CVEs published November 22, 2019
57 CVEs were published on November 22, 2019: 0 critical, 0 high.
- Published
- 57
- Critical
- 0
- High
- 0
- Medium
- 11
- Low
- 3
- Unrated
- 43
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- HP ThinPro Linux
- 5
- IBM SmartCloud Analytics
- 4
- W3 Total Cache
- 3
- IBM Tivoli Netcool Impact
- 2
- ZTE ZXCDN IAMWEB
- 2
- Apple iPhone
- 1
- designate
- 1
- GitLab
- 1
- libbluray
- 1
- McAfee Client Proxy
- 1
Medium, low and unrated 57
- CVE-2019-11287RabbitMQ Web Management Plugin DoS via heap overflowRabbitMQ for Pivotal Platform · Pivotal RabbitMQ
- CVE-2019-11291RabbitMQ XSS attack via federation and shovel endpointsPivotal RabbitMQ · RabbitMQ for Pivotal Platform
- CVE-2019-15593GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attGitLab
- CVE-2019-16286An attacker may be able to bypass the OS application filter meant to restrict applications that can be executed by changing browser preferenHP ThinPro Linux
- CVE-2019-16285If a local user has been configured and logged in, an unauthenticated attacker with physical access may be able to extract sensitive informaHP ThinPro Linux
- CVE-2019-18909The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands thatHP ThinPro Linux
- CVE-2019-16287In HP ThinPro Linux 6.2, 6.2.1, 7.0 and 7.1, an attacker may be able to leverage the application filter bypass vulnerability to gain privileHP ThinPro Linux
- CVE-2019-18910The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker to inject commands thHP ThinPro Linux
- CVE-2019-18622An issue was discovered in phpMyAdmin before 4.9.2.phpmyadmin/phpmyadmin
- CVE-2019-13566An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3.
- CVE-2019-3654Client Proxy (MCP) - Authentication Bypass vulnerabilityMcAfee Client Proxy
- CVE-2012-6079W3 Total Cache before 0.9.2.5 exposes sensitive cached database information which allows remote attackers to download this information via tW3 Total Cache
- CVE-2013-0203Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web scownCloud Server
- CVE-2013-0202Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbitrary web script or HTownCloud
- CVE-2012-6078W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the hashes.W3 Total Cache
- CVE-2013-6234Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrar
- CVE-2019-19240Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header.
- CVE-2012-6077W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files.W3 Total Cache
- CVE-2014-2214Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remote attackers to inject
- CVE-2014-2213Open redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows remote attackers to redirect users to arbit
- CVE-2019-16763XSS in Pannellum from 2.5.0 through 2.5.4mpretroff pannellum · pannellum
- CVE-2014-1238Cross-site scripting (XSS) vulnerability in ui/common/managedlistdialog.aspx in Gael Q-Pulse 0.6 and earlier.
- CVE-2014-6311generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated p
- CVE-2013-6878Cross-site scripting (XSS) vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remote attackers to injec
- CVE-2013-6879The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to com
- CVE-2013-6239Cross-site scripting (XSS) vulnerability in the photo gallery model in Exis Contexis before 2.0 allows remote attackers to inject arbitrary
- CVE-2014-6310Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' function.
- CVE-2013-6811Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DSL-6740U gateway (Rev.
- CVE-2019-9536Apple iPhone 3GS bootrom malloc implementation returns a non-NULL pointer when unable to allocate memory, aka 'alloc8'.Apple iPhone
- CVE-2013-6880Open redirect in proxy.php in FlashCanvas before 1.6 allows remote attackers to redirect users to arbitrary web sites and conduct cross-site
- CVE-2019-17446An issue was discovered in Eracent EPA Agent through 10.2.26.
- CVE-2019-18610An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4.
- CVE-2019-15652The web interface for NSSLGlobal SatLink VSAT Modem Unit (VMU) devices before 18.1.0 doesn't properly sanitize input for error messages, lea
- CVE-2019-17445An issue was discovered in Eracent EDA, EPA, EPM, EUA, FLW, and SUM Agent through 10.2.26.
- CVE-2019-18976An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x.
- CVE-2019-18790An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Cert
- CVE-2012-0877PyXML: Hash table collisions CPU usage Denial of ServicePyXML
- CVE-2012-0812PostfixAdmin 2.3.4 has multiple XSS vulnerabilitiespostfixadmin
- CVE-2019-19013A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request.pagekit/pagekit
- CVE-2019-3428The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a configuration error vulnerability.ZTE ZXCDN IAMWEB
- CVE-2019-3427The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a code injection vulnerability.ZTE ZXCDN IAMWEB
- CVE-2019-4570IBM Tivoli Netcool Impact 7.1.0 through 7.1.0.16 generates an error message that includes sensitive information about its environment, usersIBM Tivoli Netcool Impact
- CVE-2019-4569IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.16 is vulnerable to cross-site scripting.IBM Tivoli Netcool Impact
- CVE-2019-4243IBM SmartCloud Analytics 1.3.1 through 1.3.5 allows unauthorized disclosure of information like accessing solrconfig.xml and could allow an IBM SmartCloud Analytics
- CVE-2019-4216IBM SmartCloud Analytics 1.3.1 through 1.3.5 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning IBM SmartCloud Analytics
- CVE-2019-4215IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to hijack the clicking action of the victim.IBM SmartCloud Analytics
- CVE-2019-4214IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies.IBM SmartCloud Analytics
- CVE-2014-3585redhat-upgrade-tool: Does not check GPG signatures when upgrading versionsRed Hat redhat-upgrade-tool
- CVE-2012-3407plow has local buffer overflow vulnerabilityplow
- CVE-2015-7810libbluray MountManager class has a time-of-check time-of-use (TOCTOU) race when expanding JAR fileslibbluray
- CVE-2015-1780oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-centeroVirt
- CVE-2015-5694Designate does not enforce the DNS protocol limit concerning record set sizesdesignate
- CVE-2019-19227In the AppleTalk subsystem in the Linux kernel before 5.1, there is a potential NULL pointer dereference because register_snap_client may re
- CVE-2019-10203PowerDNS Authoritative daemon , pdns versions 4.0.x before 4.0.9, 4.1.x before 4.1.11, exiting when encountering a serial between 2^31 and 2Red Hat pdns
- CVE-2018-10854cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting.Red Hat cloudforms
- CVE-2019-13157nsGreen.dll in Naver Vaccine 2.1.4 allows remote attackers to overwrite arbitary files via directory traversal sequences in a filename withiNaver Vaccine
- CVE-2019-10206ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passRed Hat Ansible · ansible