# CVEs published 2019-12-09

27 CVEs were published on December 9, 2019: 1 critical, 1 high. Days are UTC.

- [CVE-2019-4621](https://cve.now/CVE-2019-4621.md): IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the (CVSS 8.1, IBM DataPower Gateway)
- [CVE-2019-4612](https://cve.now/CVE-2019-4612.md): IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. (CVSS 6.3, IBM Planning Analytics)
- [CVE-2019-4611](https://cve.now/CVE-2019-4611.md): IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Planning Analytics)
- [CVE-2019-4428](https://cve.now/CVE-2019-4428.md): IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. (CVSS 5.4, Watson Assistant for IBM Cloud Pak for Data)
- [CVE-2013-0342](https://cve.now/CVE-2013-0342.md): The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packe (no CVSS, pyrad)
- [CVE-2019-19230](https://cve.now/CVE-2019-19230.md): An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component that can allow a remot (CVSS 9.8, CA Technologies, A Broadcom Company CA Release Automation)
- [CVE-2014-0242](https://cve.now/CVE-2014-0242.md): mod\_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Cont (no CVSS, mod\_wsgi)
- [CVE-2015-7892](https://cve.now/CVE-2015-7892.md): Stack-based buffer overflow in the m2m1shot\_compat\_ioctl32 function in the Samsung m2m1shot driver framework, as used in Samsung S6 Edge, al (no CVSS)
- [CVE-2015-3424](https://cve.now/CVE-2015-3424.md): SQL injection vulnerability in Accentis Content Resource Management System before the October 2015 patch allows remote attackers to execute (no CVSS)
- [CVE-2015-3425](https://cve.now/CVE-2015-3425.md): Cross-site scripting (XSS) vulnerability in Accentis Content Resource Management System before October 2015 patch allows remote attackers to (no CVSS)
- [CVE-2015-1853](https://cve.now/CVE-2015-1853.md): chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers wi (no CVSS, chrony)
- [CVE-2019-18190](https://cve.now/CVE-2019-18190.md): Trend Micro Security (Consumer) 2020 (v16.x) is affected by a vulnerability in where null pointer dereference errors result in the crash of (no CVSS, Trend Micro Security)
- [CVE-2015-0841](https://cve.now/CVE-2015-0841.md): Off-by-one error in the readBuf function in listener.cpp in libcapsinetwork and monopd before 0.9.8, allows remote attackers to cause a deni (no CVSS, monopd)
- [CVE-2019-19603](https://cve.now/CVE-2019-19603.md): SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash. (no CVSS)
- [CVE-2019-19646](https://cve.now/CVE-2019-19646.md): pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity\_check PRAGMA command in certain cases of generated columns. (no CVSS)
- [CVE-2019-18380](https://cve.now/CVE-2019-18380.md): Symantec Industrial Control System Protection (ICSP), versions 6.x.x, may be susceptible to an unauthorized access issue that could potentia (no CVSS, Symantec Industrial Control System Protection)
- [CVE-2019-19687](https://cve.now/CVE-2019-19687.md): OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. (no CVSS, keystone)
- [CVE-2019-19682](https://cve.now/CVE-2019-19682.md): nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \\Presentation\\Nop.Web\\Areas\\Admin\\Controllers\\NewsController. (no CVSS)
- [CVE-2019-19684](https://cve.now/CVE-2019-19684.md): nopCommerce v4.2.0 allows privilege escalation via file upload in Presentation/Nop.Web/Admin/Areas/Controllers/PluginController.cs via Admin (no CVSS)
- [CVE-2019-19685](https://cve.now/CVE-2019-19685.md): RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to CSRF because GET requests can be used for renames and deletions. (no CVSS)
- [CVE-2019-19683](https://cve.now/CVE-2019-19683.md): RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/ProcessRequest because (no CVSS)
- [CVE-2019-14251](https://cve.now/CVE-2019-14251.md): An issue was discovered in T24 in TEMENOS Channels R15.01. (no CVSS)
- [CVE-2019-19678](https://cve.now/CVE-2019-19678.md): In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the generic field entry point via (no CVSS)
- [CVE-2019-19679](https://cve.now/CVE-2019-19679.md): In "Xray Test Management for Jira" prior to version 3.5.5, remote authenticated attackers can cause XSS in the Pre-Condition Summary entry p (no CVSS)
- [CVE-2019-19645](https://cve.now/CVE-2019-19645.md): alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction w (no CVSS)
- [CVE-2019-19648](https://cve.now/CVE-2019-19648.md): In the macho\_parse\_file functionality in macho/macho.c of YARA 3.11.0, command\_size may be inconsistent with the real size. (no CVSS)
- [CVE-2019-19647](https://cve.now/CVE-2019-19647.md): radare2 through 4.0.0 lacks validation of the content variable in the function r\_asm\_pseudo\_incbin at libr/asm/asm.c, ultimately leading to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.