# CVEs published 2019-11-26

120 CVEs were published on November 26, 2019: 1 critical, 10 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2011-4310](https://cve.now/CVE-2011-4310.md): The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles. (no CVSS, The CMS Made Simple Foundation CMSMS)
- [CVE-2011-1939](https://cve.now/CVE-2011-1939.md): SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in con (no CVSS, zendframework;PHP zendframework · zendframework;PHP PHP)
- [CVE-2011-1934](https://cve.now/CVE-2011-1934.md): lilo-uuid-diskid causes lilo.conf to be world-readable in lilo 23.1. (no CVSS, lilo)
- [CVE-2011-1933](https://cve.now/CVE-2011-1933.md): SQL injection vulnerability in Jifty::DBI before 0.68. (no CVSS, libjifty-dbi-perl)
- [CVE-2019-17590](https://cve.now/CVE-2019-17590.md): The csrf\_callback function in the CSRF Magic library through 2016-03-27 is vulnerable to CSRF protection bypass as it allows one to tamper w (no CVSS)
- [CVE-2019-17392](https://cve.now/CVE-2019-17392.md): Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled. (no CVSS)
- [CVE-2019-16388](https://cve.now/CVE-2019-16388.md): PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random\_token/!STANDARD?pyStream=MyAlerts request to get A (no CVSS)
- [CVE-2019-16387](https://cve.now/CVE-2019-16387.md): PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/random\_token/!STANDARD?pyActivity=Data-Admin-DB-Name.DBSchema\_ListDatabases request (no CVSS)
- [CVE-2019-16386](https://cve.now/CVE-2019-16386.md): PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random\_token/!STANDARD?pyActivity=GetWebInfo&target (no CVSS)
- [CVE-2019-16195](https://cve.now/CVE-2019-16195.md): Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields. (no CVSS)
- [CVE-2019-18446](https://cve.now/CVE-2019-18446.md): An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4. (no CVSS)
- [CVE-2019-18447](https://cve.now/CVE-2019-18447.md): An issue was discovered in GitLab Community and Enterprise Edition before 12.4. (no CVSS)
- [CVE-2019-18448](https://cve.now/CVE-2019-18448.md): An issue was discovered in GitLab Community and Enterprise Edition before 12.4. (no CVSS)
- [CVE-2019-18449](https://cve.now/CVE-2019-18449.md): An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the autocomplete feature. (no CVSS)
- [CVE-2019-15845](https://cve.now/CVE-2019-15845.md): Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions. (no CVSS)
- [CVE-2019-18450](https://cve.now/CVE-2019-18450.md): An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the Project labels feature. (no CVSS)
- [CVE-2019-18451](https://cve.now/CVE-2019-18451.md): An issue was discovered in GitLab Community and Enterprise Edition 10.7.4 through 12.4 in the InternalRedirect filtering feature. (no CVSS)
- [CVE-2019-12526](https://cve.now/CVE-2019-12526.md): An issue was discovered in Squid before 4.9. (no CVSS)
- [CVE-2019-18452](https://cve.now/CVE-2019-18452.md): An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4 when moving an issue to a public project from a private (no CVSS)
- [CVE-2019-12523](https://cve.now/CVE-2019-12523.md): An issue was discovered in Squid before 4.9. (no CVSS)
- [CVE-2019-18580](https://cve.now/CVE-2019-18580.md): Dell EMC Storage Monitoring and Reporting version 4.3.1 contains a Java RMI Deserialization of Untrusted Data vulnerability. (CVSS 9.8, Dell EMC Storage M&R)
- [CVE-2019-18453](https://cve.now/CVE-2019-18453.md): An issue was discovered in GitLab Community and Enterprise Edition 11.6 through 12.4 in the add comments via email feature. (no CVSS)
- [CVE-2019-14449](https://cve.now/CVE-2019-14449.md): An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1. (no CVSS)
- [CVE-2019-18454](https://cve.now/CVE-2019-18454.md): An issue was discovered in GitLab Community and Enterprise Edition 10.5 through 12.4 in link validation for RDoc wiki pages feature. (no CVSS)
- [CVE-2019-18455](https://cve.now/CVE-2019-18455.md): An issue was discovered in GitLab Community and Enterprise Edition 11 through 12.4 when building Nested GraphQL queries. (no CVSS)
- [CVE-2019-18676](https://cve.now/CVE-2019-18676.md): An issue was discovered in Squid 3.x and 4.x through 4.8. (no CVSS)
- [CVE-2019-18677](https://cve.now/CVE-2019-18677.md): An issue was discovered in Squid 3.x and 4.x through 4.8 when the append\_domain setting is used (because the appended characters do not prop (no CVSS)
- [CVE-2019-18678](https://cve.now/CVE-2019-18678.md): An issue was discovered in Squid 3.x and 4.x through 4.8. (no CVSS)
- [CVE-2019-18679](https://cve.now/CVE-2019-18679.md): An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. (no CVSS)
- [CVE-2019-6477](https://cve.now/CVE-2019-6477.md): TCP-pipelined queries can bypass tcp-clients limit (CVSS 7.5, ISC BIND9)
- [CVE-2019-18456](https://cve.now/CVE-2019-18456.md): An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integra (no CVSS)
- [CVE-2019-4387](https://cve.now/CVE-2019-4387.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.2.0 is vulnerable to SQL injection. (CVSS 6.3, IBM Sterling B2B Integrator)
- [CVE-2019-15687](https://cve.now/CVE-2019-15687.md): Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kas (no CVSS, Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersk…)
- [CVE-2019-15686](https://cve.now/CVE-2019-15686.md): Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kas (no CVSS, Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersk…)
- [CVE-2019-15685](https://cve.now/CVE-2019-15685.md): Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kas (no CVSS, Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersk…)
- [CVE-2019-18457](https://cve.now/CVE-2019-18457.md): An issue was discovered in GitLab Community and Enterprise Edition 11.8 through 12.4 when handling Security tokens.. (no CVSS)
- [CVE-2019-18458](https://cve.now/CVE-2019-18458.md): An issue was discovered in GitLab Community and Enterprise Edition through 12.4. (no CVSS)
- [CVE-2019-16241](https://cve.now/CVE-2019-16241.md): On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, PIN authentication can be bypassed by creating a special file within the /data/local/tmp/ di (no CVSS)
- [CVE-2019-15688](https://cve.now/CVE-2019-15688.md): Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kas (no CVSS, Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersk…)
- [CVE-2016-9271](https://cve.now/CVE-2016-9271.md): Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature. (no CVSS)
- [CVE-2019-16243](https://cve.now/CVE-2019-16243.md): On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an undocumented web API that allows unprivileged JavaScript, including JavaScript r (no CVSS)
- [CVE-2019-16242](https://cve.now/CVE-2019-16242.md): On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an engineering application named omamock that is vulnerable to OS command injection (no CVSS)
- [CVE-2017-7399](https://cve.now/CVE-2017-7399.md): Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the u (no CVSS)
- [CVE-2019-19129](https://cve.now/CVE-2019-19129.md): Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name. (no CVSS)
- [CVE-2019-18459](https://cve.now/CVE-2019-18459.md): An issue was discovered in GitLab Community and Enterprise Edition 11.3 to 12.3 in the protected environments feature. (no CVSS)
- [CVE-2019-7319](https://cve.now/CVE-2019-7319.md): An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0. (no CVSS)
- [CVE-2018-20090](https://cve.now/CVE-2018-20090.md): An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. (no CVSS)
- [CVE-2019-19307](https://cve.now/CVE-2019-19307.md): An integer overflow in parse\_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possib (no CVSS)
- [CVE-2019-14842](https://cve.now/CVE-2019-14842.md): Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks. (CVSS 7.3, \[UNKNOWN\] libnbd)
- [CVE-2015-9537](https://cve.now/CVE-2015-9537.md): The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail\_width, thumbnail\_height, thumbwidth, thum (no CVSS)
- [CVE-2015-9538](https://cve.now/CVE-2015-9538.md): The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection. (no CVSS)
- [CVE-2015-9539](https://cve.now/CVE-2015-9539.md): The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fs\_contact\_form1\[welcome\] XSS. (no CVSS)
- [CVE-2019-19306](https://cve.now/CVE-2019-19306.md): The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName. (no CVSS)
- [CVE-2019-6675](https://cve.now/CVE-2019-6675.md): BIG-IP configurations using Active Directory, LDAP, or Client Certificate LDAP for management authentication with multiple servers are expos (no CVSS, BIG-IP)
- [CVE-2019-18460](https://cve.now/CVE-2019-18460.md): An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elastics (no CVSS)
- [CVE-2019-18461](https://cve.now/CVE-2019-18461.md): An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.3 when a sub group epic is added to a public group. (no CVSS)
- [CVE-2019-18462](https://cve.now/CVE-2019-18462.md): An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4. (no CVSS)
- [CVE-2019-12489](https://cve.now/CVE-2019-12489.md): An issue was discovered on Fastweb Askey RTV1907VW 0.00.81\_FW\_200\_Askey 2018-10-02 18:08:18 devices. (no CVSS)
- [CVE-2019-18463](https://cve.now/CVE-2019-18463.md): An issue was discovered in GitLab Community and Enterprise Edition through 12.4. (no CVSS)
- [CVE-2019-19206](https://cve.now/CVE-2019-19206.md): Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture. (no CVSS, dolibarr/dolibarr)
- [CVE-2018-17860](https://cve.now/CVE-2018-17860.md): Cloudera CDH has Insecure Permissions because ALL cannot be revoked.This affects 5.x through 5.15.1 and 6.x through 6.0.1. (no CVSS)
- [CVE-2019-19274](https://cve.now/CVE-2019-19274.md): typed\_ast 1.3.0 and 1.3.1 has a handle\_keywordonly\_args out-of-bounds read. (no CVSS, typed-ast)
- [CVE-2019-19275](https://cve.now/CVE-2019-19275.md): typed\_ast 1.3.0 and 1.3.1 has an ast\_for\_arguments out-of-bounds read. (no CVSS, typed-ast)
- [CVE-2015-4457](https://cve.now/CVE-2015-4457.md): Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbit (no CVSS)
- [CVE-2015-6495](https://cve.now/CVE-2015-6495.md): There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles. (no CVSS)
- [CVE-2015-7831](https://cve.now/CVE-2015-7831.md): In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used. (no CVSS)
- [CVE-2016-3131](https://cve.now/CVE-2016-3131.md): Cloudera CDH before 5.6.1 allows authorization bypass via direct internal API calls. (no CVSS)
- [CVE-2016-3192](https://cve.now/CVE-2016-3192.md): Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files. (no CVSS)
- [CVE-2016-4572](https://cve.now/CVE-2016-4572.md): In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges. (no CVSS)
- [CVE-2016-5724](https://cve.now/CVE-2016-5724.md): Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles. (no CVSS)
- [CVE-2016-6353](https://cve.now/CVE-2016-6353.md): Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass Sentry document-level (no CVSS)
- [CVE-2019-14856](https://cve.now/CVE-2019-14856.md): ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None (CVSS 6.4, \[UNKNOWN\] ansible · ansible)
- [CVE-2019-14853](https://cve.now/CVE-2019-14853.md): An error-handling flaw was found in python-ecdsa before version 0.13.3. (CVSS 3.7, \[UNKNOWN\] python-ecdsa · ecdsa)
- [CVE-2019-14857](https://cve.now/CVE-2019-14857.md): A flaw was found in mod\_auth\_openidc before version 2.4.0.1. (CVSS 5.8, \[UNKNOWN\] mod\_auth\_openidc)
- [CVE-2019-14890](https://cve.now/CVE-2019-14890.md): A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credenti (CVSS 8.4, \[UNKNOWN\] Tower)
- [CVE-2011-4350](https://cve.now/CVE-2011-4350.md): Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. (no CVSS, yaws)
- [CVE-2011-4121](https://cve.now/CVE-2011-4121.md): The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used fo (no CVSS, OpenSSL extension of Ruby)
- [CVE-2011-4120](https://cve.now/CVE-2011-4120.md): Yubico PAM Module before 2.10 performed user authentication when 'use\_first\_pass' PAM configuration option was not used and the module was c (no CVSS, yubico-pam)
- [CVE-2011-4090](https://cve.now/CVE-2011-4090.md): Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation. (no CVSS, serendipity)
- [CVE-2011-4082](https://cve.now/CVE-2011-4082.md): A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the "Accept-Language" HTTP header (no CVSS, phpldapadmin)
- [CVE-2011-4076](https://cve.now/CVE-2011-4076.md): OpenStack Nova before 2012.1 allows someone with access to an EC2\_ACCESS\_KEY (equivalent to a username) to obtain the EC2\_SECRET\_KEY (equiva (no CVSS, nova)
- [CVE-2019-15968](https://cve.now/CVE-2019-15968.md): Cisco Unified Communications Domain Manager Persistent Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Unified Communications Domain Manager)
- [CVE-2019-15971](https://cve.now/CVE-2019-15971.md): Cisco Email Security Appliance MP3 Content Filter Bypass Vulnerability (CVSS 5.8, Cisco Email Security Appliance)
- [CVE-2019-15972](https://cve.now/CVE-2019-15972.md): Cisco Unified Communications Manager SQL Injection Vulnerability (CVSS 5.4, Cisco Unified Communications Manager)
- [CVE-2019-15986](https://cve.now/CVE-2019-15986.md): Cisco Unity Express Command Injection Vulnerability (CVSS 6.7, Cisco Unity Express)
- [CVE-2019-15987](https://cve.now/CVE-2019-15987.md): Cisco WebEx Centers Username Enumeration Information Disclosure Vulnerability (CVSS 5.3, Cisco WebEx Event Center)
- [CVE-2019-15988](https://cve.now/CVE-2019-15988.md): Cisco Email Security Appliance URL Filtering Bypass Vulnerability (CVSS 5.8, Cisco Email Security Appliance)
- [CVE-2019-15990](https://cve.now/CVE-2019-15990.md): Cisco Small Business Routers RV016, RV042, RV042G, and RV082 Information Disclosure Vulnerability (CVSS 5.3, Cisco Small Business RV Series Router Firmware)
- [CVE-2019-15994](https://cve.now/CVE-2019-15994.md): Cisco Stealthwatch Enterprise Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Stealthwatch Enterprise)
- [CVE-2019-15995](https://cve.now/CVE-2019-15995.md): Cisco DNA Spaces: Connector SQL Injection Vulnerability (CVSS 6.5, Cisco DNA Spaces)
- [CVE-2019-15996](https://cve.now/CVE-2019-15996.md): Cisco DNA Spaces: Connector Privilege Escalation Vulnerability (CVSS 6.7, Cisco DNA Spaces)
- [CVE-2019-15997](https://cve.now/CVE-2019-15997.md): Cisco DNA Spaces: Connector Command Injection Vulnerability (CVSS 6.7, Cisco DNA Spaces)
- [CVE-2019-15998](https://cve.now/CVE-2019-15998.md): Cisco IOS XR Software NETCONF Over Secure Shell ACL Bypass Vulnerability (CVSS 5.3, Cisco IOS XR Software)
- [CVE-2019-16001](https://cve.now/CVE-2019-16001.md): Cisco Webex Teams for Windows DLL Hijacking Vulnerability (CVSS 5.3, Cisco Webex Teams)
- [CVE-2019-16002](https://cve.now/CVE-2019-16002.md): Cisco SD-WAN Solution vManage Cross-Site Request Forgery Vulnerability (CVSS 6.5, Cisco vManage Software)
- [CVE-2011-3632](https://cve.now/CVE-2011-3632.md): Hardlink before 0.1.2 operates on full file system objects path names which can allow a local attacker to use this flaw to conduct symlink a (no CVSS, hardlink)
- [CVE-2019-19269](https://cve.now/CVE-2019-19269.md): An issue was discovered in tls\_verify\_crl in ProFTPD through 1.3.6b. (no CVSS)
- [CVE-2019-19270](https://cve.now/CVE-2019-19270.md): An issue was discovered in tls\_verify\_crl in ProFTPD through 1.3.6b. (no CVSS)
- [CVE-2019-19271](https://cve.now/CVE-2019-19271.md): An issue was discovered in tls\_verify\_crl in ProFTPD before 1.3.6. (no CVSS)
- [CVE-2019-19272](https://cve.now/CVE-2019-19272.md): An issue was discovered in tls\_verify\_crl in ProFTPD before 1.3.6. (no CVSS)
- [CVE-2011-3631](https://cve.now/CVE-2011-3631.md): Hardlink before 0.1.2 has multiple integer overflows leading to heap-based buffer overflows because of the way string lengths concatenation (no CVSS, hardlink)
- [CVE-2019-15271](https://cve.now/CVE-2019-15271.md): Cisco Small Business RV016, RV042, RV042G, and RV082 Routers Arbitrary Command Execution Vulnerability (CVSS 8.8, KEV, Cisco Small Business RV Series Router Firmware)
- [CVE-2019-15276](https://cve.now/CVE-2019-15276.md): Cisco Wireless LAN Controller HTTP Parsing Engine Denial of Service Vulnerability (CVSS 7.7, Cisco Wireless LAN Controller)
- [CVE-2019-15284](https://cve.now/CVE-2019-15284.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player)
- [CVE-2019-15286](https://cve.now/CVE-2019-15286.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player)
- [CVE-2019-15288](https://cve.now/CVE-2019-15288.md): Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Privilege Escalation Vulnerability (CVSS 8.8, Cisco TelePresence TC Software)
- [CVE-2019-15956](https://cve.now/CVE-2019-15956.md): Cisco Web Security Appliance Unauthorized Device Reset Vulnerability (CVSS 8.8, Cisco Web Security Appliance)
- [CVE-2019-15958](https://cve.now/CVE-2019-15958.md): Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerability (CVSS 8.1, Cisco Prime Infrastructure)
- [CVE-2019-15960](https://cve.now/CVE-2019-15960.md): Cisco Webex Network Recording Admin Page Privilege Escalation Vulnerability (CVSS 5.4, Cisco Webex Meetings)
- [CVE-2019-15967](https://cve.now/CVE-2019-15967.md): Cisco TelePresence Collaboration Endpoint and RoomOS Audio Eavesdropping Vulnerability (CVSS 4.4, Cisco TelePresence TC Software)
- [CVE-2019-15973](https://cve.now/CVE-2019-15973.md): Cisco Industrial Network Director Reflected Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Industrial Network Director)
- [CVE-2011-3630](https://cve.now/CVE-2011-3630.md): Hardlink before 0.1.2 suffer from multiple stack-based buffer overflow flaws because of the way directory trees with deeply nested directori (no CVSS, hardlink)
- [CVE-2011-3624](https://cve.now/CVE-2011-3624.md): Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forw (no CVSS, Ruby)
- [CVE-2011-3617](https://cve.now/CVE-2011-3617.md): Tahoe-LAFS v1.3.0 through v1.8.2 could allow unauthorized users to delete immutable files in some cases. (no CVSS, Tahoe-LAFS)
- [CVE-2011-3609](https://cve.now/CVE-2011-3609.md): A CSRF issue was found in JBoss Application Server 7 before 7.1.0. (no CVSS, JBoss Application Server)
- [CVE-2011-3606](https://cve.now/CVE-2011-3606.md): A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. (no CVSS, JBoss Application Server)
- [CVE-2011-3600](https://cve.now/CVE-2011-3600.md): The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations (no CVSS, OFBiz)
- [CVE-2019-16201](https://cve.now/CVE-2019-16201.md): WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service (no CVSS)
- [CVE-2019-16254](https://cve.now/CVE-2019-16254.md): Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. (no CVSS)
- [CVE-2019-16255](https://cve.now/CVE-2019-16255.md): Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-11-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.