CVEs published December 4, 2019
38 CVEs were published on December 4, 2019: 1 critical, 0 high.
- Published
- 38
- Critical
- 1
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 36
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- QNAP NAS devices
- 4
- Facebook HHVM
- 3
- Docker Engine · CS Docker Engine
- 2
- Facebook Mcrouter
- 2
- Apache Olingo · org.apache.olingo:odata-client-core
- 1
- Apache Olingo · org.apache.olingo:odata-client-core +1
- 1
- Apache Olingo · org.apache.olingo:odata-client-proxy
- 1
- Facebook folly
- 1
- Facebook Proxygen
- 1
- Keycloak · org.keycloak:keycloak-parent
- 1
Critical 1
Medium, low and unrated 37
- CVE-2019-19587In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor configuration from the source view in the Mana
- CVE-2019-19519In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is a logic error in the
- CVE-2019-19520xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH environment variable, bec
- CVE-2019-19521libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd.
- CVE-2019-19522OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveragin
- CVE-2013-2745An SQL Injection vulnerability exists in MiniDLNA prior to 1.1.0
- CVE-2019-19579An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain
- CVE-2019-11216BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality.
- CVE-2019-16752An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26.
- CVE-2019-16753An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26.
- CVE-2019-19133The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails
- CVE-2019-19228Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account
- CVE-2019-19229admincgi-bin/service.fcgi on Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allows action=download&filename= Directory Traversal.
- CVE-2019-19364A weak malicious user can escalate its privilege whenever CatalystProductionSuite.2019.1.exe (version 1.1.0.21) and CatalystBrowseSuite.2019
- CVE-2019-19576class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omverot/class.upload.php
- CVE-2019-18347A stored XSS issue was discovered in DAViCal through 1.1.8.
- CVE-2019-18346A CSRF issue was discovered in DAViCal through 1.1.8.
- CVE-2019-17555The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep()Apache Olingo · org.apache.olingo:odata-client-core
- CVE-2019-17556Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classApache Olingo · org.apache.olingo:odata-client-proxy
- CVE-2019-17554The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entitApache Olingo · org.apache.olingo:odata-client-core +1
- CVE-2019-7197A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS.QNAP NAS devices
- CVE-2019-7201An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator.QNAP NetBak Replicator
- CVE-2018-0730This command injection vulnerability in File Station allows attackers to execute commands on the affected device.QNAP NAS devices
- CVE-2018-0729This command injection vulnerability in Music Station allows attackers to execute commands on the affected device.QNAP NAS devices
- CVE-2019-11940In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the headeFacebook Proxygen
- CVE-2018-0728This improper access control vulnerability in Helpdesk allows attackers to access the system logs.QNAP NAS devices
- CVE-2019-11934Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket.Facebook folly
- CVE-2019-11935Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of-bounds memory.Facebook HHVM
- CVE-2019-11936Various APC functions accept keys containing null bytes as input, leading to premature truncation of input.Facebook HHVM
- CVE-2019-11930An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution.Facebook HHVM
- CVE-2019-19555read_textobject in read.c in Xfig fig2dev 3.2.7b has a stack-based buffer overflow because of an incorrect sscanf.
- CVE-2019-11937In Mcrouter prior to v0.41.0, a large struct input provided to the Carbon protocol reader could result in stack exhaustion and denial of serFacebook Mcrouter
- CVE-2019-11923In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforcedFacebook Mcrouter
- CVE-2014-8179Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON reDocker Engine · CS Docker Engine
- CVE-2014-8178Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes Docker Engine · CS Docker Engine
- CVE-2019-15638COPA-DATA zenone32 zenon Editor through 8.10 has an Uncontrolled Search Path Element.
- CVE-2019-18850TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response headers when responding to different HTTP me