CVEs published December 12, 2019
123 CVEs were published on December 12, 2019: 4 critical, 5 high.
- Published
- 123
- Critical
- 4
- High
- 5
- Medium
- 5
- Low
- 0
- Unrated
- 109
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Siemens SPPA-T3000 MS3000 Migration Server
- 35
- Siemens SPPA-T3000 Application Server
- 18
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 14
- Siemens Control Center Server
- 5
- Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…
- 3
- Siemens AG EN100 Ethernet module DNP3 variant · Siemens… +3
- 3
- Siemens AG XHQ
- 3
- Apache SpamAssassin
- 2
- W1.f1
- 2
- 3scale
- 1
Critical 4
- CVE-2019-18337A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0).Siemens Control Center Server
- CVE-2019-18339A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0).Siemens SiNVR/SiVMS Video Server
- CVE-2019-18342A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0).Siemens Control Center Server
- CVE-2019-19750minerstat msOS before 2019-10-23 does not have a unique SSH key for each instance of the product.
High 5
- CVE-2019-5062An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 80W1.f1
- CVE-2019-5061An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates fW1.f1
- CVE-2019-5144An exploitable heap underflow vulnerability exists in the derive_taps_and_gains function in kdu_v7ar.dll of Kakadu Software SDK 7.10.2.Kakadu Software
- CVE-2019-18338A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0).Siemens Control Center Server
- CVE-2019-4606IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 could allow a local attacker to execute arbitrary code on the system, caused by an IBM DB2 High Performance Unload load for LUW
Medium, low and unrated 114
- CVE-2019-16774Object injection in cookie driverPHPSocialNetwork phpfastcache · phpfastcache/phpfastcache
- CVE-2019-12420In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources.Apache SpamAssassin
- CVE-2018-11805In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors.Apache SpamAssassin
- CVE-2019-3951Advantech WebAccess before 8.4.3 allows unauthenticated remote attackers to execute arbitrary code or cause a denial of service (memory corrAdvantech WebAccess/SCADA
- CVE-2019-19771The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name.lodahs
- CVE-2019-19767The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and
- CVE-2019-19769In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h
- CVE-2019-19770In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (which is used to remove
- CVE-2019-19768In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to
- CVE-2019-18332A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18333A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18334A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18335A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18340A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), Control Center Server (CCS) (All versions >= V1.Siemens Control Center Server · Siemens SiNVR/SiVMS Video S…
- CVE-2019-18341A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0).Siemens Control Center Server
- CVE-2019-18307A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18308A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18309A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18310A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18311A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18312A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18313A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18314A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18315A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18316A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18317A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18318A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18319A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18320A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18321A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18322A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18323A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18324A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18325A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18326A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18327A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18328A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18329A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18330A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18331A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18283A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18284A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18285A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18286A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18287A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18288A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2).Siemens SPPA-T3000 Application Server
- CVE-2019-18289A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18290A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18291A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18292A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18293A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18294A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18295A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18296A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18297A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18298A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18299A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18300A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18301A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18302A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18303A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18304A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18305A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-18306A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions).Siemens SPPA-T3000 MS3000 Migration Server
- CVE-2019-13930A vulnerability has been identified in XHQ (All versions < V6.0.0.2).Siemens AG XHQ
- CVE-2019-13931A vulnerability has been identified in XHQ (All versions < V6.0.0.2).Siemens AG XHQ
- CVE-2019-13932A vulnerability has been identified in XHQ (All versions < V6.0.0.2).Siemens AG XHQ
- CVE-2019-13942A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versiSiemens AG EN100 Ethernet module DNP3 variant · Siemens… +3
- CVE-2019-13943A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versiSiemens AG EN100 Ethernet module DNP3 variant · Siemens… +3
- CVE-2019-13944A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versiSiemens AG EN100 Ethernet module DNP3 variant · Siemens… +3
- CVE-2019-13947A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0).Siemens Control Center Server
- CVE-2019-19766The Bitwarden server through 1.32.0 has a potentially unwanted KDF.
- CVE-2019-19198The Scoutnet Kalender plugin 1.1.0 for WordPress allows XSS.
- CVE-2019-18345A reflected XSS issue was discovered in DAViCal through 1.1.8.
- CVE-2019-17358Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays
- CVE-2019-19248Electronic Arts Origin through 10.5.x allows Elevation of Privilege (issue 2 of 2).
- CVE-2019-19247Electronic Arts Origin through 10.5.x allows Elevation of Privilege (issue 1 of 2).
- CVE-2019-17428An issue was discovered in Intesync Solismed 3.3sp1.
- CVE-2019-16246Intesync Solismed 3.3sp1 allows Local File Inclusion (LFI), a different vulnerability than CVE-2019-15931.
- CVE-2019-15936Intesync Solismed 3.3sp allows Insecure File Upload.
- CVE-2019-15935Intesync Solismed 3.3sp has XSS.
- CVE-2019-15934Intesync Solismed 3.3sp has CSRF.
- CVE-2019-15933Intesync Solismed 3.3sp has SQL Injection.
- CVE-2019-15932Intesync Solismed 3.3sp has Incorrect Access Control.
- CVE-2019-15931Intesync Solismed 3.3sp allows Directory Traversal, a different vulnerability than CVE-2019-16246.
- CVE-2019-15930Intesync Solismed 3.3sp allows Clickjacking.
- CVE-2019-13927A vulnerability has been identified in Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D with Desigo PX Web moduSiemens AG Desigo PX automation controllers PXC00-E.D, P… +1
- CVE-2019-13945A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl.Siemens AG SIMATIC S7-1200 CPU family · Siemens AG SIMA… +14
- CVE-2019-14849A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session cookie.3scale
- CVE-2019-2337While Skipping unknown IES, EMM is reading the buffer even if the no of bytes to read are more than message length which may cause device toQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2338Crafted image that has a valid signature from a non-QC entity can be loaded which can read/write memory that belongs to the secure world in Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2319HLOS could corrupt CPZ page table memory for S1 managed VMs in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon ConsQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2320Possible out of bounds write in a MT SMS/SS scenario due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2321Incorrect length used while validating the qsee log buffer sent from HLOS which could then lead to remap conflict in Snapdragon Auto, SnapdrQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2288Out of bound write in TZ while copying the secure dump structure on HLOS provided buffer as a part of memory dump in Snapdragon Auto, SnapdrQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-2310Out of bound read would occur while trying to read action category and action ID without validating the action length of the Rx Frame body iQualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…
- CVE-2019-10571Snapshot of IB can lead to invalid address access due to missing check for size in the related function in Snapdragon Auto, Snapdragon CompuQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10592Possible integer overflow while multiplying two integers of 32 bit in QDCM API of get display modes as there is no check on the maximum modeQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10618Driver may access an invalid address while processing IO control due to lack of check of address validation in Snapdragon Connectivity in QCQualcomm Snapdragon Connectivity
- CVE-2019-10555Buffer overflow can occur due to usage of wrong datatype and missing length check before copying into buffer in Snapdragon Auto, Snapdragon Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10559Accessing data buffer beyond the available data while parsing ogg clip can lead to null-pointer dereference and then memory corruption in SnQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10520An unprivileged application can allocate GPU memory by calling memory allocation ioctl function and can exhaust all the memory which resultsQualcomm Snapdragon Mobile, Snapdragon Voice & Music
- CVE-2019-10530Lack of check of data truncation on user supplied data in kernel leads to buffer overflow in Snapdragon Auto, Snapdragon Consumer IOT, SnapdQualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- CVE-2019-10545Null pointer dereference issue in kernel due to missing check related to LLC support in GPU in Snapdragon Auto, Snapdragon Consumer ElectronQualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…
- CVE-2019-10494Race condition between the camera functions due to lack of resource lock which will lead to memory corruption and UAF issue in Snapdragon AuQualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…
- CVE-2019-10511Possibility of memory overflow while decoding GSNDCP compressed mode PDU in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, SnQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10485Infinite loop while decoding compressed data can lead to overrun condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10493Position determination accuracy may be degraded due to wrongly decoded information in Snapdragon Auto, Snapdragon Compute, Snapdragon ConsumQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10484Use after free issue occurs when command destructors access dynamically allocated response buffer which is already deallocated during previoQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-19748The Work Time Calendar app before 4.7.1 for Jira allows XSS.
- CVE-2019-19746make_arrow in arrow.c in Xfig fig2dev 3.2.7b allows a segmentation fault and out-of-bounds write because of an integer overflow via a large
- CVE-2019-19740Octeth Oempro 4.7 and 4.8 allow SQL injection.
- CVE-2017-18640The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.org.yaml:snakeyaml
- CVE-2019-19726OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting