CVEs published November 20, 2019
42 CVEs were published on November 20, 2019: 0 critical, 2 high.
- Published
- 42
- Critical
- 0
- High
- 2
- Medium
- 1
- Low
- 0
- Unrated
- 39
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- dolibarr
- 3
- Openfind MAIL2000
- 3
- piwik
- 3
- VMware Workstation and Fusion
- 3
- Google Chrome
- 2
- Lenovo System Interface Foundation
- 2
- mediawiki
- 2
- PostgreSQL Global Development Group PostgreSQL
- 2
- statusnet
- 2
- IBM Maximo Asset Management
- 1
High 2
- CVE-2019-6852A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium coSchneider Electric Modicon Controllers
- CVE-2019-4561IBM Security Identity Manager 6.0.0 could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of IBM Security Identity Manager
Medium, low and unrated 40
- CVE-2019-6853A CWE-79: Failure to Preserve Web Page Structure vulnerability exists in Andover Continuum (models 9680, 5740 and 5720, bCX4040, bCX9640, 99Schneider Electric Andover Continuum models 9680, 5740 and…
- CVE-2015-3166The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.PostgreSQL Global Development Group PostgreSQL
- CVE-2015-3167contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses diffPostgreSQL Global Development Group PostgreSQL
- CVE-2013-2093Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute adolibarr
- CVE-2013-2092Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php.dolibarr
- CVE-2013-2091SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in dolibarr
- CVE-2013-1817MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive imediawiki
- CVE-2012-1257Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information via a dbus session mon
- CVE-2013-1816MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specimediawiki
- CVE-2011-4455Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the
- CVE-2011-4454Multiple cross-site scripting vulnerabilities in Tiki 8.0 RC1 and earlier allow remote attackers to inject arbitrary web script or HTML via
- CVE-2015-1607kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which
- CVE-2015-1606The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (i
- CVE-2019-3466The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary direpostgresql-common
- CVE-2019-18858CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow.
- CVE-2010-4659Cross-site scripting (XSS) vulnerability in statusnet through 2010 in error message contents.statusnet
- CVE-2019-4530IBM Maximo Asset Management 7.6, 7.6.1, and 7.6.1.1 could allow an authenticated user to delete a record that they should not normally be abIBM Maximo Asset Management
- CVE-2010-4660Unspecified vulnerability in statusnet through 2010 due to the way addslashes are used in SQL string escapes..statusnet
- CVE-2019-10765iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory.iobroker.admin
- CVE-2011-0529Weborf before 0.12.5 is affected by a Denial of Service (DOS) due to malformed fields in HTTP.weborf
- CVE-2019-5542VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain a denial-of-service vulnerability in the RPC handler.VMware Workstation and Fusion
- CVE-2019-5541VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain an out-of-bounds write vulnerability in the e1000e virtual nVMware Workstation and Fusion
- CVE-2019-5540VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain an information disclosure vulnerability in vmnetdhcp.VMware Workstation and Fusion
- CVE-2016-9652Multiple unspecified vulnerabilities in Google Chrome before 55.0.2883.75.Google Chrome
- CVE-2016-5194Unspecified vulnerabilities in Google Chrome before 54.0.2840.59.Google Chrome
- CVE-2011-1028The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smarty_internal_compile_smarty3 · smarty/smarty
- CVE-2013-0195Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.piwik
- CVE-2013-0194Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.piwik
- CVE-2013-0193Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.piwik
- CVE-2012-6136tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes.tuned
- CVE-2019-16200GNU Serveez through 0.2.2 has an Information Leak.
- CVE-2019-15072Openfind MAIL2000 Webmail Post-Auth Cross-Site ScriptingOpenfind MAIL2000
- CVE-2019-15073Openfind MAIL2000 Webmail Pre-Auth Open RedirectOpenfind MAIL2000
- CVE-2019-15071Openfind MAIL2000 Webmail Pre-Auth Cross-Site ScriptingOpenfind MAIL2000
- CVE-2019-6191A potential vulnerability in the discontinued LenovoPaper software version 1.0.0.22 may allow local privilege escalation.LenovoPaper
- CVE-2019-6189A potential vulnerability was reported in Lenovo System Interface Foundation versions before v1.1.18.3 that could allow an administrative usLenovo System Interface Foundation
- CVE-2019-6187A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriatLenovo XClarity Controller
- CVE-2019-6186A potential vulnerability was reported in Lenovo System Interface Foundation versions before v1.1.18.3 that could allow an authenticated useLenovo System Interface Foundation
- CVE-2019-6184A potential vulnerability in the discontinued Customer Engagement Service (CCSDK) software version 2.0.21.1 may allow local privilege escalaLenovo Customer Engagement Service
- CVE-2019-6176A potential vulnerability reported in ThinkPad USB-C Dock Firmware version 3.7.2 may allow a denial of service.Lenovo ThinkPad USB-C Dock Firmware