# CVEs published 2019-11-22

57 CVEs were published on November 22, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-11287](https://cve.now/CVE-2019-11287.md): RabbitMQ Web Management Plugin DoS via heap overflow (CVSS 4.5, RabbitMQ for Pivotal Platform · Pivotal RabbitMQ)
- [CVE-2019-11291](https://cve.now/CVE-2019-11291.md): RabbitMQ XSS attack via federation and shovel endpoints (CVSS 3.1, Pivotal RabbitMQ · RabbitMQ for Pivotal Platform)
- [CVE-2019-15593](https://cve.now/CVE-2019-15593.md): GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service att (no CVSS, GitLab)
- [CVE-2019-16286](https://cve.now/CVE-2019-16286.md): An attacker may be able to bypass the OS application filter meant to restrict applications that can be executed by changing browser preferen (no CVSS, HP ThinPro Linux)
- [CVE-2019-16285](https://cve.now/CVE-2019-16285.md): If a local user has been configured and logged in, an unauthenticated attacker with physical access may be able to extract sensitive informa (no CVSS, HP ThinPro Linux)
- [CVE-2019-18909](https://cve.now/CVE-2019-18909.md): The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that (no CVSS, HP ThinPro Linux)
- [CVE-2019-16287](https://cve.now/CVE-2019-16287.md): In HP ThinPro Linux 6.2, 6.2.1, 7.0 and 7.1, an attacker may be able to leverage the application filter bypass vulnerability to gain privile (no CVSS, HP ThinPro Linux)
- [CVE-2019-18910](https://cve.now/CVE-2019-18910.md): The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker to inject commands th (no CVSS, HP ThinPro Linux)
- [CVE-2019-18622](https://cve.now/CVE-2019-18622.md): An issue was discovered in phpMyAdmin before 4.9.2. (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2019-13566](https://cve.now/CVE-2019-13566.md): An issue was discovered in the ROS communications-related packages (aka ros\_comm or ros-melodic-ros-comm) through 1.14.3. (no CVSS)
- [CVE-2019-3654](https://cve.now/CVE-2019-3654.md): Client Proxy (MCP) - Authentication Bypass vulnerability (CVSS 5.3, McAfee Client Proxy)
- [CVE-2012-6079](https://cve.now/CVE-2012-6079.md): W3 Total Cache before 0.9.2.5 exposes sensitive cached database information which allows remote attackers to download this information via t (no CVSS, W3 Total Cache)
- [CVE-2013-0203](https://cve.now/CVE-2013-0203.md): Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web sc (no CVSS, ownCloud Server)
- [CVE-2013-0202](https://cve.now/CVE-2013-0202.md): Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbitrary web script or HT (no CVSS, ownCloud)
- [CVE-2012-6078](https://cve.now/CVE-2012-6078.md): W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the hashes. (no CVSS, W3 Total Cache)
- [CVE-2013-6234](https://cve.now/CVE-2013-6234.md): Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrar (no CVSS)
- [CVE-2019-19240](https://cve.now/CVE-2019-19240.md): Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. (no CVSS)
- [CVE-2012-6077](https://cve.now/CVE-2012-6077.md): W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files. (no CVSS, W3 Total Cache)
- [CVE-2014-2214](https://cve.now/CVE-2014-2214.md): Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remote attackers to inject (no CVSS)
- [CVE-2014-2213](https://cve.now/CVE-2014-2213.md): Open redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows remote attackers to redirect users to arbit (no CVSS)
- [CVE-2019-16763](https://cve.now/CVE-2019-16763.md): XSS in Pannellum from 2.5.0 through 2.5.4 (CVSS 4.8, mpretroff pannellum · pannellum)
- [CVE-2014-1238](https://cve.now/CVE-2014-1238.md): Cross-site scripting (XSS) vulnerability in ui/common/managedlistdialog.aspx in Gael Q-Pulse 0.6 and earlier. (no CVSS)
- [CVE-2014-6311](https://cve.now/CVE-2014-6311.md): generate\_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated p (no CVSS)
- [CVE-2013-6878](https://cve.now/CVE-2013-6878.md): Cross-site scripting (XSS) vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remote attackers to injec (no CVSS)
- [CVE-2013-6879](https://cve.now/CVE-2013-6879.md): The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to com (no CVSS)
- [CVE-2013-6239](https://cve.now/CVE-2013-6239.md): Cross-site scripting (XSS) vulnerability in the photo gallery model in Exis Contexis before 2.0 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2014-6310](https://cve.now/CVE-2014-6310.md): Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' function. (no CVSS)
- [CVE-2013-6811](https://cve.now/CVE-2013-6811.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DSL-6740U gateway (Rev. (no CVSS)
- [CVE-2019-9536](https://cve.now/CVE-2019-9536.md): Apple iPhone 3GS bootrom malloc implementation returns a non-NULL pointer when unable to allocate memory, aka 'alloc8'. (CVSS 6.1, Apple iPhone)
- [CVE-2013-6880](https://cve.now/CVE-2013-6880.md): Open redirect in proxy.php in FlashCanvas before 1.6 allows remote attackers to redirect users to arbitrary web sites and conduct cross-site (no CVSS)
- [CVE-2019-17446](https://cve.now/CVE-2019-17446.md): An issue was discovered in Eracent EPA Agent through 10.2.26. (no CVSS)
- [CVE-2019-18610](https://cve.now/CVE-2019-18610.md): An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. (no CVSS)
- [CVE-2019-15652](https://cve.now/CVE-2019-15652.md): The web interface for NSSLGlobal SatLink VSAT Modem Unit (VMU) devices before 18.1.0 doesn't properly sanitize input for error messages, lea (no CVSS)
- [CVE-2019-17445](https://cve.now/CVE-2019-17445.md): An issue was discovered in Eracent EDA, EPA, EPM, EUA, FLW, and SUM Agent through 10.2.26. (no CVSS)
- [CVE-2019-18976](https://cve.now/CVE-2019-18976.md): An issue was discovered in res\_pjsip\_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. (no CVSS)
- [CVE-2019-18790](https://cve.now/CVE-2019-18790.md): An issue was discovered in channels/chan\_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Cert (no CVSS)
- [CVE-2012-0877](https://cve.now/CVE-2012-0877.md): PyXML: Hash table collisions CPU usage Denial of Service (no CVSS, PyXML)
- [CVE-2012-0812](https://cve.now/CVE-2012-0812.md): PostfixAdmin 2.3.4 has multiple XSS vulnerabilities (no CVSS, postfixadmin)
- [CVE-2019-19013](https://cve.now/CVE-2019-19013.md): A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request. (no CVSS, pagekit/pagekit)
- [CVE-2019-3428](https://cve.now/CVE-2019-3428.md): The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a configuration error vulnerability. (no CVSS, ZTE ZXCDN IAMWEB)
- [CVE-2019-3427](https://cve.now/CVE-2019-3427.md): The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a code injection vulnerability. (no CVSS, ZTE ZXCDN IAMWEB)
- [CVE-2019-4570](https://cve.now/CVE-2019-4570.md): IBM Tivoli Netcool Impact 7.1.0 through 7.1.0.16 generates an error message that includes sensitive information about its environment, users (CVSS 3.7, IBM Tivoli Netcool Impact)
- [CVE-2019-4569](https://cve.now/CVE-2019-4569.md): IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.16 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Tivoli Netcool Impact)
- [CVE-2019-4243](https://cve.now/CVE-2019-4243.md): IBM SmartCloud Analytics 1.3.1 through 1.3.5 allows unauthorized disclosure of information like accessing solrconfig.xml and could allow an (CVSS 5.1, IBM SmartCloud Analytics)
- [CVE-2019-4216](https://cve.now/CVE-2019-4216.md): IBM SmartCloud Analytics 1.3.1 through 1.3.5 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning (CVSS 4.6, IBM SmartCloud Analytics)
- [CVE-2019-4215](https://cve.now/CVE-2019-4215.md): IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 6.1, IBM SmartCloud Analytics)
- [CVE-2019-4214](https://cve.now/CVE-2019-4214.md): IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies. (CVSS 3.7, IBM SmartCloud Analytics)
- [CVE-2014-3585](https://cve.now/CVE-2014-3585.md): redhat-upgrade-tool: Does not check GPG signatures when upgrading versions (no CVSS, Red Hat redhat-upgrade-tool)
- [CVE-2012-3407](https://cve.now/CVE-2012-3407.md): plow has local buffer overflow vulnerability (no CVSS, plow)
- [CVE-2015-7810](https://cve.now/CVE-2015-7810.md): libbluray MountManager class has a time-of-check time-of-use (TOCTOU) race when expanding JAR files (no CVSS, libbluray)
- [CVE-2015-1780](https://cve.now/CVE-2015-1780.md): oVirt users with MANIPULATE\_STORAGE\_DOMAIN permissions can attach a storage domain to any data-center (no CVSS, oVirt)
- [CVE-2015-5694](https://cve.now/CVE-2015-5694.md): Designate does not enforce the DNS protocol limit concerning record set sizes (no CVSS, designate)
- [CVE-2019-19227](https://cve.now/CVE-2019-19227.md): In the AppleTalk subsystem in the Linux kernel before 5.1, there is a potential NULL pointer dereference because register\_snap\_client may re (no CVSS)
- [CVE-2019-10203](https://cve.now/CVE-2019-10203.md): PowerDNS Authoritative daemon , pdns versions 4.0.x before 4.0.9, 4.1.x before 4.1.11, exiting when encountering a serial between 2^31 and 2 (CVSS 4.3, Red Hat pdns)
- [CVE-2018-10854](https://cve.now/CVE-2018-10854.md): cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. (CVSS 6.5, Red Hat cloudforms)
- [CVE-2019-13157](https://cve.now/CVE-2019-13157.md): nsGreen.dll in Naver Vaccine 2.1.4 allows remote attackers to overwrite arbitary files via directory traversal sequences in a filename withi (no CVSS, Naver Vaccine)
- [CVE-2019-10206](https://cve.now/CVE-2019-10206.md): ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt pass (CVSS 6.4, Red Hat Ansible · ansible)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-11-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.