# CVEs published 2019-11-21

105 CVEs were published on November 21, 2019: 1 critical, 5 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2012-2079](https://cve.now/CVE-2012-2079.md): A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal. (no CVSS, Activity)
- [CVE-2012-2078](https://cve.now/CVE-2012-2078.md): Cross-site scripting (XSS) vulnerability in the Activity module 6.x-1.x for Drupal. (no CVSS, Activity)
- [CVE-2012-1637](https://cve.now/CVE-2012-1637.md): Cross-site scripting vulnerability (XSS) in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3 (no CVSS, Quick Tabs Quicktabs)
- [CVE-2019-18933](https://cve.now/CVE-2019-18933.md): In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account usin (no CVSS)
- [CVE-2014-5255](https://cve.now/CVE-2014-5255.md): xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. (no CVSS, xcfa)
- [CVE-2014-5254](https://cve.now/CVE-2014-5254.md): xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. (no CVSS, xcfa)
- [CVE-2019-18889](https://cve.now/CVE-2019-18889.md): An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. (no CVSS, symfony/cache · symfony/symfony)
- [CVE-2019-18888](https://cve.now/CVE-2019-18888.md): An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. (no CVSS, symfony/http-foundation · symfony/mime +1)
- [CVE-2019-18887](https://cve.now/CVE-2019-18887.md): An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. (no CVSS, symfony/http-kernel · symfony/symfony)
- [CVE-2019-11325](https://cve.now/CVE-2019-11325.md): An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. (no CVSS, symfony/symfony · symfony/var-exporter)
- [CVE-2014-2904](https://cve.now/CVE-2014-2904.md): wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication. (no CVSS)
- [CVE-2014-2902](https://cve.now/CVE-2014-2902.md): wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates. (no CVSS)
- [CVE-2014-2901](https://cve.now/CVE-2014-2901.md): wolfssl before 3.2.0 does not properly issue certificates for a server's hostname. (no CVSS)
- [CVE-2012-1001](https://cve.now/CVE-2012-1001.md): Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary w (no CVSS)
- [CVE-2014-8356](https://cve.now/CVE-2014-8356.md): The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions v (no CVSS)
- [CVE-2015-3140](https://cve.now/CVE-2015-3140.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan before 3.5 Build 1451, Syncrify before 3.7 Bu (no CVSS)
- [CVE-2019-19207](https://cve.now/CVE-2019-19207.md): rConfig 3.9.2 allows devices.php?searchColumn= SQL injection. (no CVSS)
- [CVE-2019-19203](https://cve.now/CVE-2019-19203.md): An issue was discovered in Oniguruma 6.x before 6.9.4\_rc2. (no CVSS)
- [CVE-2019-19204](https://cve.now/CVE-2019-19204.md): An issue was discovered in Oniguruma 6.x before 6.9.4\_rc2. (no CVSS)
- [CVE-2019-19202](https://cve.now/CVE-2019-19202.md): In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role b (no CVSS)
- [CVE-2015-2793](https://cve.now/CVE-2015-2793.md): Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject ar (no CVSS, ikiwiki)
- [CVE-2013-3311](https://cve.now/CVE-2013-3311.md): Directory traversal vulnerability in the Loftek Nexus 543 IP Camera allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2013-3312](https://cve.now/CVE-2013-3312.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Loftek Nexus 543 IP Camera allow remote attackers to hijack the authentica (no CVSS)
- [CVE-2013-3313](https://cve.now/CVE-2013-3313.md): The Loftek Nexus 543 IP Camera stores passwords in cleartext, which allows remote attackers to obtain sensitive information via an HTTP GET (no CVSS)
- [CVE-2013-3314](https://cve.now/CVE-2013-3314.md): The Loftek Nexus 543 IP Camera allows remote attackers to obtain (1) IP addresses via a request to get\_realip.cgi or (2) firmware versions ( (no CVSS)
- [CVE-2019-5637](https://cve.now/CVE-2019-5637.md): Beckhoff TwinCAT Profinet Driver Divide-by-Zero Denial of Service (CVSS 7.5, Beckhoff TwinCAT)
- [CVE-2019-5636](https://cve.now/CVE-2019-5636.md): Beckhoff TwinCAT Discovery Service Denial of Service (CVSS 5.3, Beckhoff TwinCAT)
- [CVE-2019-19197](https://cve.now/CVE-2019-19197.md): IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escalation, denial-of-serv (no CVSS)
- [CVE-2019-16758](https://cve.now/CVE-2019-16758.md): In Lexmark Services Monitor 2.27.4.0.39 (running on TCP port 2070), a remote attacker can use a directory traversal technique using /../../. (no CVSS)
- [CVE-2019-18349](https://cve.now/CVE-2019-18349.md): HotkeyP through 4.9 r96 allows privilege escalation in the privilege function in Commands.cpp. (no CVSS)
- [CVE-2019-19033](https://cve.now/CVE-2019-19033.md): Jalios JCMS 10 allows attackers to access any part of the website and the WebDAV server with administrative privileges via a backdoor accoun (no CVSS)
- [CVE-2019-19006](https://cve.now/CVE-2019-19006.md): Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control. (CVSS 9.8, KEV)
- [CVE-2019-15511](https://cve.now/CVE-2019-15511.md): An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy. (no CVSS)
- [CVE-2019-18890](https://cve.now/CVE-2019-18890.md): A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a cr (no CVSS)
- [CVE-2019-18886](https://cve.now/CVE-2019-18886.md): An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. (no CVSS, symfony/security-http · symfony/symfony)
- [CVE-2019-16406](https://cve.now/CVE-2019-16406.md): Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual machine) files, allowi (no CVSS)
- [CVE-2019-16405](https://cve.now/CVE-2019-16405.md): Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an adm (no CVSS, centreon/centreon)
- [CVE-2019-19191](https://cve.now/CVE-2019-19191.md): Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service use (no CVSS)
- [CVE-2019-5072](https://cve.now/CVE-2019-5072.md): An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual (CVSS 7.8, Tenda AC9)
- [CVE-2019-5071](https://cve.now/CVE-2019-5071.md): An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual (CVSS 7.8, Tenda AC9)
- [CVE-2019-10767](https://cve.now/CVE-2019-10767.md): An attacker can include file contents from outside the \`/adapter/xxx/\` directory, where \`xxx\` is the name of an existent adapter like "admin (no CVSS, iobroker.js-controller)
- [CVE-2019-5087](https://cve.now/CVE-2019-5087.md): An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools 1. (CVSS 8.8, xcftools)
- [CVE-2019-5086](https://cve.now/CVE-2019-5086.md): An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools, v (CVSS 7.5, xcftools)
- [CVE-2019-17272](https://cve.now/CVE-2019-17272.md): All versions of ONTAP Select Deploy administration utility are susceptible to a vulnerability which when successfully exploited could allow (no CVSS, NetApp ONTAP Select Deploy administration utility)
- [CVE-2019-5509](https://cve.now/CVE-2019-5509.md): ONTAP Select Deploy administration utility versions 2.11.2 through 2.12.2 are susceptible to a code injection vulnerability which when succe (no CVSS, NetApp ONTAP Select Deploy administration utility)
- [CVE-2018-8879](https://cve.now/CVE-2018-8879.md): Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devi (no CVSS)
- [CVE-2019-6693](https://cve.now/CVE-2019-6693.md): Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the (CVSS 6.5, KEV, Fortinet FortiGate)
- [CVE-2019-17650](https://cve.now/CVE-2019-17650.md): An Improper Neutralization of Special Elements used in a Command vulnerability in one of FortiClient for Mac OS root processes, may allow a (no CVSS, Fortinet FortiClient for Mac OS)
- [CVE-2018-9195](https://cve.now/CVE-2018-9195.md): Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the k (no CVSS, Fortinet FortiClient for Windows · Fortinet FortiOS +1)
- [CVE-2019-15704](https://cve.now/CVE-2019-15704.md): A clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a local attacker to read sensitive information (no CVSS, Fortinet FortiClient for Mac OS)
- [CVE-2019-16340](https://cve.now/CVE-2019-16340.md): Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfo\_json.cg (no CVSS)
- [CVE-2019-10617](https://cve.now/CVE-2019-10617.md): Low privilege users can access service configuration which contains registry data that admins uses to create or delete entries in the regist (no CVSS, Qualcomm QCA6174\_9377.WIN.1.0)
- [CVE-2019-10627](https://cve.now/CVE-2019-10627.md): Integer overflow to buffer overflow vulnerability in PostScript image handling code used by the PostScript- and PDF-compatible interpreters (no CVSS, Qualcomm PostScript and PDF printers that use IPS versions…)
- [CVE-2019-2251](https://cve.now/CVE-2019-2251.md): If a bitmap file is loaded from any un-authenticated source, there is a possibility that the bitmap can potentially cause stack buffer overf (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2266](https://cve.now/CVE-2019-2266.md): Possible double free issue in kernel while handling the camera sensor and its sub modules power sequence in Snapdragon Auto, Snapdragon Cons (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-2268](https://cve.now/CVE-2019-2268.md): Possible OOB read issue in P2P action frames while handling WLAN management frame in Snapdragon Auto, Snapdragon Consumer Electronics Connec (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-2271](https://cve.now/CVE-2019-2271.md): Buffer over read can happen while parsing downlink session management OTA messages if network sends un-intended values in Snapdragon Auto, S (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2289](https://cve.now/CVE-2019-2289.md): Lack of integrity check allows MODEM to accept any NAS messages which can result into authentication bypass of NAS in Snapdragon Auto, Snapd (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2295](https://cve.now/CVE-2019-2295.md): Information disclosure due to lack of address range check done on the SysDBG buffers in SDI code. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2297](https://cve.now/CVE-2019-2297.md): Buffer overflow can occur while processing non-standard NAN message from user space. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-2303](https://cve.now/CVE-2019-2303.md): SNDCP module may access array out side its boundary when it receives malformed XID message. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2315](https://cve.now/CVE-2019-2315.md): While invoking the API to copy from fd or local buffer to the secure buffer, Parameters being populated are from non secure environment. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2318](https://cve.now/CVE-2019-2318.md): Non Secure Kernel can cause Trustzone to do an arbitrary memory read which will result into DOS in Snapdragon Auto, Snapdragon Connectivity, (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2019-2329](https://cve.now/CVE-2019-2329.md): Use after free issue in cleanup routine due to missing pointer sanitization for a failed start of a trusted application. (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…)
- [CVE-2019-2335](https://cve.now/CVE-2019-2335.md): While processing Attach Reject message, Valid exit condition is not met resulting into an infinite loop in Snapdragon Auto, Snapdragon Compu (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2336](https://cve.now/CVE-2019-2336.md): Subsequent use of the CBO listener may result in further memory corruption due to use after free issue. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2339](https://cve.now/CVE-2019-2339.md): Out of bound access due to lack of check of whiltelist array size while reading the image elf segments. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-13916](https://cve.now/CVE-2018-13916.md): Out-of-bounds memory access in Qurt kernel function when using the identifier to access Qurt kernel buffer to retrieve thread data. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10486](https://cve.now/CVE-2019-10486.md): Race condition due to the lack of resource lock which will be concurrently modified in the memcpy statement leads to out of bound access in (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-10490](https://cve.now/CVE-2019-10490.md): Use after free issue in Xtra daemon shutdown due to static object instance getting freed from a multiple places in Snapdragon Auto, Snapdrag (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10503](https://cve.now/CVE-2019-10503.md): Out-of-bounds access can occur in camera driver due to improper validation of array index in Snapdragon Auto, Snapdragon Consumer Electronic (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-10535](https://cve.now/CVE-2019-10535.md): Improper validation for loop variable received from firmware can lead to out of bound access in WLAN function while iterating through loop i (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10563](https://cve.now/CVE-2019-10563.md): Buffer over-read can occur in fast message handler due to improper input validation while processing a message from firmware in Snapdragon A (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-10566](https://cve.now/CVE-2019-10566.md): Buffer overflow can occur in wlan module if supported rates or extended rates element length is greater than max rate set length in Snapdrag (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-17421](https://cve.now/CVE-2019-17421.md): Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 all (no CVSS)
- [CVE-2014-3700](https://cve.now/CVE-2014-3700.md): eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data (no CVSS, eDeploy)
- [CVE-2014-1938](https://cve.now/CVE-2014-1938.md): python-rply before 0.7.4 insecurely creates temporary files. (no CVSS, rply)
- [CVE-2014-1937](https://cve.now/CVE-2014-1937.md): Gamera before 3.4.1 insecurely creates temporary files. (no CVSS)
- [CVE-2014-1936](https://cve.now/CVE-2014-1936.md): rc before 1.7.1-5 insecurely creates temporary files. (no CVSS)
- [CVE-2014-1935](https://cve.now/CVE-2014-1935.md): 9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames. (no CVSS)
- [CVE-2012-4524](https://cve.now/CVE-2012-4524.md): xlockmore before 5.43 'dclock' security bypass vulnerability (no CVSS, xlockmore)
- [CVE-2019-16548](https://cve.now/CVE-2019-16548.md): A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could (no CVSS, Jenkins project Jenkins Google Compute Engine Plugin · org.…)
- [CVE-2019-16545](https://cve.now/CVE-2019-16545.md): Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms (no CVSS, Jenkins project Jenkins QMetry for JIRA - Test Management P…)
- [CVE-2019-16546](https://cve.now/CVE-2019-16546.md): Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling (no CVSS, Jenkins project Jenkins Google Compute Engine Plugin · org.…)
- [CVE-2019-16547](https://cve.now/CVE-2019-16547.md): Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Re (no CVSS, Jenkins project Jenkins Google Compute Engine Plugin · org.…)
- [CVE-2019-16543](https://cve.now/CVE-2019-16543.md): Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where (no CVSS, Jenkins project Jenkins Spira Importer Plugin · com.inflect…)
- [CVE-2019-16544](https://cve.now/CVE-2019-16544.md): Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins mast (no CVSS, Jenkins project Jenkins QMetry for JIRA - Test Management P…)
- [CVE-2019-16541](https://cve.now/CVE-2019-16541.md): Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to s (no CVSS, Jenkins project Jenkins JIRA Plugin · org.jenkins-ci.plugin…)
- [CVE-2019-16542](https://cve.now/CVE-2019-16542.md): Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins mast (no CVSS, Jenkins project Jenkins Anchore Container Image Scanner Plu…)
- [CVE-2019-16538](https://cve.now/CVE-2019-16538.md): A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions i (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2019-16539](https://cve.now/CVE-2019-16539.md): A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support b (no CVSS, Jenkins project Jenkins Support Core Plugin · org.jenkins-c…)
- [CVE-2019-16540](https://cve.now/CVE-2019-16540.md): A path traversal vulnerability in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete arbit (no CVSS, Jenkins project Jenkins Support Core Plugin · org.jenkins-c…)
- [CVE-2019-18958](https://cve.now/CVE-2019-18958.md): Nitro Pro before 13.2 creates a debug.log file in the directory where a .pdf file is located, if the .pdf document was produced by an OCR op (no CVSS)
- [CVE-2014-0084](https://cve.now/CVE-2014-0084.md): Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily (no CVSS, rubygem-openshift-origin-node · openshift-origin-node)
- [CVE-2012-3460](https://cve.now/CVE-2012-3460.md): cumin: At installation postgresql database user created without password (no CVSS, cumin)
- [CVE-2012-3543](https://cve.now/CVE-2012-3543.md): mono 2.10.x ASP.NET Web Form Hash collision DoS (no CVSS, mono)
- [CVE-2014-0083](https://cve.now/CVE-2014-0083.md): The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords. (no CVSS, ruby-net-ldap · net-ldap)
- [CVE-2012-2350](https://cve.now/CVE-2012-2350.md): pam\_shield before 0.9.4: Default configuration does not perform protective action (no CVSS, pam-shield)
- [CVE-2013-7172](https://cve.now/CVE-2013-7172.md): Slackware 13.1, 13.37, 14.0 and 14.1 contain world-writable permissions on the iodbctest and iodbctestw programs within the libiodbc package (no CVSS)
- [CVE-2012-2238](https://cve.now/CVE-2012-2238.md): trytond 2.4: ModelView.button fails to validate authorization (no CVSS, trytond)
- [CVE-2013-7171](https://cve.now/CVE-2013-7171.md): Slackware 14.0 and 14.1, and Slackware LLVM 3.0-i486-2 and 3.3-i486-2, contain world-writable permissions on the /tmp directory which could (no CVSS)
- [CVE-2019-19037](https://cve.now/CVE-2019-19037.md): ext4\_empty\_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4\_read\_dirblock(inode,0,DI (no CVSS)
- [CVE-2019-19036](https://cve.now/CVE-2019-19036.md): btrfs\_root\_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu\_dereference(root-\>node) (no CVSS)
- [CVE-2019-19039](https://cve.now/CVE-2019-19039.md): \_\_btrfs\_free\_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs\_print\_leaf in a certain ENOENT case, which allo (no CVSS)
- [CVE-2019-19221](https://cve.now/CVE-2019-19221.md): In Libarchive 3.4.0, archive\_wstring\_append\_from\_mbs in archive\_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-11-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.