CVEs published November 27, 2019
49 CVEs were published on November 27, 2019: 0 critical, 5 high.
- Published
- 49
- Critical
- 0
- High
- 5
- Medium
- 1
- Low
- 3
- Unrated
- 40
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- F5 BIG-IP
- 5
- Siemens AG Polarion
- 3
- BIG-IP
- 1
- dhcpv6 project dhcpv6
- 1
- dirmngr
- 1
- F5 BIG-IP AFM
- 1
- F5 BIG-IP APM Edge Client
- 1
- F5 BIG-IP ASM · F5 BIG-IQ +2
- 1
- F5 SSL Orchestrator
- 1
- Fortinet FortiGate
- 1
High 5
- CVE-2019-10220Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.SUSE kernel:
- CVE-2019-14812A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privilegRed Hat ghostscript
- CVE-2019-10216In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAghostscript
- CVE-2019-14867A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way thRed Hat ipa · ipa +1
- CVE-2019-14896A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver.Red Hat kernel
Medium, low and unrated 44
- CVE-2019-19318In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can
- CVE-2019-19319In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access bec
- CVE-2019-18660The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable C
- CVE-2019-18253An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series (versions 1p1r26, 1.2.3.1Relion 670 Series
- CVE-2019-18247An attacker may use a specially crafted message to force Relion 650 series (versions 1.3.0.5 and prior) or Relion 670 series (versions 1.2.3Relion 650 and 670 Series
- CVE-2019-6665On BIG-IP ASM 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, BIG-IQ 6.0.0 and 5.2.0-5.4.0, iWorkflow 2.3.0, and EnterprisF5 BIG-IP ASM · F5 BIG-IQ +2
- CVE-2019-6666On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, and 13.1.0-13.1.1.4, the TMM process may produce a core file when an upstream serF5 BIG-IP
- CVE-2019-6667On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.5.1-11.6.5, under certain conditions, TMF5 BIG-IP
- CVE-2019-6668The BIG-IP APM Edge Client for macOS bundled with BIG-IP APM 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.5F5 BIG-IP APM Edge Client
- CVE-2019-6669On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, undisclosed traffic flow may cauF5 BIG-IP
- CVE-2019-6671On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, under certain conditions tmm may leak memory when processing pacBIG-IP
- CVE-2019-6672On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, and 13.1.0-13.1.3.1, when bad-actor detection is configured on a wildcard virtual server on platF5 BIG-IP AFM
- CVE-2019-6670On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5, vCMP hypervisors are incorrectly eF5 BIG-IP
- CVE-2019-6673On versions 15.0.0-15.0.1 and 14.0.0-14.1.2, when the BIG-IP is configured in HTTP/2 Full Proxy mode, specifically crafted requests may causF5 BIG-IP
- CVE-2019-6674On F5 SSL Orchestrator 15.0.0-15.0.1 and 14.0.0-14.1.2, TMM may crash when processing SSLO data in a service-chaining configuration.F5 SSL Orchestrator
- CVE-2011-2717The DHCPv6 client (dhcp6c) as used in the dhcpv6 project through 2011-07-25 allows remote DHCP servers to execute arbitrary commands via shedhcpv6 project dhcpv6
- CVE-2019-15705An Improper Input Validation vulnerability in the SSL VPN portal of FortiOS versions 6.2.1 and below, and 6.0.6 and below may allow an unautFortinet FortiGate
- CVE-2011-2523vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.vsftpd
- CVE-2011-2515PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packagpackagekit
- CVE-2019-19366A cross-site scripting (XSS) vulnerability in app/xml_cdr/xml_cdr_search.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary
- CVE-2019-19367A cross-site scripting (XSS) vulnerability in app/fax/fax_files.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web scrip
- CVE-2011-2480Information Disclosure vulnerability in the 802.11 stack, as used in FreeBSD before 8.2 and NetBSD when using certain non-x86 architectures.FreeBSD, NetBSD FreeBSD · FreeBSD, NetBSD NetBSD
- CVE-2014-3875The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before fex-2014053 allows remote attackers to conduct cross-site scr
- CVE-2013-2625An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2
- CVE-2011-2207dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to cause a denial of service (DOS) via a specialdirmngr
- CVE-2012-2248An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable.isc-dhcp
- CVE-2011-2187xscreensaver before 5.14 crashes during activation and leaves the screen unlocked when in Blank Only Mode and when DPMS is disabled, which axscreensaver
- CVE-2012-6655An issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in user.c which could let a local users obtain en
- CVE-2016-1000110The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow
- CVE-2011-2177OpenOffice.org v3.3 allows execution of arbitrary code with the privileges of the user running the OpenOffice.org suite tools.OpenOffice.org
- CVE-2019-18184Crestron DMC-STRO 1.0 devices allow remote command execution as root via shell metacharacters to the ping function.
- CVE-2016-4980A password generation weakness exists in xquest through 2016-06-13.xguest
- CVE-2017-12945Insufficient validation of user-supplied input for the Solstice Pod before 2.8.4 networking configuration enables authenticated attackers to
- CVE-2019-19330The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, AS
- CVE-2019-19327ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of
- CVE-2019-19328ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entit
- CVE-2019-19329In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, ar
- CVE-2019-19308In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing a TTF font file that
- CVE-2019-15298A problem was found in Centreon Web through 19.04.3.
- CVE-2019-13936Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siemens AG Polarion couldSiemens AG Polarion
- CVE-2019-13935Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siemens AG Polarion couldSiemens AG Polarion
- CVE-2019-13934Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siemens AG Polarion couldSiemens AG Polarion
- CVE-2019-15300A problem was found in Centreon Web through 19.04.3.
- CVE-2019-10195A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way thRed Hat IPA · ipa +1