# CVEs published 2019-12-04

38 CVEs were published on December 4, 2019: 1 critical, 0 high. Days are UTC.

- [CVE-2019-19587](https://cve.now/CVE-2019-19587.md): In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor configuration from the source view in the Mana (CVSS 6.1)
- [CVE-2019-19519](https://cve.now/CVE-2019-19519.md): In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is a logic error in the (no CVSS)
- [CVE-2019-19520](https://cve.now/CVE-2019-19520.md): xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL\_DRIVERS\_PATH environment variable, bec (no CVSS)
- [CVE-2019-19521](https://cve.now/CVE-2019-19521.md): libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiusd. (no CVSS)
- [CVE-2019-19522](https://cve.now/CVE-2019-19522.md): OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to become root by leveragin (no CVSS)
- [CVE-2013-2745](https://cve.now/CVE-2013-2745.md): An SQL Injection vulnerability exists in MiniDLNA prior to 1.1.0 (no CVSS)
- [CVE-2019-19579](https://cve.now/CVE-2019-19579.md): An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain (no CVSS)
- [CVE-2019-11216](https://cve.now/CVE-2019-11216.md): BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. (no CVSS)
- [CVE-2019-16752](https://cve.now/CVE-2019-16752.md): An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. (no CVSS)
- [CVE-2019-16753](https://cve.now/CVE-2019-16753.md): An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. (no CVSS)
- [CVE-2019-19133](https://cve.now/CVE-2019-19133.md): The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero\_action=edit\_page request because it fails (no CVSS)
- [CVE-2019-19228](https://cve.now/CVE-2019-19228.md): Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account (no CVSS)
- [CVE-2019-19229](https://cve.now/CVE-2019-19229.md): admincgi-bin/service.fcgi on Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allows action=download&filename= Directory Traversal. (no CVSS)
- [CVE-2019-19364](https://cve.now/CVE-2019-19364.md): A weak malicious user can escalate its privilege whenever CatalystProductionSuite.2019.1.exe (version 1.1.0.21) and CatalystBrowseSuite.2019 (no CVSS)
- [CVE-2019-19576](https://cve.now/CVE-2019-19576.md): class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, om (no CVSS, verot/class.upload.php)
- [CVE-2019-18347](https://cve.now/CVE-2019-18347.md): A stored XSS issue was discovered in DAViCal through 1.1.8. (no CVSS)
- [CVE-2019-18346](https://cve.now/CVE-2019-18346.md): A CSRF issue was discovered in DAViCal through 1.1.8. (no CVSS)
- [CVE-2019-17555](https://cve.now/CVE-2019-17555.md): The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() (no CVSS, Apache Olingo · org.apache.olingo:odata-client-core)
- [CVE-2019-17556](https://cve.now/CVE-2019-17556.md): Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check class (no CVSS, Apache Olingo · org.apache.olingo:odata-client-proxy)
- [CVE-2019-17554](https://cve.now/CVE-2019-17554.md): The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entit (no CVSS, Apache Olingo · org.apache.olingo:odata-client-core +1)
- [CVE-2019-7197](https://cve.now/CVE-2019-7197.md): A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. (no CVSS, QNAP NAS devices)
- [CVE-2019-7201](https://cve.now/CVE-2019-7201.md): An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator. (no CVSS, QNAP NetBak Replicator)
- [CVE-2018-0730](https://cve.now/CVE-2018-0730.md): This command injection vulnerability in File Station allows attackers to execute commands on the affected device. (no CVSS, QNAP NAS devices)
- [CVE-2018-0729](https://cve.now/CVE-2018-0729.md): This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. (no CVSS, QNAP NAS devices)
- [CVE-2019-11940](https://cve.now/CVE-2019-11940.md): In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the heade (no CVSS, Facebook Proxygen)
- [CVE-2018-0728](https://cve.now/CVE-2018-0728.md): This improper access control vulnerability in Helpdesk allows attackers to access the system logs. (no CVSS, QNAP NAS devices)
- [CVE-2019-11934](https://cve.now/CVE-2019-11934.md): Improper handling of close\_notify alerts can result in an out-of-bounds read in AsyncSSLSocket. (no CVSS, Facebook folly)
- [CVE-2019-11935](https://cve.now/CVE-2019-11935.md): Insufficient boundary checks when processing a string in mb\_ereg\_replace allows access to out-of-bounds memory. (no CVSS, Facebook HHVM)
- [CVE-2019-11936](https://cve.now/CVE-2019-11936.md): Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. (no CVSS, Facebook HHVM)
- [CVE-2019-11930](https://cve.now/CVE-2019-11930.md): An invalid free in mb\_detect\_order can cause the application to crash or potentially result in remote code execution. (no CVSS, Facebook HHVM)
- [CVE-2019-19555](https://cve.now/CVE-2019-19555.md): read\_textobject in read.c in Xfig fig2dev 3.2.7b has a stack-based buffer overflow because of an incorrect sscanf. (no CVSS)
- [CVE-2019-11937](https://cve.now/CVE-2019-11937.md): In Mcrouter prior to v0.41.0, a large struct input provided to the Carbon protocol reader could result in stack exhaustion and denial of ser (no CVSS, Facebook Mcrouter)
- [CVE-2019-11923](https://cve.now/CVE-2019-11923.md): In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforced (no CVSS, Facebook Mcrouter)
- [CVE-2014-8179](https://cve.now/CVE-2014-8179.md): Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON re (no CVSS, Docker Engine · CS Docker Engine)
- [CVE-2014-8178](https://cve.now/CVE-2014-8178.md): Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes (no CVSS, Docker Engine · CS Docker Engine)
- [CVE-2019-15638](https://cve.now/CVE-2019-15638.md): COPA-DATA zenone32 zenon Editor through 8.10 has an Uncontrolled Search Path Element. (no CVSS)
- [CVE-2019-14909](https://cve.now/CVE-2019-14909.md): A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or v (CVSS 9.3, Keycloak · org.keycloak:keycloak-parent)
- [CVE-2019-18850](https://cve.now/CVE-2019-18850.md): TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response headers when responding to different HTTP me (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.