CVEs published December 6, 2019
49 CVEs were published on December 6, 2019: 4 critical, 7 high. 1 is now in CISA KEV.
- Published
- 49
- Critical
- 4
- High
- 7
- Medium
- 3
- Low
- 1
- Unrated
- 34
- Now in CISA KEV
- 1
- Fix available
- 7
Most affected products
- Android
- 16
- Red Hat libyang
- 2
- Cloud Foundry UAA Release
- 1
- commenthol serialize-to-js · serialize-to-js
- 1
- Dell Command Configure
- 1
- ESXi and Horizon DaaS
- 1
- github.com/documize/community
- 1
- jbossas4 AS
- 1
- LINE Armeria · com.linecorp.armeria:armeria
- 1
- opencv-python-headless · opencv-python +2
- 1
Critical 4
- CVE-2019-16674An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 161
- CVE-2019-16672An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 161
- CVE-2019-16670An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 161
- CVE-2019-5544OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue.ESXi and Horizon DaaS
High 7
- CVE-2019-18575Dell Command Configure versions prior to 4.2.1 contain an uncontrolled search path vulnerability.Dell Command Configure
- CVE-2019-11293UAA logs all query parameters with debug logging levelCloud Foundry UAA Release
- CVE-2019-16673An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 161
- CVE-2019-19334In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of tRed Hat libyang
- CVE-2019-19333In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of tRed Hat libyang
- CVE-2019-19625SROS 2 0.8.1 (which provides the tools that generate and distribute keys for Robot Operating System 2 and uses the underlying security plugi
- CVE-2019-19627SROS 2 0.8.1 (after CVE-2019-19625 is mitigated) leaks ROS 2 node-related information regardless of the rtps_protection_kind configuration.
Medium, low and unrated 38
- CVE-2019-16772regular expressions Cross-Site Scripting (XSS) vulnerability in serialize-to-jscommenthol serialize-to-js · serialize-to-js
- CVE-2019-10769safer-eval is a npm package to sandbox the he evaluation of code used within the eval function.safer-eval
- CVE-2019-2219In several functions of NotificationManagerService.java and related files, there is a possible way to record audio from the background withoAndroid
- CVE-2019-2221In hasActivityInVisibleTask of WindowProcessController.java there’s a possible bypass of user interaction requirements due to incorrect handAndroid
- CVE-2019-2222n ihevcd_parse_slice_data of ihevcd_parse_slice.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2019-2223In ihevcd_ref_list of ihevcd_ref_list.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2019-2225When pairing with a Bluetooth device, it may be possible to pair a malicious device without any confirmation from the user, and that device Android
- CVE-2019-2226In device_class_to_int of device_class.cc, there is a possible out of bounds read due to improper casting.Android
- CVE-2019-2227In DeepCopy of btif_av.cc, there is a possible out of bounds read due to improper casting.Android
- CVE-2019-2228In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check.Android
- CVE-2019-2229In updateWidget of BaseWidgetProvider.java, there is a possible leak of user data due to a missing permission check.Android
- CVE-2019-2230In nfcManager_routeAid and nfcManager_unrouteAid of NativeNfcManager.cpp, there is possible memory reuse due to a use after free.Android
- CVE-2019-2231In Blob::Blob of blob.cpp, there is a possible unencrypted master key due to improper input validation.Android
- CVE-2019-2217In setCpuVulkanInUse of GpuStats.cpp, there is possible memory corruption due to a use after free.Android
- CVE-2019-2218In createSessionInternal of PackageInstallerService.java, there is a possible improper permission grant due to a missing permission check.Android
- CVE-2019-2220In checkOperation of AppOpsService.java, there is a possible bypass of user interaction requirements due to mishandling application suspend.Android
- CVE-2019-2232In handleRun of TextLine.java, there is a possible application crash due to improper input validation.Android
- CVE-2019-9464In various functions of RecentLocationApps.java, DevicePolicyManagerService.java, and RecognitionService.java, there is an incorrect warningAndroid
- CVE-2019-16771Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in ArmeriaLINE Armeria · com.linecorp.armeria:armeria
- CVE-2019-18672Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cry
- CVE-2019-18671Insufficient checks in the USB packet handling of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow out-of-bounds writes in
- CVE-2012-2148An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policiesjbossas4 AS
- CVE-2019-1551rsaz_512_sqr overflow bug on x86_64OpenSSL
- CVE-2012-2130A Security Bypass vulnerability exists in PolarSSL 0.99pre4 through 1.1.1 due to a weak encryption error when generating Diffie-Hellman valupolarssl
- CVE-2019-16671An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 161
- CVE-2018-7282The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi.
- CVE-2019-12734SiteVision 4 has Incorrect Access Control.
- CVE-2019-12733SiteVision 4 allows Remote Code Execution.
- CVE-2012-2092A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an error when verifying theUbuntu Cobbler
- CVE-2019-19620In SecureWorks Red Cloak Windows Agent before 2.0.7.9, a local user can bypass the generation of telemetry alerts by removing NT AUTHORITY\S
- CVE-2012-1615A Privilege Escalation vulnerability exits in Fedoraproject Sectool due to an incorrect DBus file.sectool
- CVE-2019-11554The Audible application through 2.34.0 for Android has Missing SSL Certificate Validation for Adobe SDKs, allowing MITM attackers to cause a
- CVE-2019-19551In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site.
- CVE-2019-19552In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/
- CVE-2019-19624An out-of-bounds read was discovered in OpenCV before 4.1.1.opencv-python-headless · opencv-python +2
- CVE-2019-19619domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content.github.com/documize/community
- CVE-2019-19617phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/phpmyadmin/phpmyadmin
- CVE-2019-19616An Insecure Direct Object Reference (IDOR) vulnerability in the Xtivia Web Time and Expense (WebTE) interface used for Microsoft Dynamics NA