# CVEs published 2019-12-02

41 CVEs were published on December 2, 2019: 1 critical, 1 high. Days are UTC.

- [CVE-2019-19516](https://cve.now/CVE-2019-19516.md): Intelbras WRN 150 1.0.18 devices allow CSRF via GO=system\_password.asp to the goform/SysToolChangePwd URI to change a password. (no CVSS)
- [CVE-2019-19316](https://cve.now/CVE-2019-19316.md): When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snap (no CVSS, github.com/hashicorp/terraform)
- [CVE-2019-15689](https://cve.now/CVE-2019-15689.md): Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud prior to version 2020 patch E h (no CVSS, Kaspersky Secure Connection, Kaspersky Internet Security, K…)
- [CVE-2012-5562](https://cve.now/CVE-2012-5562.md): Rhn-proxy: rhn-satellite: rhn-proxy: information disclosure via clear-text credential transmission when accessing rhn satellite (CVSS 8.6, Red Hat Satellite Proxy v · Red Hat Satellite)
- [CVE-2012-4576](https://cve.now/CVE-2012-4576.md): FreeBSD: Input Validation Flaw allows local users to gain elevated privileges (no CVSS, FreeBSD)
- [CVE-2012-4526](https://cve.now/CVE-2012-4526.md): piwigo has XSS in password.php (incomplete fix for CVE-2012-4525) (no CVSS, piwigo)
- [CVE-2012-4525](https://cve.now/CVE-2012-4525.md): piwigo has XSS in password.php (no CVSS, piwigo)
- [CVE-2012-4480](https://cve.now/CVE-2012-4480.md): mom creates world-writable pid files in /var/run (no CVSS, mom)
- [CVE-2012-4428](https://cve.now/CVE-2012-4428.md): openslp: SLPIntersectStringList()' Function has a DoS vulnerability (no CVSS, openslp-dfsg)
- [CVE-2013-4410](https://cve.now/CVE-2013-4410.md): ReviewBoard: has an access-control problem in REST API (no CVSS, ReviewBoard)
- [CVE-2014-9356](https://cve.now/CVE-2014-9356.md): Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection me (no CVSS, github.com/docker/docker)
- [CVE-2019-12503](https://cve.now/CVE-2019-12503.md): Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to keystroke injection atta (no CVSS)
- [CVE-2019-19021](https://cve.now/CVE-2019-19021.md): An issue was discovered in TitanHQ WebTitan before 5.18. (no CVSS)
- [CVE-2019-19020](https://cve.now/CVE-2019-19020.md): An issue was discovered in TitanHQ WebTitan before 5.18. (no CVSS)
- [CVE-2019-19019](https://cve.now/CVE-2019-19019.md): An issue was discovered in TitanHQ WebTitan before 5.18. (no CVSS)
- [CVE-2019-19018](https://cve.now/CVE-2019-19018.md): An issue was discovered in TitanHQ WebTitan before 5.18. (no CVSS)
- [CVE-2019-19017](https://cve.now/CVE-2019-19017.md): An issue was discovered in TitanHQ WebTitan before 5.18. (no CVSS)
- [CVE-2019-12518](https://cve.now/CVE-2019-12518.md): Anviz CrossChex access control management software 4.3.8.0 and 4.3.12 is vulnerable to a buffer overflow vulnerability. (no CVSS)
- [CVE-2019-19016](https://cve.now/CVE-2019-19016.md): An issue was discovered in TitanHQ WebTitan before 5.18. (no CVSS)
- [CVE-2019-19015](https://cve.now/CVE-2019-19015.md): An issue was discovered in TitanHQ WebTitan before 5.18. (no CVSS)
- [CVE-2019-19014](https://cve.now/CVE-2019-19014.md): An issue was discovered in TitanHQ WebTitan before 5.18. (no CVSS)
- [CVE-2019-12388](https://cve.now/CVE-2019-12388.md): Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on po (no CVSS)
- [CVE-2019-12389](https://cve.now/CVE-2019-12389.md): Anviz access control devices expose credentials (names and passwords) by allowing remote attackers to query this information without credent (no CVSS)
- [CVE-2019-12390](https://cve.now/CVE-2019-12390.md): Anviz access control devices expose private Information (pin code and name) by allowing remote attackers to query this information without c (no CVSS)
- [CVE-2019-12394](https://cve.now/CVE-2019-12394.md): Anviz access control devices allow unverified password change which allows remote attackers to change the administrator password without pri (no CVSS)
- [CVE-2019-12392](https://cve.now/CVE-2019-12392.md): Anviz access control devices allow remote attackers to issue commands without a password. (no CVSS)
- [CVE-2019-19507](https://cve.now/CVE-2019-19507.md): In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via (no CVSS, jpv)
- [CVE-2019-12391](https://cve.now/CVE-2019-12391.md): The Anviz Management System for access control has insufficient logging for device events such as door open requests. (no CVSS)
- [CVE-2019-12393](https://cve.now/CVE-2019-12393.md): Anviz access control devices are vulnerable to replay attacks which could allow attackers to intercept and replay open door requests. (no CVSS)
- [CVE-2019-15628](https://cve.now/CVE-2019-15628.md): Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could allow an attacker to use (no CVSS, Trend Micro Security)
- [CVE-2019-19502](https://cve.now/CVE-2019-19502.md): Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbi (no CVSS)
- [CVE-2019-19245](https://cve.now/CVE-2019-19245.md): NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm\[username\] field when do (no CVSS)
- [CVE-2019-19118](https://cve.now/CVE-2019-19118.md): Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. (no CVSS, django)
- [CVE-2019-19496](https://cve.now/CVE-2019-19496.md): Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document. (no CVSS)
- [CVE-2019-19362](https://cve.now/CVE-2019-19362.md): An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. (CVSS 4.3)
- [CVE-2019-19493](https://cve.now/CVE-2019-19493.md): Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, leading to XSS. (no CVSS)
- [CVE-2019-15631](https://cve.now/CVE-2019-15631.md): Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 allows remote attackers (CVSS 9.8, MuleSoft Mule CE/EE 3.x · MuleSoft Mule API Gateway 2.x)
- [CVE-2019-19489](https://cve.now/CVE-2019-19489.md): SMPlayer 19.5.0 has a buffer overflow via a long .m3u file. (no CVSS)
- [CVE-2019-19490](https://cve.now/CVE-2019-19490.md): LiteManager 4.5.0 has weak permissions (Everyone: Full Control) in the "LiteManagerFree - Server" folder, as demonstrated by ROMFUSClient.ex (no CVSS)
- [CVE-2019-19491](https://cve.now/CVE-2019-19491.md): TestLink 1.9.19 has XSS via the lib/testcases/archiveData.php edit parameter, the index.php reqURI parameter, or the URI in a lib/testcases/ (no CVSS)
- [CVE-2019-19492](https://cve.now/CVE-2019-19492.md): FreeSWITCH 1.6.10 through 1.10.1 has a default password in event\_socket.conf.xml. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.