CVEs published November 26, 2019
120 CVEs were published on November 26, 2019: 1 critical, 10 high. 1 is now in CISA KEV.
- Published
- 120
- Critical
- 1
- High
- 10
- Medium
- 20
- Low
- 1
- Unrated
- 88
- Now in CISA KEV
- 1
- Fix available
- 5
Most affected products
- Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersk…
- 4
- Cisco DNA Spaces
- 3
- hardlink
- 3
- Cisco Email Security Appliance
- 2
- Cisco Small Business RV Series Router Firmware
- 2
- Cisco TelePresence TC Software
- 2
- Cisco WebEx WRF Player
- 2
- JBoss Application Server
- 2
- typed-ast
- 2
- [UNKNOWN] ansible · ansible
- 1
Critical 1
High 10
- CVE-2019-6477TCP-pipelined queries can bypass tcp-clients limitISC BIND9
- CVE-2019-14842Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks.[UNKNOWN] libnbd
- CVE-2019-14890A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credenti[UNKNOWN] Tower
- CVE-2019-15271Cisco Small Business RV016, RV042, RV042G, and RV082 Routers Arbitrary Command Execution VulnerabilityCisco Small Business RV Series Router Firmware
- CVE-2019-15276Cisco Wireless LAN Controller HTTP Parsing Engine Denial of Service VulnerabilityCisco Wireless LAN Controller
- CVE-2019-15284Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesCisco WebEx WRF Player
- CVE-2019-15286Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesCisco WebEx WRF Player
- CVE-2019-15288Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Privilege Escalation VulnerabilityCisco TelePresence TC Software
- CVE-2019-15956Cisco Web Security Appliance Unauthorized Device Reset VulnerabilityCisco Web Security Appliance
- CVE-2019-15958Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution VulnerabilityCisco Prime Infrastructure
Medium, low and unrated 109
- CVE-2011-4310The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles.The CMS Made Simple Foundation CMSMS
- CVE-2011-1939SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conzendframework;PHP zendframework · zendframework;PHP PHP
- CVE-2011-1934lilo-uuid-diskid causes lilo.conf to be world-readable in lilo 23.1.lilo
- CVE-2011-1933SQL injection vulnerability in Jifty::DBI before 0.68.libjifty-dbi-perl
- CVE-2019-17590The csrf_callback function in the CSRF Magic library through 2016-03-27 is vulnerable to CSRF protection bypass as it allows one to tamper w
- CVE-2019-17392Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled.
- CVE-2019-16388PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyStream=MyAlerts request to get A
- CVE-2019-16387PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/random_token/!STANDARD?pyActivity=Data-Admin-DB-Name.DBSchema_ListDatabases request
- CVE-2019-16386PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyActivity=GetWebInfo&target
- CVE-2019-16195Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields.
- CVE-2019-18446An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4.
- CVE-2019-18447An issue was discovered in GitLab Community and Enterprise Edition before 12.4.
- CVE-2019-18448An issue was discovered in GitLab Community and Enterprise Edition before 12.4.
- CVE-2019-18449An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the autocomplete feature.
- CVE-2019-15845Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.
- CVE-2019-18450An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the Project labels feature.
- CVE-2019-18451An issue was discovered in GitLab Community and Enterprise Edition 10.7.4 through 12.4 in the InternalRedirect filtering feature.
- CVE-2019-12526An issue was discovered in Squid before 4.9.
- CVE-2019-18452An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4 when moving an issue to a public project from a private
- CVE-2019-12523An issue was discovered in Squid before 4.9.
- CVE-2019-18453An issue was discovered in GitLab Community and Enterprise Edition 11.6 through 12.4 in the add comments via email feature.
- CVE-2019-14449An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1.
- CVE-2019-18454An issue was discovered in GitLab Community and Enterprise Edition 10.5 through 12.4 in link validation for RDoc wiki pages feature.
- CVE-2019-18455An issue was discovered in GitLab Community and Enterprise Edition 11 through 12.4 when building Nested GraphQL queries.
- CVE-2019-18676An issue was discovered in Squid 3.x and 4.x through 4.8.
- CVE-2019-18677An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not prop
- CVE-2019-18678An issue was discovered in Squid 3.x and 4.x through 4.8.
- CVE-2019-18679An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8.
- CVE-2019-18456An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integra
- CVE-2019-4387IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.2.0 is vulnerable to SQL injection.IBM Sterling B2B Integrator
- CVE-2019-15687Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, KasKaspersky Anti-Virus, Kaspersky Internet Security, Kaspersk…
- CVE-2019-15686Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, KasKaspersky Anti-Virus, Kaspersky Internet Security, Kaspersk…
- CVE-2019-15685Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, KasKaspersky Anti-Virus, Kaspersky Internet Security, Kaspersk…
- CVE-2019-18457An issue was discovered in GitLab Community and Enterprise Edition 11.8 through 12.4 when handling Security tokens..
- CVE-2019-18458An issue was discovered in GitLab Community and Enterprise Edition through 12.4.
- CVE-2019-16241On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, PIN authentication can be bypassed by creating a special file within the /data/local/tmp/ di
- CVE-2019-15688Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, KasKaspersky Anti-Virus, Kaspersky Internet Security, Kaspersk…
- CVE-2016-9271Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature.
- CVE-2019-16243On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an undocumented web API that allows unprivileged JavaScript, including JavaScript r
- CVE-2019-16242On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an engineering application named omamock that is vulnerable to OS command injection
- CVE-2017-7399Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the u
- CVE-2019-19129Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name.
- CVE-2019-18459An issue was discovered in GitLab Community and Enterprise Edition 11.3 to 12.3 in the protected environments feature.
- CVE-2019-7319An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0.
- CVE-2018-20090An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2.
- CVE-2019-19307An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possib
- CVE-2015-9537The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thum
- CVE-2015-9538The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.
- CVE-2015-9539The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fs_contact_form1[welcome] XSS.
- CVE-2019-19306The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName.
- CVE-2019-6675BIG-IP configurations using Active Directory, LDAP, or Client Certificate LDAP for management authentication with multiple servers are exposBIG-IP
- CVE-2019-18460An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elastics
- CVE-2019-18461An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.3 when a sub group epic is added to a public group.
- CVE-2019-18462An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4.
- CVE-2019-12489An issue was discovered on Fastweb Askey RTV1907VW 0.00.81_FW_200_Askey 2018-10-02 18:08:18 devices.
- CVE-2019-18463An issue was discovered in GitLab Community and Enterprise Edition through 12.4.
- CVE-2019-19206Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture.dolibarr/dolibarr
- CVE-2018-17860Cloudera CDH has Insecure Permissions because ALL cannot be revoked.This affects 5.x through 5.15.1 and 6.x through 6.0.1.
- CVE-2019-19274typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read.typed-ast
- CVE-2019-19275typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read.typed-ast
- CVE-2015-4457Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbit
- CVE-2015-6495There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles.
- CVE-2015-7831In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used.
- CVE-2016-3131Cloudera CDH before 5.6.1 allows authorization bypass via direct internal API calls.
- CVE-2016-3192Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files.
- CVE-2016-4572In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges.
- CVE-2016-5724Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles.
- CVE-2016-6353Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass Sentry document-level
- CVE-2019-14856ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None[UNKNOWN] ansible · ansible
- CVE-2019-14853An error-handling flaw was found in python-ecdsa before version 0.13.3.[UNKNOWN] python-ecdsa · ecdsa
- CVE-2019-14857A flaw was found in mod_auth_openidc before version 2.4.0.1.[UNKNOWN] mod_auth_openidc
- CVE-2011-4350Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed.yaws
- CVE-2011-4121The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used foOpenSSL extension of Ruby
- CVE-2011-4120Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was cyubico-pam
- CVE-2011-4090Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation.serendipity
- CVE-2011-4082A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the "Accept-Language" HTTP headerphpldapadmin
- CVE-2011-4076OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivanova
- CVE-2019-15968Cisco Unified Communications Domain Manager Persistent Cross-Site Scripting VulnerabilityCisco Unified Communications Domain Manager
- CVE-2019-15971Cisco Email Security Appliance MP3 Content Filter Bypass VulnerabilityCisco Email Security Appliance
- CVE-2019-15972Cisco Unified Communications Manager SQL Injection VulnerabilityCisco Unified Communications Manager
- CVE-2019-15986Cisco Unity Express Command Injection VulnerabilityCisco Unity Express
- CVE-2019-15987Cisco WebEx Centers Username Enumeration Information Disclosure VulnerabilityCisco WebEx Event Center
- CVE-2019-15988Cisco Email Security Appliance URL Filtering Bypass VulnerabilityCisco Email Security Appliance
- CVE-2019-15990Cisco Small Business Routers RV016, RV042, RV042G, and RV082 Information Disclosure VulnerabilityCisco Small Business RV Series Router Firmware
- CVE-2019-15994Cisco Stealthwatch Enterprise Cross-Site Scripting VulnerabilityCisco Stealthwatch Enterprise
- CVE-2019-15995Cisco DNA Spaces: Connector SQL Injection VulnerabilityCisco DNA Spaces
- CVE-2019-15996Cisco DNA Spaces: Connector Privilege Escalation VulnerabilityCisco DNA Spaces
- CVE-2019-15997Cisco DNA Spaces: Connector Command Injection VulnerabilityCisco DNA Spaces
- CVE-2019-15998Cisco IOS XR Software NETCONF Over Secure Shell ACL Bypass VulnerabilityCisco IOS XR Software
- CVE-2019-16001Cisco Webex Teams for Windows DLL Hijacking VulnerabilityCisco Webex Teams
- CVE-2019-16002Cisco SD-WAN Solution vManage Cross-Site Request Forgery VulnerabilityCisco vManage Software
- CVE-2011-3632Hardlink before 0.1.2 operates on full file system objects path names which can allow a local attacker to use this flaw to conduct symlink ahardlink
- CVE-2019-19269An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b.
- CVE-2019-19270An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b.
- CVE-2019-19271An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6.
- CVE-2019-19272An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6.
- CVE-2011-3631Hardlink before 0.1.2 has multiple integer overflows leading to heap-based buffer overflows because of the way string lengths concatenation hardlink
- CVE-2019-15960Cisco Webex Network Recording Admin Page Privilege Escalation VulnerabilityCisco Webex Meetings
- CVE-2019-15967Cisco TelePresence Collaboration Endpoint and RoomOS Audio Eavesdropping VulnerabilityCisco TelePresence TC Software
- CVE-2019-15973Cisco Industrial Network Director Reflected Cross-Site Scripting VulnerabilityCisco Industrial Network Director
- CVE-2011-3630Hardlink before 0.1.2 suffer from multiple stack-based buffer overflow flaws because of the way directory trees with deeply nested directorihardlink
- CVE-2011-3624Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-ForwRuby
- CVE-2011-3617Tahoe-LAFS v1.3.0 through v1.8.2 could allow unauthorized users to delete immutable files in some cases.Tahoe-LAFS
- CVE-2011-3609A CSRF issue was found in JBoss Application Server 7 before 7.1.0.JBoss Application Server
- CVE-2011-3606A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console.JBoss Application Server
- CVE-2011-3600The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarationsOFBiz
- CVE-2019-16201WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service
- CVE-2019-16254Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting.
- CVE-2019-16255Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to