# CVEs published 2019-12-05

47 CVEs were published on December 5, 2019: 6 critical, 1 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2012-1592](https://cve.now/CVE-2012-1592.md): A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and exec (no CVSS, libstruts1.2-java · org.apache.struts:struts2-core)
- [CVE-2012-1115](https://cve.now/CVE-2012-1115.md): A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add\_value\_form, and dn parameters to (no CVSS, ldap-account-manager LDAP Account Manager (LAM) Pro)
- [CVE-2012-1114](https://cve.now/CVE-2012-1114.md): A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and (no CVSS, ldap-account-manager LDAP Account Manager)
- [CVE-2019-16768](https://cve.now/CVE-2019-16768.md): Internal exception message exposure for login action in Sylius (CVSS 3.5, Sylius · sylius/sylius)
- [CVE-2019-19609](https://cve.now/CVE-2019-19609.md): The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Adm (no CVSS, strapi)
- [CVE-2019-16770](https://cve.now/CVE-2019-16770.md): Potential DOS attack in Puma (CVSS 5.3, puma)
- [CVE-2019-16769](https://cve.now/CVE-2019-16769.md): Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS) (CVSS 4.2, yahoo serialize-javascript · serialize-javascript)
- [CVE-2012-1105](https://cve.now/CVE-2012-1105.md): An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. (no CVSS, Jasig Project php-pear-CAS)
- [CVE-2012-1104](https://cve.now/CVE-2012-1104.md): A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of services are managed. (no CVSS, jasig project phpCAS)
- [CVE-2019-5098](https://cve.now/CVE-2019-5098.md): An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. (no CVSS, AMD ATI)
- [CVE-2019-19546](https://cve.now/CVE-2019-19546.md): Norton Password Manager, prior to 6.6.2.5, may be susceptible to an information disclosure issue, which is a type of vulnerability whereby t (no CVSS, Norton Password Manager)
- [CVE-2019-19545](https://cve.now/CVE-2019-19545.md): Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, which is a type of is (no CVSS, Norton Password Manager)
- [CVE-2019-18381](https://cve.now/CVE-2019-18381.md): Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, which is a type of is (no CVSS, Norton Password Manager)
- [CVE-2019-17388](https://cve.now/CVE-2019-17388.md): Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux allow a local attacker t (no CVSS)
- [CVE-2019-17387](https://cve.now/CVE-2019-17387.md): An authentication flaw in the AVPNC\_RP service in Aviatrix VPN Client through 2.2.10 allows an attacker to gain elevated privileges through (no CVSS)
- [CVE-2019-7185](https://cve.now/CVE-2019-7185.md): This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on the administrator’s (no CVSS, QNAP NAS devices running Music Station)
- [CVE-2019-7184](https://cve.now/CVE-2019-7184.md): This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s (no CVSS, QNAP NAS devices running Video Station)
- [CVE-2019-7183](https://cve.now/CVE-2019-7183.md): This improper link resolution vulnerability allows remote attackers to access system files. (no CVSS, QNAP NAS devices)
- [CVE-2019-7195](https://cve.now/CVE-2019-7195.md): This external control of file name or path vulnerability allows remote attackers to access or modify system files. (CVSS 9.8, KEV, QNAP NAS devices running Photo Station)
- [CVE-2019-7194](https://cve.now/CVE-2019-7194.md): This external control of file name or path vulnerability allows remote attackers to access or modify system files. (CVSS 9.8, KEV, QNAP NAS devices running Photo Station)
- [CVE-2019-7193](https://cve.now/CVE-2019-7193.md): This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. (CVSS 9.8, KEV, QNAP NAS devices)
- [CVE-2019-7192](https://cve.now/CVE-2019-7192.md): This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. (CVSS 9.8, KEV, QNAP NAS devices running Photo Station)
- [CVE-2019-19466](https://cve.now/CVE-2019-19466.md): SCEditor 2.1.3 allows XSS. (no CVSS)
- [CVE-2013-0326](https://cve.now/CVE-2013-0326.md): OpenStack nova base images permissions are world readable (no CVSS, openstack-nova)
- [CVE-2019-11255](https://cve.now/CVE-2019-11255.md): Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation (CVSS 4.8, kubernetes-csi external-provisioner · kubernetes-csi ext… +4)
- [CVE-2018-1002102](https://cve.now/CVE-2018-1002102.md): Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints (CVSS 2.6, Kubernetes)
- [CVE-2013-0283](https://cve.now/CVE-2013-0283.md): Katello: Username in Notification page has cross site scripting (no CVSS, Katello)
- [CVE-2019-15897](https://cve.now/CVE-2019-15897.md): beegfs-ctl in ThinkParQ BeeGFS through 7.1.3 allows Authentication Bypass via communication with a BeeGFS metadata server (which is typicall (no CVSS)
- [CVE-2019-3690](https://cve.now/CVE-2019-3690.md): chkstat follows untrusted symbolic links (CVSS 6.8, SUSE permissions)
- [CVE-2019-19007](https://cve.now/CVE-2019-19007.md): Intelbras IWR 3000N 1.8.7 devices allow disclosure of the administrator login name and password because v1/system/user is mishandled, a rela (no CVSS)
- [CVE-2019-19594](https://cve.now/CVE-2019-19594.md): reset/modules/fotoliaFoto/multi\_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allows remote attackers t (no CVSS)
- [CVE-2019-19595](https://cve.now/CVE-2019-19595.md): reset/modules/advanced\_form\_maker\_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote (no CVSS)
- [CVE-2013-0243](https://cve.now/CVE-2013-0243.md): haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections (no CVSS, haskell-tls-extra)
- [CVE-2013-0163](https://cve.now/CVE-2013-0163.md): OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS (no CVSS, OpenShift haproxy cartridge)
- [CVE-2019-18180](https://cve.now/CVE-2019-18180.md): Denial of service (CVSS 5.3)
- [CVE-2019-14910](https://cve.now/CVE-2019-14910.md): A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS fro (CVSS 9.3, Keycloak · org.keycloak:keycloak-parent)
- [CVE-2019-17437](https://cve.now/CVE-2019-17437.md): PAN-OS: Custom-role users may escalate privileges (CVSS 7.8, Palo Alto Networks PAN-OS)
- [CVE-2019-19317](https://cve.now/CVE-2019-19317.md): lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to ca (no CVSS)
- [CVE-2019-19602](https://cve.now/CVE-2019-19602.md): fpregs\_state\_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows context-dependent att (no CVSS)
- [CVE-2019-19601](https://cve.now/CVE-2019-19601.md): OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf. (no CVSS)
- [CVE-2019-19589](https://cve.now/CVE-2019-19589.md): The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives. (CVSS 9.8)
- [CVE-2019-19597](https://cve.now/CVE-2019-19597.md): D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters w (no CVSS)
- [CVE-2019-19598](https://cve.now/CVE-2019-19598.md): D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAP\_AUTH header timesta (no CVSS)
- [CVE-2019-19596](https://cve.now/CVE-2019-19596.md): GitBook through 2.6.9 allows XSS via a local .md file. (no CVSS, gitbook)
- [CVE-2019-19590](https://cve.now/CVE-2019-19590.md): In radare2 through 4.0, there is an integer overflow for the variable new\_token\_size in the function r\_asm\_massemble at libr/asm/asm.c. (no CVSS)
- [CVE-2019-19553](https://cve.now/CVE-2019-19553.md): In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. (no CVSS)
- [CVE-2019-19588](https://cve.now/CVE-2019-19588.md): The validators package 0.12.2 through 0.12.5 for Python enters an infinite loop when validators.domain is called with a crafted domain strin (no CVSS, validators)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.