CVEs published December 10, 2019
100 CVEs were published on December 10, 2019: 1 critical, 3 high. 1 is now in CISA KEV.
- Published
- 100
- Critical
- 1
- High
- 3
- Medium
- 5
- Low
- 0
- Unrated
- 91
- Now in CISA KEV
- 1
- Fix available
- 49
Most affected products
- Google Chrome
- 40
- Microsoft Windows
- 18
- IBM Cloud Pak System
- 2
- Microsoft Office
- 2
- monkey
- 2
- python-keystoneclient
- 2
- Red Hat samba
- 2
- dietlibc
- 1
- IBM SmartCloud Analytics
- 1
- IBM WebSphere Application Server
- 1
Critical 1
High 3
- CVE-2019-1458An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-4521Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection.IBM Cloud Pak System
- CVE-2019-14889A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8.Red Hat libssh
Medium, low and unrated 96
- CVE-2019-19604Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x b
- CVE-2019-14861All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPCRed Hat samba
- CVE-2019-1490A spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for BusiMicrosoft Skype for Business Server 2019 CU2
- CVE-2019-1487An information disclosure vulnerability in Android Apps using Microsoft Authentication Library (MSAL) 0.3.1-Alpha or later exists under specMicrosoft Authentication Library (MSAL) for Android
- CVE-2019-1488A security feature bypass vulnerability exists when Microsoft Defender improperly handles specific buffers, aka 'Microsoft Defender SecurityMicrosoft Windows
- CVE-2019-1489An information disclosure vulnerability exists when the Windows Remote Desktop Protocol (RDP) fails to properly handle objects in memory, akMicrosoft Windows XP Service Pack
- CVE-2019-1485A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code ExecutMicrosoft Internet Explorer
- CVE-2019-1486A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URLMicrosoft Visual Studio
- CVE-2019-1481An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows MediMicrosoft Windows
- CVE-2019-1483An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerabMicrosoft Windows
- CVE-2019-1484A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Microsoft Windows
- CVE-2019-1478An elevation of privilege vulnerability exists when Windows improperly handles COM object creation, aka 'Windows COM Server Elevation of PriMicrosoft Windows
- CVE-2019-1480An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows MediMicrosoft Windows
- CVE-2019-1476An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows ElMicrosoft Windows
- CVE-2019-1477An elevation of privilege vulnerability exists when the Windows Printer Service improperly validates file paths while loading printer driverMicrosoft Windows
- CVE-2019-1471A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated usMicrosoft Windows
- CVE-2019-1472An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationMicrosoft Windows
- CVE-2019-1474An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel InformationMicrosoft Windows
- CVE-2019-1469An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information DisMicrosoft Windows
- CVE-2019-1470An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authMicrosoft Windows
- CVE-2019-1467An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows Server, · Microsoft Windows
- CVE-2019-1468A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k Microsoft Windows
- CVE-2019-1464An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel InMicrosoft Office · Microsoft Excel
- CVE-2019-1465An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-1466An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows Microsoft Windows
- CVE-2019-1462A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, Microsoft Office · Microsoft PowerPoint
- CVE-2019-1463An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, akMicrosoft Office
- CVE-2019-1461A denial of service vulnerability exists in Microsoft Word software when the software fails to properly handle objects in memory, aka 'MicroMicrosoft Office · Microsoft Word
- CVE-2019-1332A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a speciallyMicrosoft SQL Server 2017 Reporting Services · Microsoft… +1
- CVE-2019-1400An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, akMicrosoft Office
- CVE-2019-1453A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sendsMicrosoft Windows
- CVE-2019-13762Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded Google Chrome
- CVE-2019-13763Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the rendereGoogle Chrome
- CVE-2019-13764Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2019-13759Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a craGoogle Chrome
- CVE-2019-13761Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homograGoogle Chrome
- CVE-2019-13757Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homograGoogle Chrome
- CVE-2019-13758Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass navigatiGoogle Chrome
- CVE-2019-13755Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a cGoogle Chrome
- CVE-2019-13756Incorrect security UI in printing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted Google Chrome
- CVE-2019-13753Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information frGoogle Chrome
- CVE-2019-13754Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictGoogle Chrome
- CVE-2019-13750Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures Google Chrome
- CVE-2019-13751Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information frGoogle Chrome
- CVE-2019-13752Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information frGoogle Chrome
- CVE-2019-13748Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially senGoogle Chrome
- CVE-2019-13749Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the OmniboGoogle Chrome
- CVE-2019-13746Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the OmnGoogle Chrome
- CVE-2019-13747Uninitialized data in rendering in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corrGoogle Chrome
- CVE-2019-13743Incorrect security UI in external protocol handling in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof security UI viGoogle Chrome
- CVE-2019-13744Insufficient policy enforcement in cookies in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a Google Chrome
- CVE-2019-13745Insufficient policy enforcement in audio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crGoogle Chrome
- CVE-2019-13741Insufficient validation of untrusted input in Blink in Google Chrome prior to 79.0.3945.79 allowed a local attacker to bypass same origin poGoogle Chrome
- CVE-2019-13742Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the OmniboGoogle Chrome
- CVE-2019-13739Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IGoogle Chrome
- CVE-2019-13740Incorrect security UI in sharing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HGoogle Chrome
- CVE-2019-13737Insufficient policy enforcement in autocomplete in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensiGoogle Chrome
- CVE-2019-13738Insufficient policy enforcement in navigation in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass site isolation via Google Chrome
- CVE-2019-13734Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2019-13735Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a sandboGoogle Chrome
- CVE-2019-13736Integer overflow in PDFium in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2019-13730Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2019-13732Use-after-free in WebAudio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2019-13728Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption viGoogle Chrome
- CVE-2019-13729Use-after-free in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2019-13726Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a craftedGoogle Chrome
- CVE-2019-13727Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy Google Chrome
- CVE-2019-13725Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML paGoogle Chrome
- CVE-2019-17270Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/system
- CVE-2019-5841Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruGoogle Chrome
- CVE-2019-5843Out of bounds memory access in JavaScript in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corrGoogle Chrome
- CVE-2019-13672Incorrect security UI in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially spoof the contents of the OGoogle Chrome
- CVE-2019-19703In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.io.ktor:ktor-client-core
- CVE-2019-19702The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.modoboa-dmarc
- CVE-2012-1577lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0.dietlibc
- CVE-2019-6192A potential vulnerability has been reported in Lenovo Power Management Driver versions prior to 1.67.17.48 leading to a buffer overflow whicLenovo Power Management driver
- CVE-2019-6183A denial of service vulnerability has been reported in Lenovo Energy Management Driver for Windows 10 versions prior to 15.11.29.7 that coulLenovo Energy Management driver
- CVE-2013-1689Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), related to event handling with frames.Mozilla Firefox
- CVE-2016-1000107inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of u
- CVE-2019-4663IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting.IBM WebSphere Application Server
- CVE-2019-4095IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actIBM Cloud Pak System
- CVE-2016-1000108yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications fr
- CVE-2013-4133kde-workspace before 4.10.5 has a memory leak in plasma desktopkde-workspace
- CVE-2013-4120Katello has a Denial of Service vulnerability in API OAuth authenticationKatello
- CVE-2013-2183Monkey HTTP Daemon has local security bypassmonkey
- CVE-2019-19251The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS.
- CVE-2013-2167python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypasspython-keystoneclient
- CVE-2013-2166python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypasspython-keystoneclient
- CVE-2013-2159Monkey HTTP Daemon: broken user name authenticationmonkey
- CVE-2013-2095rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injectionrubygem-openshift-origin-controller · openshift-origin-cont…
- CVE-2013-1793openstack-utils openstack-db has insecure password creationopenstack-utils openstack-db program
- CVE-2013-0293oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalationoVirt Node
- CVE-2014-3656JBoss KeyCloak: XSS in login-status-iframe.htmlJBoss KeyCloak · org.keycloak:keycloak-core
- CVE-2019-19698marc-q libwav through 2017-04-20 has a NULL pointer dereference in wav_content_read() at libwav.c.
- CVE-2013-4184Perl module Data::UUID from CPAN version 1.219 vulnerable to symlink attackslibdata-uuid-perl
- CVE-2019-14870All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegaRed Hat samba