CVEs published December 2, 2019
41 CVEs were published on December 2, 2019: 1 critical, 1 high.
- Published
- 41
- Critical
- 1
- High
- 1
- Medium
- 1
- Low
- 0
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- piwigo
- 2
- django
- 1
- FreeBSD
- 1
- github.com/docker/docker
- 1
- github.com/hashicorp/terraform
- 1
- jpv
- 1
- Kaspersky Secure Connection, Kaspersky Internet Security, K…
- 1
- mom
- 1
- MuleSoft Mule CE/EE 3.x · MuleSoft Mule API Gateway 2.x
- 1
- openslp-dfsg
- 1
Critical 1
High 1
Medium, low and unrated 39
- CVE-2019-19516Intelbras WRN 150 1.0.18 devices allow CSRF via GO=system_password.asp to the goform/SysToolChangePwd URI to change a password.
- CVE-2019-19316When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapgithub.com/hashicorp/terraform
- CVE-2019-15689Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud prior to version 2020 patch E hKaspersky Secure Connection, Kaspersky Internet Security, K…
- CVE-2012-4576FreeBSD: Input Validation Flaw allows local users to gain elevated privilegesFreeBSD
- CVE-2012-4526piwigo has XSS in password.php (incomplete fix for CVE-2012-4525)piwigo
- CVE-2012-4525piwigo has XSS in password.phppiwigo
- CVE-2012-4480mom creates world-writable pid files in /var/runmom
- CVE-2012-4428openslp: SLPIntersectStringList()' Function has a DoS vulnerabilityopenslp-dfsg
- CVE-2013-4410ReviewBoard: has an access-control problem in REST APIReviewBoard
- CVE-2014-9356Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection megithub.com/docker/docker
- CVE-2019-12503Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to keystroke injection atta
- CVE-2019-19021An issue was discovered in TitanHQ WebTitan before 5.18.
- CVE-2019-19020An issue was discovered in TitanHQ WebTitan before 5.18.
- CVE-2019-19019An issue was discovered in TitanHQ WebTitan before 5.18.
- CVE-2019-19018An issue was discovered in TitanHQ WebTitan before 5.18.
- CVE-2019-19017An issue was discovered in TitanHQ WebTitan before 5.18.
- CVE-2019-12518Anviz CrossChex access control management software 4.3.8.0 and 4.3.12 is vulnerable to a buffer overflow vulnerability.
- CVE-2019-19016An issue was discovered in TitanHQ WebTitan before 5.18.
- CVE-2019-19015An issue was discovered in TitanHQ WebTitan before 5.18.
- CVE-2019-19014An issue was discovered in TitanHQ WebTitan before 5.18.
- CVE-2019-12388Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on po
- CVE-2019-12389Anviz access control devices expose credentials (names and passwords) by allowing remote attackers to query this information without credent
- CVE-2019-12390Anviz access control devices expose private Information (pin code and name) by allowing remote attackers to query this information without c
- CVE-2019-12394Anviz access control devices allow unverified password change which allows remote attackers to change the administrator password without pri
- CVE-2019-12392Anviz access control devices allow remote attackers to issue commands without a password.
- CVE-2019-19507In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten viajpv
- CVE-2019-12391The Anviz Management System for access control has insufficient logging for device events such as door open requests.
- CVE-2019-12393Anviz access control devices are vulnerable to replay attacks which could allow attackers to intercept and replay open door requests.
- CVE-2019-15628Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could allow an attacker to useTrend Micro Security
- CVE-2019-19502Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbi
- CVE-2019-19245NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[username] field when do
- CVE-2019-19118Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing.django
- CVE-2019-19496Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document.
- CVE-2019-19362An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows.
- CVE-2019-19493Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS.
- CVE-2019-19489SMPlayer 19.5.0 has a buffer overflow via a long .m3u file.
- CVE-2019-19490LiteManager 4.5.0 has weak permissions (Everyone: Full Control) in the "LiteManagerFree - Server" folder, as demonstrated by ROMFUSClient.ex
- CVE-2019-19491TestLink 1.9.19 has XSS via the lib/testcases/archiveData.php edit parameter, the index.php reqURI parameter, or the URI in a lib/testcases/
- CVE-2019-19492FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.