CVEs published December 11, 2019
73 CVEs were published on December 11, 2019: 3 critical, 6 high. 1 is now in CISA KEV.
- Published
- 73
- Critical
- 3
- High
- 6
- Medium
- 3
- Low
- 0
- Unrated
- 61
- Now in CISA KEV
- 1
- Fix available
- 11
Most affected products
- Amazon's Blink XT2 Sync Module
- 6
- LEADTOOLS libltdic.so
- 4
- Atlassian Crucible · Atlassian Fisheye
- 3
- SAP SE SAP Enable Now
- 3
- Symantec Messaging Gateway
- 3
- IBM Spectrum Scale
- 2
- LEADTOOLS
- 2
- SAP SE SAP BusinessObjects Business Intelligence Platform
- 2
- Avaya IP Office Application Server
- 1
- bson-objectid
- 1
Critical 3
- CVE-2019-5085An exploitable code execution vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so, version 20.0.2019.3.1LEADTOOLS libltdic.so
- CVE-2019-5090An exploitable information disclosure vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so, version 20.0.LEADTOOLS libltdic.so
- CVE-2019-18935Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function.
High 6
- CVE-2019-5092An exploitable heap out of bounds write vulnerability exists in the UI tag parsing functionality of the DICOM image format of LEADTOOLS 20.0LEADTOOLS
- CVE-2019-5154An exploitable heap overflow vulnerability exists in the JPEG2000 parsing functionality of LEADTOOLS 20.0.2019.3.15.LEADTOOLS
- CVE-2019-5091An exploitable denial-of-service vulnerability exists in the Dicom-packet parsing functionality of LEADTOOLS libltdic.so version 20.0.2019.3LEADTOOLS libltdic.so
- CVE-2019-5093An exploitable code execution vulnerability exists in the DICOM network response functionality of LEADTOOLS libltdic.so version 20.0.2019.3.LEADTOOLS libltdic.so
- CVE-2019-14899A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent userRed Hat VPN
- CVE-2019-4715IBM Spectrum Scale 4.2 and 5.0 could allow a remote authenticated attacker to execute arbitrary commands on the system.IBM Spectrum Scale
Medium, low and unrated 64
- CVE-2019-7004Avaya IP Office XSS VulnerabilityAvaya IP Office Application Server
- CVE-2019-10695When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user’s username and password Continuous Delivery for Puppet Enterprise
- CVE-2019-10694The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admiPuppet Enterprise
- CVE-2019-3983Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary code and commands on the device due to insufficAmazon's Blink XT2 Sync Module
- CVE-2019-3985Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitiAmazon's Blink XT2 Sync Module
- CVE-2019-3986Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitiAmazon's Blink XT2 Sync Module
- CVE-2019-3987Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitiAmazon's Blink XT2 Sync Module
- CVE-2019-3988Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitiAmazon's Blink XT2 Sync Module
- CVE-2019-3989Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitiAmazon's Blink XT2 Sync Module
- CVE-2019-18232SafeNet Sentinel LDK License Manager, all versions prior to 7.101(only Microsoft Windows versions are affected) is vulnerable when configureSafeNet Sentinel LDK License Manager Runtime
- CVE-2019-18245Reliable Controls LicenseManager versions 3.4 and prior may allow an authenticated user to insert malicious code into the system root path, Reliable Controls LicenseManager
- CVE-2019-17087Unauthorized file download vulnerability in all supported versions of Micro Focus AcuToWeb.Micro Focus International AcuToWeb
- CVE-2019-0405SAP Enable Now, before version 1911, leaks information about the existence of a particular user which can be used to construct a list of useSAP SE SAP Enable Now
- CVE-2019-0404SAP Enable Now, before version 1911, leaks information about network configuration in the server error messages, leading to Information DiscSAP SE SAP Enable Now
- CVE-2019-0403SAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files, which will be executed when opened, leading toSAP SE SAP Enable Now
- CVE-2019-0402SAP Adaptive Server Enterprise, before versions 15.7 and 16.0, under certain conditions exposes some sensitive information to the admin, leaSAP SE SAP Adaptive Server Enterprise
- CVE-2019-0399SAP Portfolio and Project Management, before versions S4CORE 102, 103, EPPM 100 and CPRXRPM 500_702, 600_740, 610_740; unintentionally allowSAP SE SAP Portfolio and Project Management
- CVE-2019-0398Due to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform (Monitoring Application), before versions 4.1, 4.2 aSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2019-0395SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2, allows execution of JavaScript in a text moduleSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2019-19729An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js.bson-objectid
- CVE-2019-19374An issue was discovered in core/assets/form/form_question_types/form_question_type_file_upload/form_question_type_file_upload.inc in Squiz M
- CVE-2019-19373An issue was discovered in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2 prior to 5.5.2.4, and 5.5.3 prior to 5.5.3
- CVE-2013-5743Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7.
- CVE-2013-5978Multiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote att
- CVE-2014-7257SQL injection vulnerability in DBD::PgPP 0.05 and earlierDBD::PgPP
- CVE-2013-4303includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 doesWikimedia Foundation MediaWiki
- CVE-2013-3691AirLive POE-2600HD allows remote attackers to cause a denial of service (device reset) via a long URL.
- CVE-2013-3542Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly ot
- CVE-2019-19649Zoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection via the SyncEventServlet eventid parameter
- CVE-2013-4968Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors related to the console, a
- CVE-2019-19650Zoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection via the Agent servlet agentid parameter to t
- CVE-2019-14317wolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) generate biased DSA nonces.
- CVE-2019-19577An issue was discovered in Xen through 4.12.x allowing x86 AMD HVM guest OS users to cause a denial of service or possibly gain privileges b
- CVE-2019-19578An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via degenerate chains of linear pa
- CVE-2019-19580An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pag
- CVE-2019-19581An issue was discovered in Xen through 4.12.x allowing 32-bit Arm guest OS users to cause a denial of service (out-of-bounds access) because
- CVE-2019-19582An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service (infinite loop) because certain bit i
- CVE-2019-19583An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service (guest OS crash) because VMX
- CVE-2019-18379Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a server-side request forgery (SSRF) exploit, which is a type of issue thSymantec Messaging Gateway
- CVE-2019-18378Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can eSymantec Messaging Gateway
- CVE-2019-18377Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby anSymantec Messaging Gateway
- CVE-2014-0163Openshift has shell command injection flaws due to unsanitized data being passed into shell commands.Openshift
- CVE-2019-10772It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by enshrined/svg-sanitize
- CVE-2019-15009The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove anotheAtlassian Crucible · Atlassian Fisheye
- CVE-2019-15008The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrarAtlassian Crucible · Atlassian Fisheye
- CVE-2019-15007The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript viAtlassian Crucible · Atlassian Fisheye
- CVE-2019-4665IBM Spectrum Scale 4.2 and 5.0 is vulnerable to cross-site scripting.IBM Spectrum Scale
- CVE-2014-0091Foreman has improper input validation which could lead to partial Denial of ServiceForeman
- CVE-2014-0026katello-headpin is vulnerable to CSRF in REST APIkatello-headpin
- CVE-2013-7371node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370node-connect · connect
- CVE-2013-7370node-connect before 2.8.1 has XSS in the Sencha Labs Connect middlewareconnect
- CVE-2013-6495JBossWeb Bayeux has reflected XSSJBossWeb Bayeux
- CVE-2013-4593RubyGem omniauth-facebook has an access token security vulnerabilityomniauth-facebook
- CVE-2013-4245Orca has arbitrary code execution due to insecure Python module loadOrca
- CVE-2013-4158smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)smokeping
- CVE-2019-18960Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0.
- CVE-2019-3667DLL Search Order HijackingMcAfee TechCheck
- CVE-2019-19720Yabasic 2.86.1 has a heap-based buffer overflow in the yylex() function in flex.c via a crafted BASIC source file.
- CVE-2019-19719Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.
- CVE-2019-19708The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attri
- CVE-2019-19709MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishimediawiki/core
- CVE-2019-19707On Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices (with firmware through 6.0), denial of service can occur via PROFINET DCE-RPC endpoint d
- CVE-2019-5815Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via Google Chrome · nokogiri
- CVE-2019-19725sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.