CVEs published December 9, 2019
27 CVEs were published on December 9, 2019: 1 critical, 1 high.
- Published
- 27
- Critical
- 1
- High
- 1
- Medium
- 3
- Low
- 0
- Unrated
- 22
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- IBM Planning Analytics
- 2
- CA Technologies, A Broadcom Company CA Release Automation
- 1
- chrony
- 1
- IBM DataPower Gateway
- 1
- keystone
- 1
- mod_wsgi
- 1
- monopd
- 1
- pyrad
- 1
- Symantec Industrial Control System Protection
- 1
- Trend Micro Security
- 1
Critical 1
High 1
Medium, low and unrated 25
- CVE-2019-4612IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal.IBM Planning Analytics
- CVE-2019-4611IBM Planning Analytics 2.0 is vulnerable to cross-site scripting.IBM Planning Analytics
- CVE-2019-4428IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting.Watson Assistant for IBM Cloud Pak for Data
- CVE-2013-0342The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packepyrad
- CVE-2014-0242mod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Contmod_wsgi
- CVE-2015-7892Stack-based buffer overflow in the m2m1shot_compat_ioctl32 function in the Samsung m2m1shot driver framework, as used in Samsung S6 Edge, al
- CVE-2015-3424SQL injection vulnerability in Accentis Content Resource Management System before the October 2015 patch allows remote attackers to execute
- CVE-2015-3425Cross-site scripting (XSS) vulnerability in Accentis Content Resource Management System before October 2015 patch allows remote attackers to
- CVE-2015-1853chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers wichrony
- CVE-2019-18190Trend Micro Security (Consumer) 2020 (v16.x) is affected by a vulnerability in where null pointer dereference errors result in the crash of Trend Micro Security
- CVE-2015-0841Off-by-one error in the readBuf function in listener.cpp in libcapsinetwork and monopd before 0.9.8, allows remote attackers to cause a denimonopd
- CVE-2019-19603SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.
- CVE-2019-19646pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.
- CVE-2019-18380Symantec Industrial Control System Protection (ICSP), versions 6.x.x, may be susceptible to an unauthorized access issue that could potentiaSymantec Industrial Control System Protection
- CVE-2019-19687OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API.keystone
- CVE-2019-19682nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.
- CVE-2019-19684nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin
- CVE-2019-19685RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can be used for renames and deletions.
- CVE-2019-19683RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/ProcessRequest because
- CVE-2019-14251An issue was discovered in T24 in TEMENOS Channels R15.01.
- CVE-2019-19678In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the generic field entry point via
- CVE-2019-19679In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the Pre-Condition Summary entry p
- CVE-2019-19645alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction w
- CVE-2019-19648In the macho_parse_file functionality in macho/macho.c of YARA 3.11.0, command_size may be inconsistent with the real size.
- CVE-2019-19647radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to