# CVEs published 2019-11-25

154 CVEs were published on November 25, 2019: 0 critical, 6 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2019-11290](https://cve.now/CVE-2019-11290.md): Cloud Foundry UAA logs query parameters in tomcat access file (CVSS 8.8, Cloud Foundry UAA Release)
- [CVE-2011-3596](https://cve.now/CVE-2011-3596.md): Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request. (no CVSS, polipo)
- [CVE-2011-3584](https://cve.now/CVE-2011-3584.md): The TYPO3 Core wec\_discussion extension before 2.1.1 is vulnerable to SQL Injection due to improper sanitation of user-supplied input. (no CVSS, TYPO3 Core wec\_discussion)
- [CVE-2019-18251](https://cve.now/CVE-2019-18251.md): In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. (no CVSS, Omron CX-Supervisor)
- [CVE-2019-18241](https://cve.now/CVE-2019-18241.md): In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server running (no CVSS, Philips IntelliBridge EC40 and EC80)
- [CVE-2011-3583](https://cve.now/CVE-2011-3583.md): It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could (no CVSS, TYPO3 Core · typo3/cms)
- [CVE-2019-15595](https://cve.now/CVE-2019-15595.md): A privilege escalation exists in UniFi Video Controller =\<3.10.6 that would allow an attacker on the local machine to run arbitrary commands (no CVSS, UniFi Video Server)
- [CVE-2019-18250](https://cve.now/CVE-2019-18250.md): In all versions of ABB Power Generation Information Manager (PGIM) and Plant Connect, the affected product is vulnerable to authentication b (no CVSS, ABB Power Generation Information Manager (PGIM) and Plant C…)
- [CVE-2011-3374](https://cve.now/CVE-2011-3374.md): It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-th (no CVSS, apt)
- [CVE-2011-3373](https://cve.now/CVE-2011-3373.md): Drupal Views Builk Operations (VBO) module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had (no CVSS, drupal6-views\_bulk\_operations)
- [CVE-2019-10771](https://cve.now/CVE-2019-10771.md): Characters in the GET url path are not properly escaped and can be reflected in the server response. (no CVSS, iobroker.web)
- [CVE-2011-3355](https://cve.now/CVE-2011-3355.md): evolution-data-server3 3.0.3 through 3.2.1 used insecure (non-SSL) connection when attempting to store sent email messages into the Sent fol (no CVSS, evolution-data-server3)
- [CVE-2019-17632](https://cve.now/CVE-2019-17632.md): In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response conte (no CVSS, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2011-3351](https://cve.now/CVE-2011-3351.md): openvas-scanner before 2011-09-11 creates a temporary file insecurely when generating OVAL system characteristics document with the ovaldi i (no CVSS, openvas-scanner)
- [CVE-2019-15629](https://cve.now/CVE-2019-15629.md): Trend Micro Password Manager versions 3.x, 5.0, and 5.1 for Android is affected by a FLAG\_MISUSE vulnerability that could be exploited to al (no CVSS, Trend Micro Password Manager for Android)
- [CVE-2019-5825](https://cve.now/CVE-2019-5825.md): Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption vi (CVSS 6.5, KEV, Google Chrome)
- [CVE-2019-5826](https://cve.now/CVE-2019-5826.md): Use after free in IndexedDB in Google Chrome prior to 73.0.3683.86 allowed a remote attacker who had compromised the renderer process to pot (no CVSS, Google Chrome)
- [CVE-2019-19244](https://cve.now/CVE-2019-19244.md): sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDE (no CVSS)
- [CVE-2019-16765](https://cve.now/CVE-2019-16765.md): If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension act (CVSS 7.4, github vscode-codeql)
- [CVE-2012-6639](https://cve.now/CVE-2012-6639.md): An privilege elevation vulnerability exists in Cloud-init before 0.7.0 when requests to an untrusted system are submitted for EC2 instance d (no CVSS, cloud-init)
- [CVE-2019-19252](https://cve.now/CVE-2019-19252.md): vcs\_write in drivers/tty/vt/vc\_screen.c in the Linux kernel through 5.3.13 does not prevent write access to vcsu devices, aka CID-0c9acb1af7 (no CVSS)
- [CVE-2019-16764](https://cve.now/CVE-2019-16764.md): PowAssent is susceptible to denial of service attacks (CVSS 6.5, pow-auth pow\_assent)
- [CVE-2011-4924](https://cve.now/CVE-2011-4924.md): Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and (no CVSS, zope2, zope3 · zope +1)
- [CVE-2019-4406](https://cve.now/CVE-2019-4406.md): IBM Spectrum Protect Backup-Archive Client 7.1 and 8.1 may be vulnerable to a denial of service attack due to a timing issue between client (CVSS 4.4, IBM Spectrum Protect Backup-Archive Client)
- [CVE-2018-2025](https://cve.now/CVE-2018-2025.md): IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments 7.1 and 8.1 creates directories/files in the CI (CVSS 5.1, IBM Spectrum Protect Backup-Archive Client · IBM Spectrum P…)
- [CVE-2019-19249](https://cve.now/CVE-2019-19249.md): Controllers/InvitationsController.cs in QueryTree before 3.0.99-beta mishandles invitations. (no CVSS)
- [CVE-2019-19250](https://cve.now/CVE-2019-19250.md): OpenTrade before 2019-11-23 allows SQL injection, related to server/modules/api/v1.js and server/utils.js. (no CVSS)
- [CVE-2019-18374](https://cve.now/CVE-2019-18374.md): Symantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypass vulnerability, wh (no CVSS, Symantec Critical System Protection)
- [CVE-2019-19246](https://cve.now/CVE-2019-19246.md): Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str\_lower\_case\_match in regexec.c. (no CVSS)
- [CVE-2019-15684](https://cve.now/CVE-2019-15684.md): Kaspersky Protection extension for web browser Google Chrome prior to 30.112.62.0 was vulnerable to unauthorized access to its features remo (no CVSS, Kaspersky Protection extension for Google Chrome)
- [CVE-2015-1396](https://cve.now/CVE-2015-1396.md): A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. (no CVSS)
- [CVE-2019-19242](https://cve.now/CVE-2019-19242.md): SQLite 3.30.1 mishandles pExpr-\>y.pTab, as demonstrated by the TK\_COLUMN case in sqlite3ExprCodeTarget in expr.c. (no CVSS)
- [CVE-2019-10217](https://cve.now/CVE-2019-10217.md): A flaw was found in ansible 2.8.0 before 2.8.4. (CVSS 5.7, Red Hat Ansible · ansible)
- [CVE-2019-17406](https://cve.now/CVE-2019-17406.md): Nokia IMPACT \< 18A has path traversal that may lead to RCE if chained with CVE-2019-1743 (no CVSS)
- [CVE-2019-17405](https://cve.now/CVE-2019-17405.md): Nokia IMPACT \< 18A: has Reflected self XSS (no CVSS)
- [CVE-2019-17404](https://cve.now/CVE-2019-17404.md): Nokia IMPACT \< 18A: allows full path disclosure (no CVSS)
- [CVE-2019-17403](https://cve.now/CVE-2019-17403.md): Nokia IMPACT \< 18A: An unrestricted File Upload vulnerability was found that may lead to Remote Code Execution. (no CVSS)
- [CVE-2012-5644](https://cve.now/CVE-2012-5644.md): libuser has information disclosure when moving user's home directory (no CVSS, libuser)
- [CVE-2019-5878](https://cve.now/CVE-2019-5878.md): Use after free in V8 in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted H (no CVSS, Google Chrome)
- [CVE-2019-5879](https://cve.now/CVE-2019-5879.md): Insufficient policy enforcement in extensions in Google Chrome prior to 77.0.3865.75 allowed an attacker who convinced a user to install a m (no CVSS, Google Chrome)
- [CVE-2019-5880](https://cve.now/CVE-2019-5880.md): Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a cr (no CVSS, Google Chrome)
- [CVE-2019-5881](https://cve.now/CVE-2019-5881.md): Out of bounds read in SwiftShader in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to obtain potentially sensitive informati (no CVSS, Google Chrome)
- [CVE-2019-5872](https://cve.now/CVE-2019-5872.md): Use after free in Mojo in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2019-5873](https://cve.now/CVE-2019-5873.md): Insufficient policy validation in navigation in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents o (no CVSS, Google Chrome)
- [CVE-2019-5874](https://cve.now/CVE-2019-5874.md): Insufficient filtering in URI schemes in Google Chrome on Windows prior to 77.0.3865.75 allowed a remote attacker to bypass navigation restr (no CVSS, Google Chrome)
- [CVE-2019-5875](https://cve.now/CVE-2019-5875.md): Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omni (no CVSS, Google Chrome)
- [CVE-2019-5876](https://cve.now/CVE-2019-5876.md): Use after free in media in Google Chrome on Android prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption v (no CVSS, Google Chrome)
- [CVE-2019-5877](https://cve.now/CVE-2019-5877.md): Out of bounds memory access in JavaScript in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corru (no CVSS, Google Chrome)
- [CVE-2019-5851](https://cve.now/CVE-2019-5851.md): Use after free in WebAudio in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2019-5852](https://cve.now/CVE-2019-5852.md): Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to obtain potentially sensitive (no CVSS, Google Chrome)
- [CVE-2019-5853](https://cve.now/CVE-2019-5853.md): Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corr (no CVSS, Google Chrome)
- [CVE-2019-5854](https://cve.now/CVE-2019-5854.md): Integer overflow in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2019-5855](https://cve.now/CVE-2019-5855.md): Integer overflow in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2019-5856](https://cve.now/CVE-2019-5856.md): Insufficient policy enforcement in storage in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer (no CVSS, Google Chrome)
- [CVE-2019-5857](https://cve.now/CVE-2019-5857.md): Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit object co (no CVSS, Google Chrome)
- [CVE-2019-5858](https://cve.now/CVE-2019-5858.md): Incorrect security UI in MacOS services integration in Google Chrome on OS X prior to 76.0.3809.87 allowed a local attacker to execute arbit (no CVSS, Google Chrome)
- [CVE-2019-5859](https://cve.now/CVE-2019-5859.md): Insufficient filtering in URI schemes in Google Chrome on Windows prior to 76.0.3809.87 allowed a remote attacker to bypass navigation restr (no CVSS, Google Chrome)
- [CVE-2019-5860](https://cve.now/CVE-2019-5860.md): Use after free in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2019-5861](https://cve.now/CVE-2019-5861.md): Insufficient data validation in Blink in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to bypass anti-clickjacking policy vi (no CVSS, Google Chrome)
- [CVE-2019-5862](https://cve.now/CVE-2019-5862.md): Insufficient data validation in AppCache in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer p (no CVSS, Google Chrome)
- [CVE-2019-5864](https://cve.now/CVE-2019-5864.md): Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious (no CVSS, Google Chrome)
- [CVE-2019-5865](https://cve.now/CVE-2019-5865.md): Insufficient policy enforcement in navigations in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the rend (no CVSS, Google Chrome)
- [CVE-2019-5866](https://cve.now/CVE-2019-5866.md): Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to potentially exploit heap corr (no CVSS, Google Chrome)
- [CVE-2019-5867](https://cve.now/CVE-2019-5867.md): Out of bounds read in JavaScript in Google Chrome prior to 76.0.3809.100 allowed a remote attacker to potentially exploit heap corruption vi (no CVSS, Google Chrome)
- [CVE-2019-5868](https://cve.now/CVE-2019-5868.md): Use after free in PDFium in Google Chrome prior to 76.0.3809.100 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2019-5869](https://cve.now/CVE-2019-5869.md): Use after free in Blink in Google Chrome prior to 76.0.3809.132 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2019-5870](https://cve.now/CVE-2019-5870.md): Use after free in media in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox escape via a craft (no CVSS, Google Chrome)
- [CVE-2019-5871](https://cve.now/CVE-2019-5871.md): Heap buffer overflow in Skia in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a c (no CVSS, Google Chrome)
- [CVE-2019-13705](https://cve.now/CVE-2019-13705.md): Insufficient policy enforcement in extensions in Google Chrome prior to 78.0.3904.70 allowed an attacker who convinced a user to install a m (no CVSS, Google Chrome)
- [CVE-2019-13706](https://cve.now/CVE-2019-13706.md): Out of bounds memory access in PDFium in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to potentially exploit heap corruptio (no CVSS, Google Chrome)
- [CVE-2019-13707](https://cve.now/CVE-2019-13707.md): Insufficient validation of untrusted input in intents in Google Chrome on Android prior to 78.0.3904.70 allowed a local attacker to leak fil (no CVSS, Google Chrome)
- [CVE-2019-13708](https://cve.now/CVE-2019-13708.md): Inappropriate implementation in navigation in Google Chrome on iOS prior to 78.0.3904.70 allowed a remote attacker to spoof the contents of (no CVSS, Google Chrome)
- [CVE-2019-13709](https://cve.now/CVE-2019-13709.md): Insufficient policy enforcement in downloads in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass download restriction (no CVSS, Google Chrome)
- [CVE-2019-13710](https://cve.now/CVE-2019-13710.md): Insufficient validation of untrusted input in downloads in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass download (no CVSS, Google Chrome)
- [CVE-2019-13711](https://cve.now/CVE-2019-13711.md): Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via (no CVSS, Google Chrome)
- [CVE-2019-13713](https://cve.now/CVE-2019-13713.md): Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via (no CVSS, Google Chrome)
- [CVE-2019-13714](https://cve.now/CVE-2019-13714.md): Insufficient validation of untrusted input in Color Enhancer extension in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to i (no CVSS, Google Chrome)
- [CVE-2019-13715](https://cve.now/CVE-2019-13715.md): Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to perform domain spo (no CVSS, Google Chrome)
- [CVE-2019-13716](https://cve.now/CVE-2019-13716.md): Insufficient policy enforcement in service workers in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass navigation res (no CVSS, Google Chrome)
- [CVE-2019-13717](https://cve.now/CVE-2019-13717.md): Incorrect security UI in full screen mode in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to hide security UI via a crafted (no CVSS, Google Chrome)
- [CVE-2019-13718](https://cve.now/CVE-2019-13718.md): Insufficient data validation in Omnibox in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to perform domain spoofing via IDN (no CVSS, Google Chrome)
- [CVE-2019-13719](https://cve.now/CVE-2019-13719.md): Incorrect security UI in full screen mode in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to hide security UI via a crafted (no CVSS, Google Chrome)
- [CVE-2019-13720](https://cve.now/CVE-2019-13720.md): Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, KEV, Google Chrome)
- [CVE-2019-13721](https://cve.now/CVE-2019-13721.md): Use after free in PDFium in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 8.8, Google Chrome)
- [CVE-2019-13723](https://cve.now/CVE-2019-13723.md): Use after free in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to (no CVSS, Google Chrome)
- [CVE-2019-13724](https://cve.now/CVE-2019-13724.md): Out of bounds memory access in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the render (no CVSS, Google Chrome)
- [CVE-2019-5842](https://cve.now/CVE-2019-5842.md): Use after free in Blink in Google Chrome prior to 75.0.3770.90 allowed a remote attacker to potentially exploit heap corruption via a crafte (no CVSS, Google Chrome)
- [CVE-2019-5847](https://cve.now/CVE-2019-5847.md): Inappropriate implementation in JavaScript in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to potentially exploit heap cor (no CVSS, Google Chrome)
- [CVE-2019-5848](https://cve.now/CVE-2019-5848.md): Incorrect font handling in autofill in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to obtain potentially sensitive inform (no CVSS, Google Chrome)
- [CVE-2019-5849](https://cve.now/CVE-2019-5849.md): Out of bounds read in Skia in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to obtain potentially sensitive information from (no CVSS, Google Chrome)
- [CVE-2019-5850](https://cve.now/CVE-2019-5850.md): Use after free in offline mode in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to (no CVSS, Google Chrome)
- [CVE-2019-13679](https://cve.now/CVE-2019-13679.md): Insufficient policy enforcement in PDFium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to show print dialogs via a craft (no CVSS, Google Chrome)
- [CVE-2019-13680](https://cve.now/CVE-2019-13680.md): Inappropriate implementation in TLS in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof client IP address to websites (no CVSS, Google Chrome)
- [CVE-2019-13681](https://cve.now/CVE-2019-13681.md): Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass download restrictions v (no CVSS, Google Chrome)
- [CVE-2019-13682](https://cve.now/CVE-2019-13682.md): Insufficient policy enforcement in external protocol handling in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass sam (no CVSS, Google Chrome)
- [CVE-2019-13683](https://cve.now/CVE-2019-13683.md): Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin dat (no CVSS, Google Chrome)
- [CVE-2019-13684](https://cve.now/CVE-2019-13684.md): Inappropriate implementation in JavaScript in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to leak cross-origin data via a (no CVSS, Google Chrome)
- [CVE-2019-13685](https://cve.now/CVE-2019-13685.md): Use after free in sharing view in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2019-13686](https://cve.now/CVE-2019-13686.md): Use after free in offline mode in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2019-13687](https://cve.now/CVE-2019-13687.md): Use after free in Blink in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafte (no CVSS, Google Chrome)
- [CVE-2019-13688](https://cve.now/CVE-2019-13688.md): Use after free in Blink in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafte (no CVSS, Google Chrome)
- [CVE-2019-13691](https://cve.now/CVE-2019-13691.md): Insufficient validation of untrusted input in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the conte (no CVSS, Google Chrome)
- [CVE-2019-13692](https://cve.now/CVE-2019-13692.md): Insufficient policy enforcement in reader mode in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via (no CVSS, Google Chrome)
- [CVE-2019-13693](https://cve.now/CVE-2019-13693.md): Use after free in IndexedDB in Google Chrome prior to 77.0.3865.120 allowed a remote attacker who had compromised the renderer process to ex (no CVSS, Google Chrome)
- [CVE-2019-13694](https://cve.now/CVE-2019-13694.md): Use after free in WebRTC in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2019-13695](https://cve.now/CVE-2019-13695.md): Use after free in audio in Google Chrome on Android prior to 77.0.3865.120 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2019-13696](https://cve.now/CVE-2019-13696.md): Use after free in JavaScript in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2019-13697](https://cve.now/CVE-2019-13697.md): Insufficient policy enforcement in performance APIs in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to leak cross-origin d (no CVSS, Google Chrome)
- [CVE-2019-13698](https://cve.now/CVE-2019-13698.md): Out of bounds memory access in JavaScript in Google Chrome prior to 73.0.3683.103 allowed a remote attacker to potentially exploit heap corr (no CVSS, Google Chrome)
- [CVE-2019-13699](https://cve.now/CVE-2019-13699.md): Use after free in media in Google Chrome prior to 78.0.3904.70 allowed a remote attacker who had compromised the renderer process to potenti (no CVSS, Google Chrome)
- [CVE-2019-13700](https://cve.now/CVE-2019-13700.md): Out of bounds memory access in the gamepad API in Google Chrome prior to 78.0.3904.70 allowed a remote attacker who had compromised the rend (no CVSS, Google Chrome)
- [CVE-2019-13701](https://cve.now/CVE-2019-13701.md): Incorrect implementation in navigation in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to spoof the contents of the Omnibox (no CVSS, Google Chrome)
- [CVE-2019-13702](https://cve.now/CVE-2019-13702.md): Inappropriate implementation in installer in Google Chrome on Windows prior to 78.0.3904.70 allowed a local attacker to perform privilege es (no CVSS, Google Chrome)
- [CVE-2019-13703](https://cve.now/CVE-2019-13703.md): Insufficient policy enforcement in the Omnibox in Google Chrome on Android prior to 78.0.3904.70 allowed a remote attacker to spoof the cont (no CVSS, Google Chrome)
- [CVE-2019-13704](https://cve.now/CVE-2019-13704.md): Insufficient policy enforcement in navigation in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass content security po (no CVSS, Google Chrome)
- [CVE-2019-13659](https://cve.now/CVE-2019-13659.md): IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a (no CVSS, Google Chrome)
- [CVE-2019-13660](https://cve.now/CVE-2019-13660.md): UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page. (no CVSS, Google Chrome)
- [CVE-2019-13661](https://cve.now/CVE-2019-13661.md): UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page. (no CVSS, Google Chrome)
- [CVE-2019-13662](https://cve.now/CVE-2019-13662.md): Insufficient policy enforcement in navigations in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security p (no CVSS, Google Chrome)
- [CVE-2019-13663](https://cve.now/CVE-2019-13663.md): IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a (no CVSS, Google Chrome)
- [CVE-2019-13664](https://cve.now/CVE-2019-13664.md): Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy (no CVSS, Google Chrome)
- [CVE-2019-13665](https://cve.now/CVE-2019-13665.md): Insufficient filtering in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass multiple file download protection (no CVSS, Google Chrome)
- [CVE-2019-13666](https://cve.now/CVE-2019-13666.md): Information leak in storage in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML pa (no CVSS, Google Chrome)
- [CVE-2019-13667](https://cve.now/CVE-2019-13667.md): Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the (no CVSS, Google Chrome)
- [CVE-2019-13668](https://cve.now/CVE-2019-13668.md): Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin dat (no CVSS, Google Chrome)
- [CVE-2019-13669](https://cve.now/CVE-2019-13669.md): Incorrect data validation in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibo (no CVSS, Google Chrome)
- [CVE-2019-13670](https://cve.now/CVE-2019-13670.md): Insufficient data validation in JavaScript in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corr (no CVSS, Google Chrome)
- [CVE-2019-13671](https://cve.now/CVE-2019-13671.md): UI spoofing in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof security UI via a crafted HTML page. (no CVSS, Google Chrome)
- [CVE-2019-13673](https://cve.now/CVE-2019-13673.md): Insufficient data validation in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data v (no CVSS, Google Chrome)
- [CVE-2019-13674](https://cve.now/CVE-2019-13674.md): IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a (no CVSS, Google Chrome)
- [CVE-2019-13675](https://cve.now/CVE-2019-13675.md): Insufficient data validation in extensions in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to disable extensions via a craf (no CVSS, Google Chrome)
- [CVE-2019-13676](https://cve.now/CVE-2019-13676.md): Insufficient policy enforcement in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via (no CVSS, Google Chrome)
- [CVE-2019-13677](https://cve.now/CVE-2019-13677.md): Insufficient policy enforcement in site isolation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation (no CVSS, Google Chrome)
- [CVE-2019-13678](https://cve.now/CVE-2019-13678.md): Incorrect data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via a cra (no CVSS, Google Chrome)
- [CVE-2019-10213](https://cve.now/CVE-2019-10213.md): OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator (CVSS 5.3, Red Hat openshift)
- [CVE-2012-5640](https://cve.now/CVE-2012-5640.md): thttpd has a local DoS vulnerability via specially-crafted .htpasswd files (no CVSS, thttpd)
- [CVE-2012-5631](https://cve.now/CVE-2012-5631.md): ipa 3.0 does not properly check server identity before sending credential containing cookies (no CVSS, ipa)
- [CVE-2012-5630](https://cve.now/CVE-2012-5630.md): libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees. (no CVSS, libuser)
- [CVE-2019-10207](https://cve.now/CVE-2019-10207.md): A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and kernel 5.x.x. (CVSS 4.7, Red Hat kernel)
- [CVE-2019-18675](https://cve.now/CVE-2019-18675.md): The Linux kernel through 5.3.13 has a start\_offset+size Integer Overflow in cpia2\_remap\_buffer in drivers/media/usb/cpia2/cpia2\_core.c becau (no CVSS)
- [CVE-2012-5617](https://cve.now/CVE-2012-5617.md): gksu-polkit: permissive PolicyKit policy configuration file allows privilege escalation (no CVSS, gksu-polkit)
- [CVE-2012-5582](https://cve.now/CVE-2012-5582.md): opendnssec misuses libcurl API (no CVSS, opendnssec)
- [CVE-2012-5527](https://cve.now/CVE-2012-5527.md): Claws Mail vCalendar plugin: credentials exposed on interface (no CVSS, Claws Mail vCalendar plugin)
- [CVE-2012-5521](https://cve.now/CVE-2012-5521.md): quagga (ospf6d) 0.99.21 has a DoS flaw in the way the ospf6d daemon performs routes removal (no CVSS, quagga)
- [CVE-2012-5535](https://cve.now/CVE-2012-5535.md): gnome-system-log polkit policy allows arbitrary files on the system to be read (no CVSS, gnome-system-log)
- [CVE-2012-5518](https://cve.now/CVE-2012-5518.md): vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from anyone who has a matching key (and certificat (no CVSS, vdsm)
- [CVE-2012-5578](https://cve.now/CVE-2012-5578.md): Python keyring has insecure permissions on new databases allowing world-readable files to be created (no CVSS, Python keyring · keyring)
- [CVE-2019-14822](https://cve.now/CVE-2019-14822.md): A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus o (no CVSS, ibus)
- [CVE-2019-14815](https://cve.now/CVE-2019-14815.md): A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex\_set\_wmm\_params() function of Marvell Wifi Driver. (CVSS 7.8, Linux kernel)
- [CVE-2019-10214](https://cve.now/CVE-2019-10214.md): The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in Open (CVSS 6.4, containers/image · github.com/containers/image)
- [CVE-2019-14891](https://cve.now/CVE-2019-14891.md): A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. (CVSS 5.0, cri-o)
- [CVE-2019-10174](https://cve.now/CVE-2019-10174.md): A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application cl (CVSS 7.5, \[UNKNOWN\] infinispan · org.infinispan:infinispan-core)
- [CVE-2019-10224](https://cve.now/CVE-2019-10224.md): A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. (CVSS 4.3, Red Hat 389-ds-base)
- [CVE-2019-14825](https://cve.now/CVE-2019-14825.md): A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. (CVSS 4.1, Red Hat katello · katello)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-11-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.