# CVEs published 2019-11-20

42 CVEs were published on November 20, 2019: 0 critical, 2 high. Days are UTC.

- [CVE-2019-6852](https://cve.now/CVE-2019-6852.md): A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium co (CVSS 7.5, Schneider Electric Modicon Controllers)
- [CVE-2019-6853](https://cve.now/CVE-2019-6853.md): A CWE-79: Failure to Preserve Web Page Structure vulnerability exists in Andover Continuum (models 9680, 5740 and 5720, bCX4040, bCX9640, 99 (no CVSS, Schneider Electric Andover Continuum models 9680, 5740 and…)
- [CVE-2015-3166](https://cve.now/CVE-2015-3166.md): The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4. (no CVSS, PostgreSQL Global Development Group PostgreSQL)
- [CVE-2015-3167](https://cve.now/CVE-2015-3167.md): contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses diff (no CVSS, PostgreSQL Global Development Group PostgreSQL)
- [CVE-2013-2093](https://cve.now/CVE-2013-2093.md): Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute a (no CVSS, dolibarr)
- [CVE-2013-2092](https://cve.now/CVE-2013-2092.md): Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php. (no CVSS, dolibarr)
- [CVE-2013-2091](https://cve.now/CVE-2013-2091.md): SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in (no CVSS, dolibarr)
- [CVE-2013-1817](https://cve.now/CVE-2013-1817.md): MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive i (no CVSS, mediawiki)
- [CVE-2012-1257](https://cve.now/CVE-2012-1257.md): Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information via a dbus session mon (no CVSS)
- [CVE-2013-1816](https://cve.now/CVE-2013-1816.md): MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a speci (no CVSS, mediawiki)
- [CVE-2011-4455](https://cve.now/CVE-2011-4455.md): Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2011-4454](https://cve.now/CVE-2011-4454.md): Multiple cross-site scripting vulnerabilities in Tiki 8.0 RC1 and earlier allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2015-1607](https://cve.now/CVE-2015-1607.md): kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which (no CVSS)
- [CVE-2015-1606](https://cve.now/CVE-2015-1606.md): The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (i (no CVSS)
- [CVE-2019-3466](https://cve.now/CVE-2019-3466.md): The pg\_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary dire (no CVSS, postgresql-common)
- [CVE-2019-18858](https://cve.now/CVE-2019-18858.md): CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow. (no CVSS)
- [CVE-2010-4659](https://cve.now/CVE-2010-4659.md): Cross-site scripting (XSS) vulnerability in statusnet through 2010 in error message contents. (no CVSS, statusnet)
- [CVE-2019-4561](https://cve.now/CVE-2019-4561.md): IBM Security Identity Manager 6.0.0 could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of (CVSS 8.0, IBM Security Identity Manager)
- [CVE-2019-4530](https://cve.now/CVE-2019-4530.md): IBM Maximo Asset Management 7.6, 7.6.1, and 7.6.1.1 could allow an authenticated user to delete a record that they should not normally be ab (CVSS 4.3, IBM Maximo Asset Management)
- [CVE-2010-4660](https://cve.now/CVE-2010-4660.md): Unspecified vulnerability in statusnet through 2010 due to the way addslashes are used in SQL string escapes.. (no CVSS, statusnet)
- [CVE-2019-10765](https://cve.now/CVE-2019-10765.md): iobroker.admin before 3.6.12 allows attacker to include file contents from outside the \`/log/file1/\` directory. (no CVSS, iobroker.admin)
- [CVE-2011-0529](https://cve.now/CVE-2011-0529.md): Weborf before 0.12.5 is affected by a Denial of Service (DOS) due to malformed fields in HTTP. (no CVSS, weborf)
- [CVE-2019-5542](https://cve.now/CVE-2019-5542.md): VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain a denial-of-service vulnerability in the RPC handler. (no CVSS, VMware Workstation and Fusion)
- [CVE-2019-5541](https://cve.now/CVE-2019-5541.md): VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain an out-of-bounds write vulnerability in the e1000e virtual n (no CVSS, VMware Workstation and Fusion)
- [CVE-2019-5540](https://cve.now/CVE-2019-5540.md): VMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain an information disclosure vulnerability in vmnetdhcp. (no CVSS, VMware Workstation and Fusion)
- [CVE-2016-9652](https://cve.now/CVE-2016-9652.md): Multiple unspecified vulnerabilities in Google Chrome before 55.0.2883.75. (no CVSS, Google Chrome)
- [CVE-2016-5194](https://cve.now/CVE-2016-5194.md): Unspecified vulnerabilities in Google Chrome before 54.0.2840.59. (no CVSS, Google Chrome)
- [CVE-2011-1028](https://cve.now/CVE-2011-1028.md): The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smarty\_internal\_compile\_ (no CVSS, smarty3 · smarty/smarty)
- [CVE-2013-0195](https://cve.now/CVE-2013-0195.md): Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. (no CVSS, piwik)
- [CVE-2013-0194](https://cve.now/CVE-2013-0194.md): Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. (no CVSS, piwik)
- [CVE-2013-0193](https://cve.now/CVE-2013-0193.md): Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. (no CVSS, piwik)
- [CVE-2012-6136](https://cve.now/CVE-2012-6136.md): tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes. (no CVSS, tuned)
- [CVE-2019-16200](https://cve.now/CVE-2019-16200.md): GNU Serveez through 0.2.2 has an Information Leak. (no CVSS)
- [CVE-2019-15072](https://cve.now/CVE-2019-15072.md): Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting (no CVSS, Openfind MAIL2000)
- [CVE-2019-15073](https://cve.now/CVE-2019-15073.md): Openfind MAIL2000 Webmail Pre-Auth Open Redirect (no CVSS, Openfind MAIL2000)
- [CVE-2019-15071](https://cve.now/CVE-2019-15071.md): Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting (no CVSS, Openfind MAIL2000)
- [CVE-2019-6191](https://cve.now/CVE-2019-6191.md): A potential vulnerability in the discontinued LenovoPaper software version 1.0.0.22 may allow local privilege escalation. (no CVSS, LenovoPaper)
- [CVE-2019-6189](https://cve.now/CVE-2019-6189.md): A potential vulnerability was reported in Lenovo System Interface Foundation versions before v1.1.18.3 that could allow an administrative us (no CVSS, Lenovo System Interface Foundation)
- [CVE-2019-6187](https://cve.now/CVE-2019-6187.md): A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriat (no CVSS, Lenovo XClarity Controller)
- [CVE-2019-6186](https://cve.now/CVE-2019-6186.md): A potential vulnerability was reported in Lenovo System Interface Foundation versions before v1.1.18.3 that could allow an authenticated use (no CVSS, Lenovo System Interface Foundation)
- [CVE-2019-6184](https://cve.now/CVE-2019-6184.md): A potential vulnerability in the discontinued Customer Engagement Service (CCSDK) software version 2.0.21.1 may allow local privilege escala (no CVSS, Lenovo Customer Engagement Service)
- [CVE-2019-6176](https://cve.now/CVE-2019-6176.md): A potential vulnerability reported in ThinkPad USB-C Dock Firmware version 3.7.2 may allow a denial of service. (no CVSS, Lenovo ThinkPad USB-C Dock Firmware)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-11-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.