CVEs published December 3, 2019
64 CVEs were published on December 3, 2019: 6 critical, 5 high.
- Published
- 64
- Critical
- 6
- High
- 5
- Medium
- 12
- Low
- 0
- Unrated
- 41
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- IBM Cloud Pak System
- 6
- Accusoft
- 4
- Forma
- 4
- Dell Command Update
- 2
- EmbedThis
- 2
- McAfee Web Advisor
- 2
- Shadowsocks
- 2
- Autodesk Desktop Application
- 1
- Autodesk FBX Software Development Kit
- 1
- Dell RSA Authentication Manager
- 1
Critical 6
- CVE-2019-5096An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server appEmbedThis
- CVE-2019-5133An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll BMP parser of the ImageGear 19.3.0 library.Accusoft
- CVE-2019-5132An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll GEM Raster parser of the Accusoft ImageGear 19.3.0 library.Accusoft
- CVE-2019-5076An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll PNG header-parser of the Accusoft ImageGear 19.3.0 library.Accusoft
- CVE-2019-5083An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll TIFdecodethunderscan function of Accusoft ImageGear 19.3.0 librAccusoft
- CVE-2019-4130IBM Cloud Pak System 2.3 and 2.3.0.1 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbiIBM Cloud Pak System
High 5
- CVE-2019-5164An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2.Shadowsocks
- CVE-2019-5110Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1.Forma
- CVE-2019-5109Exploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1.Forma
- CVE-2019-5112Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1.Forma
- CVE-2019-5111Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1.Forma
Medium, low and unrated 53
- CVE-2013-7325An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball.
- CVE-2015-7542A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates.libgwenhywfar
- CVE-2019-5163An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2.Shadowsocks
- CVE-2019-5097A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in veEmbedThis
- CVE-2016-1000104A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.
- CVE-2019-3750Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability.Dell Command Update
- CVE-2019-3749Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability.Dell Command Update
- CVE-2019-18574RSA Authentication Manager software versions prior to 8.4 P8 contain a stored cross-site scripting vulnerability in the Security Console.Dell RSA Authentication Manager
- CVE-2019-19543In the Linux kernel before 5.1.6, there is a use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c.
- CVE-2019-10013The asn1_signature function in asn1.c in Cameron Hamilton-Rich axTLS through 2.1.5 has a Buffer Overflow that allows remote attackers to cau
- CVE-2019-9689process_certificate in tls1.c in Cameron Hamilton-Rich axTLS through 2.1.5 has a Buffer Overflow via a crafted TLS certificate handshake mes
- CVE-2019-13456In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10
- CVE-2019-16885In OkayCMS through 2.3.4, an unauthenticated attacker can achieve remote code execution by injecting a malicious PHP object via a crafted co
- CVE-2019-18992OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules URI: "Open ports on router" and "New forwa
- CVE-2019-18993OpenWrt 18.06.4 allows XSS via the "New port forward" Name field to the cgi-bin/luci/admin/network/firewall/forwards URI (this can occur, fo
- CVE-2019-19382Max Secure Anti Virus Plus 19.0.4.020 has Insecure Permissions on the installation directory.
- CVE-2019-19383freeFTPd 1.0.8 has a Post-Authentication Buffer Overflow via a crafted SIZE command (this is exploitable even if logging is disabled).
- CVE-2019-19457SALTO ProAccess SPACE 5.4.3.0 allows XSS.
- CVE-2019-19458SALTO ProAccess SPACE 5.4.3.0 allows Directory Traversal in the Data Export feature.
- CVE-2019-19459An issue was discovered in SALTO ProAccess SPACE 5.4.3.0.
- CVE-2019-19460An issue was discovered in SALTO ProAccess SPACE 5.4.3.0.
- CVE-2019-7366Buffer overflow vulnerability in Autodesk FBX Software Development Kit version 2019.5.Autodesk FBX Software Development Kit
- CVE-2019-7365DLL preloading vulnerability in Autodesk Desktop Application versions 7.0.16.29 and earlier.Autodesk Desktop Application
- CVE-2019-3990A User Enumeration flaw exists in Harbor.Harbor
- CVE-2019-19523In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/adutux.
- CVE-2019-19524In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memles
- CVE-2019-19525In the Linux kernel before 5.3.6, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/ieee802154/a
- CVE-2019-19526In the Linux kernel before 5.3.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/nfc/pn533/usb.c
- CVE-2019-19527In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/hid/usbhid/hidd
- CVE-2019-19528In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/iowarri
- CVE-2019-19529In the Linux kernel before 5.3.11, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/can/usb/mcb
- CVE-2019-19530In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-a
- CVE-2019-19531In the Linux kernel before 5.2.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/yurex.c
- CVE-2019-19532In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a malicious USB device in the Linux kern
- CVE-2019-19533In the Linux kernel before 5.3.4, there is an info-leak bug that can be caused by a malicious USB device in the drivers/media/usb/ttusb-dec/
- CVE-2019-19534In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_us
- CVE-2019-19535In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb
- CVE-2019-19536In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb
- CVE-2019-19537In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device dr
- CVE-2019-4468IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting.IBM Cloud Pak System
- CVE-2019-4467IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting.IBM Cloud Pak System
- CVE-2019-4465IBM Cloud Pak System 2.3 and 2.3.0.1 allows web pages to be stored locally which can be read by another user on the system.IBM Cloud Pak System
- CVE-2019-4226IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting.IBM Cloud Pak System
- CVE-2019-4098IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting.IBM Cloud Pak System
- CVE-2013-4486Zanata 3.0.0 through 3.1.2 has RCE due to EL interpolation in loggingZanata
- CVE-2013-4411Review Board: URL processing gives unauthorized users access to review listsReview Board
- CVE-2013-2228SaltStack RSA Key Generation allows remote users to decrypt communicationsSaltStack · salt
- CVE-2013-2106webauth before 4.6.1 has authentication credential disclosurewebauth
- CVE-2013-2103OpenShift cartridge allows remote URL retrievalOpenShift cartridge
- CVE-2013-2101Katello has multiple XSS issues in various entitiesKatello
- CVE-2019-3665Code Injection vulnerabilityMcAfee Web Advisor
- CVE-2019-3666API Abuse VulnerabilityMcAfee Web Advisor
- CVE-2013-4235shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory treesshadow