CVEs published December 5, 2019
47 CVEs were published on December 5, 2019: 6 critical, 1 high. 4 are now in CISA KEV.
- Published
- 47
- Critical
- 6
- High
- 1
- Medium
- 5
- Low
- 2
- Unrated
- 33
- Now in CISA KEV
- 4
- Fix available
- 10
Most affected products
- Norton Password Manager
- 3
- QNAP NAS devices running Photo Station
- 3
- QNAP NAS devices
- 2
- AMD ATI
- 1
- gitbook
- 1
- haskell-tls-extra
- 1
- Jasig Project php-pear-CAS
- 1
- jasig project phpCAS
- 1
- Katello
- 1
- Keycloak · org.keycloak:keycloak-parent
- 1
Critical 6
- CVE-2019-7195This external control of file name or path vulnerability allows remote attackers to access or modify system files.QNAP NAS devices running Photo Station
- CVE-2019-7194This external control of file name or path vulnerability allows remote attackers to access or modify system files.QNAP NAS devices running Photo Station
- CVE-2019-7193This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system.QNAP NAS devices
- CVE-2019-7192This improper access control vulnerability allows remote attackers to gain unauthorized access to the system.QNAP NAS devices running Photo Station
- CVE-2019-14910A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS froKeycloak · org.keycloak:keycloak-parent
- CVE-2019-19589The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives.
High 1
Medium, low and unrated 40
- CVE-2012-1592A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execlibstruts1.2-java · org.apache.struts:struts2-core
- CVE-2012-1115A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, and dn parameters to ldap-account-manager LDAP Account Manager (LAM) Pro
- CVE-2012-1114A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and ldap-account-manager LDAP Account Manager
- CVE-2019-16768Internal exception message exposure for login action in SyliusSylius · sylius/sylius
- CVE-2019-19609The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admstrapi
- CVE-2019-16770Potential DOS attack in Pumapuma
- CVE-2019-16769Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS)yahoo serialize-javascript · serialize-javascript
- CVE-2012-1105An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory.Jasig Project php-pear-CAS
- CVE-2012-1104A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of services are managed.jasig project phpCAS
- CVE-2019-5098An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010.AMD ATI
- CVE-2019-19546Norton Password Manager, prior to 6.6.2.5, may be susceptible to an information disclosure issue, which is a type of vulnerability whereby tNorton Password Manager
- CVE-2019-19545Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, which is a type of isNorton Password Manager
- CVE-2019-18381Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, which is a type of isNorton Password Manager
- CVE-2019-17388Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux allow a local attacker t
- CVE-2019-17387An authentication flaw in the AVPNC_RP service in Aviatrix VPN Client through 2.2.10 allows an attacker to gain elevated privileges through
- CVE-2019-7185This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on the administrator’s QNAP NAS devices running Music Station
- CVE-2019-7184This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s QNAP NAS devices running Video Station
- CVE-2019-7183This improper link resolution vulnerability allows remote attackers to access system files.QNAP NAS devices
- CVE-2019-19466SCEditor 2.1.3 allows XSS.
- CVE-2013-0326OpenStack nova base images permissions are world readableopenstack-nova
- CVE-2019-11255Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutationkubernetes-csi external-provisioner · kubernetes-csi ext… +4
- CVE-2018-1002102Kubernetes API server follows unvalidated redirects from streaming Kubelet endpointsKubernetes
- CVE-2013-0283Katello: Username in Notification page has cross site scriptingKatello
- CVE-2019-15897beegfs-ctl in ThinkParQ BeeGFS through 7.1.3 allows Authentication Bypass via communication with a BeeGFS metadata server (which is typicall
- CVE-2019-3690chkstat follows untrusted symbolic linksSUSE permissions
- CVE-2019-19007Intelbras IWR 3000N 1.8.7 devices allow disclosure of the administrator login name and password because v1/system/user is mishandled, a rela
- CVE-2019-19594reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allows remote attackers t
- CVE-2019-19595reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote
- CVE-2013-0243haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connectionshaskell-tls-extra
- CVE-2013-0163OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoSOpenShift haproxy cartridge
- CVE-2019-18180Denial of service
- CVE-2019-19317lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to ca
- CVE-2019-19602fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows context-dependent att
- CVE-2019-19601OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf.
- CVE-2019-19597D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters w
- CVE-2019-19598D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAP_AUTH header timesta
- CVE-2019-19596GitBook through 2.6.9 allows XSS via a local .md file.gitbook
- CVE-2019-19590In radare2 through 4.0, there is an integer overflow for the variable new_token_size in the function r_asm_massemble at libr/asm/asm.c.
- CVE-2019-19553In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash.
- CVE-2019-19588The validators package 0.12.2 through 0.12.5 for Python enters an infinite loop when validators.domain is called with a crafted domain strinvalidators