# CVEs published 2019-12-03

64 CVEs were published on December 3, 2019: 6 critical, 5 high. Days are UTC.

- [CVE-2013-7325](https://cve.now/CVE-2013-7325.md): An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball. (no CVSS)
- [CVE-2015-7542](https://cve.now/CVE-2015-7542.md): A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates. (no CVSS, libgwenhywfar)
- [CVE-2019-5164](https://cve.now/CVE-2019-5164.md): An exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev 3.3.2. (CVSS 7.8, Shadowsocks)
- [CVE-2019-5163](https://cve.now/CVE-2019-5163.md): An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. (CVSS 5.9, Shadowsocks)
- [CVE-2019-5096](https://cve.now/CVE-2019-5096.md): An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server app (CVSS 9.8, EmbedThis)
- [CVE-2019-5097](https://cve.now/CVE-2019-5097.md): A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in ve (CVSS 5.3, EmbedThis)
- [CVE-2019-5110](https://cve.now/CVE-2019-5110.md): Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1. (CVSS 7.4, Forma)
- [CVE-2019-5109](https://cve.now/CVE-2019-5109.md): Exploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1. (CVSS 7.4, Forma)
- [CVE-2019-5112](https://cve.now/CVE-2019-5112.md): Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. (CVSS 7.4, Forma)
- [CVE-2019-5111](https://cve.now/CVE-2019-5111.md): Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. (CVSS 7.4, Forma)
- [CVE-2019-5133](https://cve.now/CVE-2019-5133.md): An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll BMP parser of the ImageGear 19.3.0 library. (CVSS 9.8, Accusoft)
- [CVE-2019-5132](https://cve.now/CVE-2019-5132.md): An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll GEM Raster parser of the Accusoft ImageGear 19.3.0 library. (CVSS 9.8, Accusoft)
- [CVE-2019-5076](https://cve.now/CVE-2019-5076.md): An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll PNG header-parser of the Accusoft ImageGear 19.3.0 library. (CVSS 9.8, Accusoft)
- [CVE-2019-5083](https://cve.now/CVE-2019-5083.md): An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll TIFdecodethunderscan function of Accusoft ImageGear 19.3.0 libr (CVSS 9.8, Accusoft)
- [CVE-2016-1000104](https://cve.now/CVE-2016-1000104.md): A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod\_fcgid through 2016-07-07. (no CVSS)
- [CVE-2019-3750](https://cve.now/CVE-2019-3750.md): Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. (CVSS 5.6, Dell Command Update)
- [CVE-2019-3749](https://cve.now/CVE-2019-3749.md): Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. (CVSS 5.6, Dell Command Update)
- [CVE-2019-18574](https://cve.now/CVE-2019-18574.md): RSA Authentication Manager software versions prior to 8.4 P8 contain a stored cross-site scripting vulnerability in the Security Console. (CVSS 4.8, Dell RSA Authentication Manager)
- [CVE-2019-19543](https://cve.now/CVE-2019-19543.md): In the Linux kernel before 5.1.6, there is a use-after-free in serial\_ir\_init\_module() in drivers/media/rc/serial\_ir.c. (no CVSS)
- [CVE-2019-10013](https://cve.now/CVE-2019-10013.md): The asn1\_signature function in asn1.c in Cameron Hamilton-Rich axTLS through 2.1.5 has a Buffer Overflow that allows remote attackers to cau (no CVSS)
- [CVE-2019-9689](https://cve.now/CVE-2019-9689.md): process\_certificate in tls1.c in Cameron Hamilton-Rich axTLS through 2.1.5 has a Buffer Overflow via a crafted TLS certificate handshake mes (no CVSS)
- [CVE-2019-13456](https://cve.now/CVE-2019-13456.md): In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 (no CVSS)
- [CVE-2019-16885](https://cve.now/CVE-2019-16885.md): In OkayCMS through 2.3.4, an unauthenticated attacker can achieve remote code execution by injecting a malicious PHP object via a crafted co (no CVSS)
- [CVE-2019-18992](https://cve.now/CVE-2019-18992.md): OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules URI: "Open ports on router" and "New forwa (no CVSS)
- [CVE-2019-18993](https://cve.now/CVE-2019-18993.md): OpenWrt 18.06.4 allows XSS via the "New port forward" Name field to the cgi-bin/luci/admin/network/firewall/forwards URI (this can occur, fo (no CVSS)
- [CVE-2019-19382](https://cve.now/CVE-2019-19382.md): Max Secure Anti Virus Plus 19.0.4.020 has Insecure Permissions on the installation directory. (no CVSS)
- [CVE-2019-19383](https://cve.now/CVE-2019-19383.md): freeFTPd 1.0.8 has a Post-Authentication Buffer Overflow via a crafted SIZE command (this is exploitable even if logging is disabled). (no CVSS)
- [CVE-2019-19457](https://cve.now/CVE-2019-19457.md): SALTO ProAccess SPACE 5.4.3.0 allows XSS. (no CVSS)
- [CVE-2019-19458](https://cve.now/CVE-2019-19458.md): SALTO ProAccess SPACE 5.4.3.0 allows Directory Traversal in the Data Export feature. (no CVSS)
- [CVE-2019-19459](https://cve.now/CVE-2019-19459.md): An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. (no CVSS)
- [CVE-2019-19460](https://cve.now/CVE-2019-19460.md): An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. (no CVSS)
- [CVE-2019-7366](https://cve.now/CVE-2019-7366.md): Buffer overflow vulnerability in Autodesk FBX Software Development Kit version 2019.5. (no CVSS, Autodesk FBX Software Development Kit)
- [CVE-2019-7365](https://cve.now/CVE-2019-7365.md): DLL preloading vulnerability in Autodesk Desktop Application versions 7.0.16.29 and earlier. (no CVSS, Autodesk Desktop Application)
- [CVE-2019-3990](https://cve.now/CVE-2019-3990.md): A User Enumeration flaw exists in Harbor. (no CVSS, Harbor)
- [CVE-2019-19523](https://cve.now/CVE-2019-19523.md): In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/adutux. (no CVSS)
- [CVE-2019-19524](https://cve.now/CVE-2019-19524.md): In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/input/ff-memles (no CVSS)
- [CVE-2019-19525](https://cve.now/CVE-2019-19525.md): In the Linux kernel before 5.3.6, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/ieee802154/a (no CVSS)
- [CVE-2019-19526](https://cve.now/CVE-2019-19526.md): In the Linux kernel before 5.3.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/nfc/pn533/usb.c (no CVSS)
- [CVE-2019-19527](https://cve.now/CVE-2019-19527.md): In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/hid/usbhid/hidd (no CVSS)
- [CVE-2019-19528](https://cve.now/CVE-2019-19528.md): In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/iowarri (no CVSS)
- [CVE-2019-19529](https://cve.now/CVE-2019-19529.md): In the Linux kernel before 5.3.11, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/net/can/usb/mcb (no CVSS)
- [CVE-2019-19530](https://cve.now/CVE-2019-19530.md): In the Linux kernel before 5.2.10, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/class/cdc-a (no CVSS)
- [CVE-2019-19531](https://cve.now/CVE-2019-19531.md): In the Linux kernel before 5.2.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/yurex.c (no CVSS)
- [CVE-2019-19532](https://cve.now/CVE-2019-19532.md): In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a malicious USB device in the Linux kern (no CVSS)
- [CVE-2019-19533](https://cve.now/CVE-2019-19533.md): In the Linux kernel before 5.3.4, there is an info-leak bug that can be caused by a malicious USB device in the drivers/media/usb/ttusb-dec/ (no CVSS)
- [CVE-2019-19534](https://cve.now/CVE-2019-19534.md): In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak\_us (no CVSS)
- [CVE-2019-19535](https://cve.now/CVE-2019-19535.md): In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak\_usb (no CVSS)
- [CVE-2019-19536](https://cve.now/CVE-2019-19536.md): In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak\_usb (no CVSS)
- [CVE-2019-19537](https://cve.now/CVE-2019-19537.md): In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device dr (no CVSS)
- [CVE-2019-4468](https://cve.now/CVE-2019-4468.md): IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Cloud Pak System)
- [CVE-2019-4467](https://cve.now/CVE-2019-4467.md): IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Cloud Pak System)
- [CVE-2019-4465](https://cve.now/CVE-2019-4465.md): IBM Cloud Pak System 2.3 and 2.3.0.1 allows web pages to be stored locally which can be read by another user on the system. (CVSS 4.0, IBM Cloud Pak System)
- [CVE-2019-4226](https://cve.now/CVE-2019-4226.md): IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Cloud Pak System)
- [CVE-2019-4130](https://cve.now/CVE-2019-4130.md): IBM Cloud Pak System 2.3 and 2.3.0.1 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbi (CVSS 9.0, IBM Cloud Pak System)
- [CVE-2019-4098](https://cve.now/CVE-2019-4098.md): IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Cloud Pak System)
- [CVE-2013-4486](https://cve.now/CVE-2013-4486.md): Zanata 3.0.0 through 3.1.2 has RCE due to EL interpolation in logging (no CVSS, Zanata)
- [CVE-2013-4411](https://cve.now/CVE-2013-4411.md): Review Board: URL processing gives unauthorized users access to review lists (no CVSS, Review Board)
- [CVE-2013-2228](https://cve.now/CVE-2013-2228.md): SaltStack RSA Key Generation allows remote users to decrypt communications (no CVSS, SaltStack · salt)
- [CVE-2013-2106](https://cve.now/CVE-2013-2106.md): webauth before 4.6.1 has authentication credential disclosure (no CVSS, webauth)
- [CVE-2013-2103](https://cve.now/CVE-2013-2103.md): OpenShift cartridge allows remote URL retrieval (no CVSS, OpenShift cartridge)
- [CVE-2013-2101](https://cve.now/CVE-2013-2101.md): Katello has multiple XSS issues in various entities (no CVSS, Katello)
- [CVE-2019-3665](https://cve.now/CVE-2019-3665.md): Code Injection vulnerability (CVSS 6.5, McAfee Web Advisor)
- [CVE-2019-3666](https://cve.now/CVE-2019-3666.md): API Abuse Vulnerability (CVSS 6.5, McAfee Web Advisor)
- [CVE-2013-4235](https://cve.now/CVE-2013-4235.md): shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees (no CVSS, shadow)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.