-2012-6135](https://cve.now/CVE-2012-6135.md): RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process. (no CVSS, ruby-passenger · passenger)
- [CVE-2012-6071](https://cve.now/CVE-2012-6071.md): nuSOAP before 0.7.3-5 does not properly check the hostname of a cert. (no CVSS, nusoap)
- [CVE-2012-6070](https://cve.now/CVE-2012-6070.md): Falconpl before 0.9.6.9-git20120606 misuses the libcurl API which may allow remote attackers to interfere with security checks. (no CVSS, falconpl)
- [CVE-2012-0843](https://cve.now/CVE-2012-0843.md): uzbl: Information disclosure via world-readable cookies storage file (no CVSS, uzbl)
- [CVE-2012-0824](https://cve.now/CVE-2012-0824.md): gnusound 0.7.5 has format string issue (no CVSS, gnusound)
- [CVE-2011-4954](https://cve.now/CVE-2011-4954.md): cobbler has local privilege escalation via the use of insecure location for PYTHON\_EGG\_CACHE (no CVSS, cobbler)
- [CVE-2011-4919](https://cve.now/CVE-2011-4919.md): mpack 1.6 has information disclosure via eavesdropping on mails sent by other users (no CVSS, mpack)
- [CVE-2011-4952](https://cve.now/CVE-2011-4952.md): cobbler: Web interface lacks CSRF protection when using Django framework (no CVSS, cobbler)
- [CVE-2011-4968](https://cve.now/CVE-2011-4968.md): nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM) (no CVSS, nginx)
- [CVE-2011-4967](https://cve.now/CVE-2011-4967.md): tog-Pegasus has a package hash collision DoS vulnerability (no CVSS, tog-pegasus)
- [CVE-2014-5439](https://cve.now/CVE-2014-5439.md): Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file that will bypass Non- (no CVSS)
- [CVE-2012-0842](https://cve.now/CVE-2012-0842.md): surf: cookie jar has read access from other local user (no CVSS, surf)
- [CVE-2016-1000006](https://cve.now/CVE-2016-1000006.md): hhvm before 3.12.11 has a use-after-free in the serialize\_memoize\_param() and ResourceBundle::\_\_construct() functions. (no CVSS)
- [CVE-2019-16861](https://cve.now/CVE-2019-16861.md): Code42 server through 7.0.2 for Windows has an Untrusted Search Path. (no CVSS)
- [CVE-2019-16860](https://cve.now/CVE-2019-16860.md): Code42 app through version 7.0.2 for Windows has an Untrusted Search Path. (no CVSS)
- [CVE-2019-19126](https://cve.now/CVE-2019-19126.md): On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD\_PREFER\_MAP\_32BIT\_EXEC environment variable duri (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-11-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.