# CVEs published 2019-12-06

49 CVEs were published on December 6, 2019: 4 critical, 7 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-16772](https://cve.now/CVE-2019-16772.md): regular expressions Cross-Site Scripting (XSS) vulnerability in serialize-to-js (CVSS 3.1, commenthol serialize-to-js · serialize-to-js)
- [CVE-2019-10769](https://cve.now/CVE-2019-10769.md): safer-eval is a npm package to sandbox the he evaluation of code used within the eval function. (no CVSS, safer-eval)
- [CVE-2019-2219](https://cve.now/CVE-2019-2219.md): In several functions of NotificationManagerService.java and related files, there is a possible way to record audio from the background witho (no CVSS, Android)
- [CVE-2019-2221](https://cve.now/CVE-2019-2221.md): In hasActivityInVisibleTask of WindowProcessController.java there’s a possible bypass of user interaction requirements due to incorrect hand (no CVSS, Android)
- [CVE-2019-2222](https://cve.now/CVE-2019-2222.md): n ihevcd\_parse\_slice\_data of ihevcd\_parse\_slice.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-2223](https://cve.now/CVE-2019-2223.md): In ihevcd\_ref\_list of ihevcd\_ref\_list.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-2225](https://cve.now/CVE-2019-2225.md): When pairing with a Bluetooth device, it may be possible to pair a malicious device without any confirmation from the user, and that device (no CVSS, Android)
- [CVE-2019-2226](https://cve.now/CVE-2019-2226.md): In device\_class\_to\_int of device\_class.cc, there is a possible out of bounds read due to improper casting. (no CVSS, Android)
- [CVE-2019-2227](https://cve.now/CVE-2019-2227.md): In DeepCopy of btif\_av.cc, there is a possible out of bounds read due to improper casting. (no CVSS, Android)
- [CVE-2019-2228](https://cve.now/CVE-2019-2228.md): In array\_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2019-2229](https://cve.now/CVE-2019-2229.md): In updateWidget of BaseWidgetProvider.java, there is a possible leak of user data due to a missing permission check. (no CVSS, Android)
- [CVE-2019-2230](https://cve.now/CVE-2019-2230.md): In nfcManager\_routeAid and nfcManager\_unrouteAid of NativeNfcManager.cpp, there is possible memory reuse due to a use after free. (no CVSS, Android)
- [CVE-2019-2231](https://cve.now/CVE-2019-2231.md): In Blob::Blob of blob.cpp, there is a possible unencrypted master key due to improper input validation. (no CVSS, Android)
- [CVE-2019-2217](https://cve.now/CVE-2019-2217.md): In setCpuVulkanInUse of GpuStats.cpp, there is possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2019-2218](https://cve.now/CVE-2019-2218.md): In createSessionInternal of PackageInstallerService.java, there is a possible improper permission grant due to a missing permission check. (no CVSS, Android)
- [CVE-2019-2220](https://cve.now/CVE-2019-2220.md): In checkOperation of AppOpsService.java, there is a possible bypass of user interaction requirements due to mishandling application suspend. (no CVSS, Android)
- [CVE-2019-2232](https://cve.now/CVE-2019-2232.md): In handleRun of TextLine.java, there is a possible application crash due to improper input validation. (no CVSS, Android)
- [CVE-2019-9464](https://cve.now/CVE-2019-9464.md): In various functions of RecentLocationApps.java, DevicePolicyManagerService.java, and RecognitionService.java, there is an incorrect warning (no CVSS, Android)
- [CVE-2019-18575](https://cve.now/CVE-2019-18575.md): Dell Command Configure versions prior to 4.2.1 contain an uncontrolled search path vulnerability. (CVSS 7.1, Dell Command Configure)
- [CVE-2019-11293](https://cve.now/CVE-2019-11293.md): UAA logs all query parameters with debug logging level (CVSS 8.8, Cloud Foundry UAA Release)
- [CVE-2019-16771](https://cve.now/CVE-2019-16771.md): Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria (CVSS 4.8, LINE Armeria · com.linecorp.armeria:armeria)
- [CVE-2019-18672](https://cve.now/CVE-2019-18672.md): Insufficient checks in the finite state machine of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow a partial reset of cry (no CVSS)
- [CVE-2019-18671](https://cve.now/CVE-2019-18671.md): Insufficient checks in the USB packet handling of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow out-of-bounds writes in (no CVSS)
- [CVE-2012-2148](https://cve.now/CVE-2012-2148.md): An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies (no CVSS, jbossas4 AS)
- [CVE-2019-1551](https://cve.now/CVE-2019-1551.md): rsaz\_512\_sqr overflow bug on x86\_64 (no CVSS, OpenSSL)
- [CVE-2012-2130](https://cve.now/CVE-2012-2130.md): A Security Bypass vulnerability exists in PolarSSL 0.99pre4 through 1.1.1 due to a weak encryption error when generating Diffie-Hellman valu (no CVSS, polarssl)
- [CVE-2019-16674](https://cve.now/CVE-2019-16674.md): An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 161 (CVSS 9.8)
- [CVE-2019-16673](https://cve.now/CVE-2019-16673.md): An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 161 (CVSS 7.5)
- [CVE-2019-16672](https://cve.now/CVE-2019-16672.md): An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 161 (CVSS 9.8)
- [CVE-2019-16671](https://cve.now/CVE-2019-16671.md): An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 161 (CVSS 6.5)
- [CVE-2019-16670](https://cve.now/CVE-2019-16670.md): An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 161 (CVSS 9.8)
- [CVE-2018-7282](https://cve.now/CVE-2018-7282.md): The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi. (no CVSS)
- [CVE-2019-12734](https://cve.now/CVE-2019-12734.md): SiteVision 4 has Incorrect Access Control. (no CVSS)
- [CVE-2019-12733](https://cve.now/CVE-2019-12733.md): SiteVision 4 allows Remote Code Execution. (no CVSS)
- [CVE-2012-2092](https://cve.now/CVE-2012-2092.md): A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an error when verifying the (no CVSS, Ubuntu Cobbler)
- [CVE-2019-19620](https://cve.now/CVE-2019-19620.md): In SecureWorks Red Cloak Windows Agent before 2.0.7.9, a local user can bypass the generation of telemetry alerts by removing NT AUTHORITY\\S (no CVSS)
- [CVE-2019-5544](https://cve.now/CVE-2019-5544.md): OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. (CVSS 9.8, KEV, ESXi and Horizon DaaS)
- [CVE-2012-1615](https://cve.now/CVE-2012-1615.md): A Privilege Escalation vulnerability exits in Fedoraproject Sectool due to an incorrect DBus file. (no CVSS, sectool)
- [CVE-2019-19334](https://cve.now/CVE-2019-19334.md): In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of t (CVSS 8.1, Red Hat libyang)
- [CVE-2019-19333](https://cve.now/CVE-2019-19333.md): In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of t (CVSS 8.1, Red Hat libyang)
- [CVE-2019-19625](https://cve.now/CVE-2019-19625.md): SROS 2 0.8.1 (which provides the tools that generate and distribute keys for Robot Operating System 2 and uses the underlying security plugi (CVSS 7.5)
- [CVE-2019-19627](https://cve.now/CVE-2019-19627.md): SROS 2 0.8.1 (after CVE-2019-19625 is mitigated) leaks ROS 2 node-related information regardless of the rtps\_protection\_kind configuration. (CVSS 7.5)
- [CVE-2019-11554](https://cve.now/CVE-2019-11554.md): The Audible application through 2.34.0 for Android has Missing SSL Certificate Validation for Adobe SDKs, allowing MITM attackers to cause a (no CVSS)
- [CVE-2019-19551](https://cve.now/CVE-2019-19551.md): In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. (no CVSS)
- [CVE-2019-19552](https://cve.now/CVE-2019-19552.md): In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/ (no CVSS)
- [CVE-2019-19624](https://cve.now/CVE-2019-19624.md): An out-of-bounds read was discovered in OpenCV before 4.1.1. (no CVSS, opencv-python-headless · opencv-python +2)
- [CVE-2019-19619](https://cve.now/CVE-2019-19619.md): domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. (no CVSS, github.com/documize/community)
- [CVE-2019-19617](https://cve.now/CVE-2019-19617.md): phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/ (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2019-19616](https://cve.now/CVE-2019-19616.md): An Insecure Direct Object Reference (IDOR) vulnerability in the Xtivia Web Time and Expense (WebTE) interface used for Microsoft Dynamics NA (CVSS 4.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.