# CVEs published 2019-12-10

100 CVEs were published on December 10, 2019: 1 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-19604](https://cve.now/CVE-2019-19604.md): Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x b (no CVSS)
- [CVE-2019-14861](https://cve.now/CVE-2019-14861.md): All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC (CVSS 5.3, Red Hat samba)
- [CVE-2019-1490](https://cve.now/CVE-2019-1490.md): A spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Busi (no CVSS, Microsoft Skype for Business Server 2019 CU2)
- [CVE-2019-1487](https://cve.now/CVE-2019-1487.md): An information disclosure vulnerability in Android Apps using Microsoft Authentication Library (MSAL) 0.3.1-Alpha or later exists under spec (no CVSS, Microsoft Authentication Library (MSAL) for Android)
- [CVE-2019-1488](https://cve.now/CVE-2019-1488.md): A security feature bypass vulnerability exists when Microsoft Defender improperly handles specific buffers, aka 'Microsoft Defender Security (no CVSS, Microsoft Windows)
- [CVE-2019-1489](https://cve.now/CVE-2019-1489.md): An information disclosure vulnerability exists when the Windows Remote Desktop Protocol (RDP) fails to properly handle objects in memory, ak (no CVSS, Microsoft Windows XP Service Pack)
- [CVE-2019-1485](https://cve.now/CVE-2019-1485.md): A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut (no CVSS, Microsoft Internet Explorer)
- [CVE-2019-1486](https://cve.now/CVE-2019-1486.md): A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL (no CVSS, Microsoft Visual Studio)
- [CVE-2019-1481](https://cve.now/CVE-2019-1481.md): An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows Medi (no CVSS, Microsoft Windows)
- [CVE-2019-1483](https://cve.now/CVE-2019-1483.md): An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerab (no CVSS, Microsoft Windows)
- [CVE-2019-1484](https://cve.now/CVE-2019-1484.md): A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code (no CVSS, Microsoft Windows)
- [CVE-2019-1478](https://cve.now/CVE-2019-1478.md): An elevation of privilege vulnerability exists when Windows improperly handles COM object creation, aka 'Windows COM Server Elevation of Pri (no CVSS, Microsoft Windows)
- [CVE-2019-1480](https://cve.now/CVE-2019-1480.md): An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows Medi (no CVSS, Microsoft Windows)
- [CVE-2019-1476](https://cve.now/CVE-2019-1476.md): An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows El (no CVSS, Microsoft Windows)
- [CVE-2019-1477](https://cve.now/CVE-2019-1477.md): An elevation of privilege vulnerability exists when the Windows Printer Service improperly validates file paths while loading printer driver (no CVSS, Microsoft Windows)
- [CVE-2019-1471](https://cve.now/CVE-2019-1471.md): A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated us (no CVSS, Microsoft Windows)
- [CVE-2019-1472](https://cve.now/CVE-2019-1472.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2019-1474](https://cve.now/CVE-2019-1474.md): An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information (no CVSS, Microsoft Windows)
- [CVE-2019-1469](https://cve.now/CVE-2019-1469.md): An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Dis (no CVSS, Microsoft Windows)
- [CVE-2019-1470](https://cve.now/CVE-2019-1470.md): An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an auth (no CVSS, Microsoft Windows)
- [CVE-2019-1467](https://cve.now/CVE-2019-1467.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows (no CVSS, Microsoft Windows Server, · Microsoft Windows)
- [CVE-2019-1468](https://cve.now/CVE-2019-1468.md): A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k (no CVSS, Microsoft Windows)
- [CVE-2019-1464](https://cve.now/CVE-2019-1464.md): An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel In (no CVSS, Microsoft Office · Microsoft Excel)
- [CVE-2019-1465](https://cve.now/CVE-2019-1465.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows (no CVSS, Microsoft Windows)
- [CVE-2019-1466](https://cve.now/CVE-2019-1466.md): An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows (no CVSS, Microsoft Windows)
- [CVE-2019-1462](https://cve.now/CVE-2019-1462.md): A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, (no CVSS, Microsoft Office · Microsoft PowerPoint)
- [CVE-2019-1463](https://cve.now/CVE-2019-1463.md): An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, ak (no CVSS, Microsoft Office)
- [CVE-2019-1458](https://cve.now/CVE-2019-1458.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2019-1461](https://cve.now/CVE-2019-1461.md): A denial of service vulnerability exists in Microsoft Word software when the software fails to properly handle objects in memory, aka 'Micro (no CVSS, Microsoft Office · Microsoft Word)
- [CVE-2019-1332](https://cve.now/CVE-2019-1332.md): A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially (no CVSS, Microsoft SQL Server 2017 Reporting Services · Microsoft… +1)
- [CVE-2019-1400](https://cve.now/CVE-2019-1400.md): An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, ak (no CVSS, Microsoft Office)
- [CVE-2019-1453](https://cve.now/CVE-2019-1453.md): A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends (no CVSS, Microsoft Windows)
- [CVE-2019-13762](https://cve.now/CVE-2019-13762.md): Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded (no CVSS, Google Chrome)
- [CVE-2019-13763](https://cve.now/CVE-2019-13763.md): Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the rendere (no CVSS, Google Chrome)
- [CVE-2019-13764](https://cve.now/CVE-2019-13764.md): Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a c (no CVSS, Google Chrome)
- [CVE-2019-13759](https://cve.now/CVE-2019-13759.md): Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a cra (no CVSS, Google Chrome)
- [CVE-2019-13761](https://cve.now/CVE-2019-13761.md): Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homogra (no CVSS, Google Chrome)
- [CVE-2019-13757](https://cve.now/CVE-2019-13757.md): Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homogra (no CVSS, Google Chrome)
- [CVE-2019-13758](https://cve.now/CVE-2019-13758.md): Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass navigati (no CVSS, Google Chrome)
- [CVE-2019-13755](https://cve.now/CVE-2019-13755.md): Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a c (no CVSS, Google Chrome)
- [CVE-2019-13756](https://cve.now/CVE-2019-13756.md): Incorrect security UI in printing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted (no CVSS, Google Chrome)
- [CVE-2019-13753](https://cve.now/CVE-2019-13753.md): Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information fr (no CVSS, Google Chrome)
- [CVE-2019-13754](https://cve.now/CVE-2019-13754.md): Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrict (no CVSS, Google Chrome)
- [CVE-2019-13750](https://cve.now/CVE-2019-13750.md): Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures (no CVSS, Google Chrome)
- [CVE-2019-13751](https://cve.now/CVE-2019-13751.md): Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information fr (no CVSS, Google Chrome)
- [CVE-2019-13752](https://cve.now/CVE-2019-13752.md): Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information fr (no CVSS, Google Chrome)
- [CVE-2019-13748](https://cve.now/CVE-2019-13748.md): Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sen (no CVSS, Google Chrome)
- [CVE-2019-13749](https://cve.now/CVE-2019-13749.md): Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibo (no CVSS, Google Chrome)
- [CVE-2019-13746](https://cve.now/CVE-2019-13746.md): Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omn (no CVSS, Google Chrome)
- [CVE-2019-13747](https://cve.now/CVE-2019-13747.md): Uninitialized data in rendering in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corr (no CVSS, Google Chrome)
- [CVE-2019-13743](https://cve.now/CVE-2019-13743.md): Incorrect security UI in external protocol handling in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof security UI vi (no CVSS, Google Chrome)
- [CVE-2019-13744](https://cve.now/CVE-2019-13744.md): Insufficient policy enforcement in cookies in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a (no CVSS, Google Chrome)
- [CVE-2019-13745](https://cve.now/CVE-2019-13745.md): Insufficient policy enforcement in audio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a cr (no CVSS, Google Chrome)
- [CVE-2019-13741](https://cve.now/CVE-2019-13741.md): Insufficient validation of untrusted input in Blink in Google Chrome prior to 79.0.3945.79 allowed a local attacker to bypass same origin po (no CVSS, Google Chrome)
- [CVE-2019-13742](https://cve.now/CVE-2019-13742.md): Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibo (no CVSS, Google Chrome)
- [CVE-2019-13739](https://cve.now/CVE-2019-13739.md): Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via I (no CVSS, Google Chrome)
- [CVE-2019-13740](https://cve.now/CVE-2019-13740.md): Incorrect security UI in sharing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted H (no CVSS, Google Chrome)
- [CVE-2019-13737](https://cve.now/CVE-2019-13737.md): Insufficient policy enforcement in autocomplete in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensi (no CVSS, Google Chrome)
- [CVE-2019-13738](https://cve.now/CVE-2019-13738.md): Insufficient policy enforcement in navigation in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass site isolation via (no CVSS, Google Chrome)
- [CVE-2019-13734](https://cve.now/CVE-2019-13734.md): Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2019-13735](https://cve.now/CVE-2019-13735.md): Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a sandbo (no CVSS, Google Chrome)
- [CVE-2019-13736](https://cve.now/CVE-2019-13736.md): Integer overflow in PDFium in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2019-13730](https://cve.now/CVE-2019-13730.md): Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a c (no CVSS, Google Chrome)
- [CVE-2019-13732](https://cve.now/CVE-2019-13732.md): Use-after-free in WebAudio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2019-13728](https://cve.now/CVE-2019-13728.md): Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption vi (no CVSS, Google Chrome)
- [CVE-2019-13729](https://cve.now/CVE-2019-13729.md): Use-after-free in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a c (no CVSS, Google Chrome)
- [CVE-2019-13726](https://cve.now/CVE-2019-13726.md): Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted (no CVSS, Google Chrome)
- [CVE-2019-13727](https://cve.now/CVE-2019-13727.md): Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy (no CVSS, Google Chrome)
- [CVE-2019-13725](https://cve.now/CVE-2019-13725.md): Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML pa (no CVSS, Google Chrome)
- [CVE-2019-17270](https://cve.now/CVE-2019-17270.md): Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/system (no CVSS)
- [CVE-2019-5841](https://cve.now/CVE-2019-5841.md): Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corru (no CVSS, Google Chrome)
- [CVE-2019-5843](https://cve.now/CVE-2019-5843.md): Out of bounds memory access in JavaScript in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to potentially exploit heap corr (no CVSS, Google Chrome)
- [CVE-2019-13672](https://cve.now/CVE-2019-13672.md): Incorrect security UI in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially spoof the contents of the O (no CVSS, Google Chrome)
- [CVE-2019-19703](https://cve.now/CVE-2019-19703.md): In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location. (no CVSS, io.ktor:ktor-client-core)
- [CVE-2019-19702](https://cve.now/CVE-2019-19702.md): The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (no CVSS, modoboa-dmarc)
- [CVE-2012-1577](https://cve.now/CVE-2012-1577.md): lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0. (no CVSS, dietlibc)
- [CVE-2019-6192](https://cve.now/CVE-2019-6192.md): A potential vulnerability has been reported in Lenovo Power Management Driver versions prior to 1.67.17.48 leading to a buffer overflow whic (CVSS 4.4, Lenovo Power Management driver)
- [CVE-2019-6183](https://cve.now/CVE-2019-6183.md): A denial of service vulnerability has been reported in Lenovo Energy Management Driver for Windows 10 versions prior to 15.11.29.7 that coul (no CVSS, Lenovo Energy Management driver)
- [CVE-2013-1689](https://cve.now/CVE-2013-1689.md): Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), related to event handling with frames. (no CVSS, Mozilla Firefox)
- [CVE-2016-1000107](https://cve.now/CVE-2016-1000107.md): inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of u (no CVSS)
- [CVE-2019-4663](https://cve.now/CVE-2019-4663.md): IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. (CVSS 5.4, IBM WebSphere Application Server)
- [CVE-2019-4521](https://cve.now/CVE-2019-4521.md): Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. (CVSS 7.0, IBM Cloud Pak System)
- [CVE-2019-4244](https://cve.now/CVE-2019-4244.md): IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to gain unauthorized information and unrestricted control over Zo (CVSS 9.1, IBM SmartCloud Analytics)
- [CVE-2019-4095](https://cve.now/CVE-2019-4095.md): IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized act (CVSS 5.3, IBM Cloud Pak System)
- [CVE-2016-1000108](https://cve.now/CVE-2016-1000108.md): yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications fr (no CVSS)
- [CVE-2013-4133](https://cve.now/CVE-2013-4133.md): kde-workspace before 4.10.5 has a memory leak in plasma desktop (no CVSS, kde-workspace)
- [CVE-2013-4120](https://cve.now/CVE-2013-4120.md): Katello has a Denial of Service vulnerability in API OAuth authentication (no CVSS, Katello)
- [CVE-2013-2183](https://cve.now/CVE-2013-2183.md): Monkey HTTP Daemon has local security bypass (no CVSS, monkey)
- [CVE-2019-19251](https://cve.now/CVE-2019-19251.md): The Last.fm desktop app (Last.fm Scrobbler) through 2.1.39 on macOS makes HTTP requests that include an API key without the use of SSL/TLS. (no CVSS)
- [CVE-2013-2167](https://cve.now/CVE-2013-2167.md): python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass (no CVSS, python-keystoneclient)
- [CVE-2013-2166](https://cve.now/CVE-2013-2166.md): python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass (no CVSS, python-keystoneclient)
- [CVE-2013-2159](https://cve.now/CVE-2013-2159.md): Monkey HTTP Daemon: broken user name authentication (no CVSS, monkey)
- [CVE-2013-2095](https://cve.now/CVE-2013-2095.md): rubygem-openshift-origin-controller: API can be used to create applications via cartridge\_cache.rb URI.prase() to perform command injection (no CVSS, rubygem-openshift-origin-controller · openshift-origin-cont…)
- [CVE-2013-1793](https://cve.now/CVE-2013-1793.md): openstack-utils openstack-db has insecure password creation (no CVSS, openstack-utils openstack-db program)
- [CVE-2013-0293](https://cve.now/CVE-2013-0293.md): oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation (no CVSS, oVirt Node)
- [CVE-2014-3656](https://cve.now/CVE-2014-3656.md): JBoss KeyCloak: XSS in login-status-iframe.html (no CVSS, JBoss KeyCloak · org.keycloak:keycloak-core)
- [CVE-2019-19698](https://cve.now/CVE-2019-19698.md): marc-q libwav through 2017-04-20 has a NULL pointer dereference in wav\_content\_read() at libwav.c. (no CVSS)
- [CVE-2013-4184](https://cve.now/CVE-2013-4184.md): Perl module Data::UUID from CPAN version 1.219 vulnerable to symlink attacks (no CVSS, libdata-uuid-perl)
- [CVE-2019-14870](https://cve.now/CVE-2019-14870.md): All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delega (CVSS 5.4, Red Hat samba)
- [CVE-2019-14889](https://cve.now/CVE-2019-14889.md): A flaw was found with the libssh API function ssh\_scp\_new() in versions before 0.9.3 and before 0.8.8. (CVSS 7.1, Red Hat libssh)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.