# CVEs published 2019-12-13

59 CVEs were published on December 13, 2019: 0 critical, 3 high. Days are UTC.

- [CVE-2019-5252](https://cve.now/CVE-2019-5252.md): There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). (no CVSS, Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro)
- [CVE-2019-5235](https://cve.now/CVE-2019-5235.md): Some Huawei smart phones have a null pointer dereference vulnerability. (no CVSS, Harry-AL00C, Harry-AL00C-PRELOAD, Harry-AL10B, Harry-LGRP1-…)
- [CVE-2019-5264](https://cve.now/CVE-2019-5264.md): There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxia (no CVSS, Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxi…)
- [CVE-2019-5277](https://cve.now/CVE-2019-5277.md): Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. (no CVSS, CloudUSM-EUA)
- [CVE-2019-5254](https://cve.now/CVE-2019-5254.md): Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS80 (no CVSS, AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700…)
- [CVE-2019-5255](https://cve.now/CVE-2019-5255.md): Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS80 (no CVSS, AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700…)
- [CVE-2019-5256](https://cve.now/CVE-2019-5256.md): Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS80 (no CVSS, AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700…)
- [CVE-2019-5258](https://cve.now/CVE-2019-5258.md): Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS80 (no CVSS, AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700…)
- [CVE-2019-5257](https://cve.now/CVE-2019-5257.md): Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace) have a re (no CVSS, AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700…)
- [CVE-2019-19796](https://cve.now/CVE-2019-19796.md): Yabasic 2.86.2 has a heap-based buffer overflow in myformat in function.c via a crafted BASIC source file. (no CVSS)
- [CVE-2019-19795](https://cve.now/CVE-2019-19795.md): samurai 0.7 has a heap-based buffer overflow in canonpath in util.c via a crafted build file. (no CVSS)
- [CVE-2019-5260](https://cve.now/CVE-2019-5260.md): Huawei smartphones HUAWEI Y9 2019 and Honor View 20 have a denial of service vulnerability. (no CVSS, HUAWEI Y9 2019;Honor View)
- [CVE-2019-19794](https://cve.now/CVE-2019-19794.md): The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math (no CVSS, github.com/miekg/dns)
- [CVE-2019-5278](https://cve.now/CVE-2019-5278.md): There is an out-of-bounds read vulnerability in the Advanced Packages feature of the Gauss100 OLTP database in CampusInsight before V100R019 (no CVSS, CampusInsight)
- [CVE-2019-5253](https://cve.now/CVE-2019-5253.md): E5572-855 with versions earlier than 8.0.1.3(H335SP1C233) has an improper authentication vulnerability. (no CVSS, E5572-855)
- [CVE-2019-16736](https://cve.now/CVE-2019-16736.md): A stack-based buffer overflow in processCommandUploadSnapshot in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 al (no CVSS)
- [CVE-2019-16735](https://cve.now/CVE-2019-16735.md): A stack-based buffer overflow in processCommandUploadLog in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows (no CVSS)
- [CVE-2019-17364](https://cve.now/CVE-2019-17364.md): The processCommandUploadLog() function of libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers t (no CVSS)
- [CVE-2019-16730](https://cve.now/CVE-2019-16730.md): processCommandUpgrade() in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbit (no CVSS)
- [CVE-2019-16733](https://cve.now/CVE-2019-16733.md): processCommandSetUid() in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2019-16737](https://cve.now/CVE-2019-16737.md): The processCommandSetMac() function of libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to e (no CVSS)
- [CVE-2019-16731](https://cve.now/CVE-2019-16731.md): The udpServerSys service in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to initiate firmware upgrades a (no CVSS)
- [CVE-2019-16734](https://cve.now/CVE-2019-16734.md): Use of default credentials for the TELNET server in Petwant PF-103 firmware 4.3.2.50 and Petalk AI 3.2.2.30 allows remote attackers to execu (no CVSS)
- [CVE-2019-16732](https://cve.now/CVE-2019-16732.md): Unencrypted HTTP communications for firmware upgrades in Petalk AI and PF-103 allow man-in-the-middle attackers to run arbitrary code as the (no CVSS)
- [CVE-2019-19774](https://cve.now/CVE-2019-19774.md): An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. (no CVSS)
- [CVE-2019-17123](https://cve.now/CVE-2019-17123.md): The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to /system/ws/v11/ss/email) are mishandled, as (no CVSS)
- [CVE-2019-19793](https://cve.now/CVE-2019-19793.md): In Cyxtera AppGate SDP Client 4.1.x through 4.3.x before 4.3.2 on Windows, a local or remote user from the same domain can gain privileges. (no CVSS)
- [CVE-2019-19790](https://cve.now/CVE-2019-19790.md): Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with extension .BMP, .EXIF, . (no CVSS)
- [CVE-2019-19722](https://cve.now/CVE-2019-19722.md): In Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email when push notifications are used, because o (no CVSS)
- [CVE-2019-14344](https://cve.now/CVE-2019-14344.md): TemaTres 3.0 has reflected XSS via the replace\_string or search\_string parameter to the vocab/admin.php?doAdmin=bulkReplace URI. (no CVSS)
- [CVE-2019-4426](https://cve.now/CVE-2019-4426.md): The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripti (CVSS 5.4, IBM Business Automation Workflow · IBM Case Manager)
- [CVE-2019-19785](https://cve.now/CVE-2019-19785.md): ATasm 1.06 has a stack-based buffer overflow in the to\_comma() function in asm.c via a crafted .m65 file. (no CVSS)
- [CVE-2019-19786](https://cve.now/CVE-2019-19786.md): ATasm 1.06 has a stack-based buffer overflow in the parse\_expr() function in setparse.c via a crafted .m65 file. (no CVSS)
- [CVE-2019-19787](https://cve.now/CVE-2019-19787.md): ATasm 1.06 has a stack-based buffer overflow in the get\_signed\_expression() function in setparse.c via a crafted .m65 file. (no CVSS)
- [CVE-2019-5290](https://cve.now/CVE-2019-5290.md): Huawei S5700 and S6700 have a DoS security vulnerability. (no CVSS, S5700;S6700)
- [CVE-2019-5248](https://cve.now/CVE-2019-5248.md): CloudEngine 12800 has a DoS vulnerability. (no CVSS, CloudEngine)
- [CVE-2019-5291](https://cve.now/CVE-2019-5291.md): Some Huawei products have an insufficient verification of data authenticity vulnerability. (no CVSS, AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;A…)
- [CVE-2019-5251](https://cve.now/CVE-2019-5251.md): There is a path traversal vulnerability in several Huawei smartphones. (no CVSS, Honor V10;P30;Mate 20;Honor 9 Lite;Honor 9i;M6;P30 Pro;Honor)
- [CVE-2019-5250](https://cve.now/CVE-2019-5250.md): Mate 20 Pro smartphones with versions earlier than 9.1.0.135(C00E133R3P1) have an improper authorization vulnerability. (no CVSS, Mate 20 Pro)
- [CVE-2019-19397](https://cve.now/CVE-2019-19397.md): There is a weak algorithm vulnerability in some Huawei products. (no CVSS, S12700;S1700;S2700;S5700;S6700;S7700;S9700)
- [CVE-2019-17599](https://cve.now/CVE-2019-17599.md): The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). (no CVSS)
- [CVE-2014-3495](https://cve.now/CVE-2014-3495.md): duplicity 0.6.24 has improper verification of SSL certificates (no CVSS, duplicity)
- [CVE-2014-2387](https://cve.now/CVE-2014-2387.md): Pen 0.18.0 has Insecure Temporary File Creation vulnerabilities (no CVSS)
- [CVE-2014-1867](https://cve.now/CVE-2014-1867.md): suPHP before 0.7.2 source-highlighting feature allows security bypass which could lead to arbitrary code execution (no CVSS, suphp)
- [CVE-2014-0241](https://cve.now/CVE-2014-0241.md): rubygem-hammer\_cli\_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable (no CVSS, rubygem-hammer\_cli\_foreman)
- [CVE-2014-0212](https://cve.now/CVE-2014-0212.md): qpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all available file descriptors (no CVSS, qpid-cpp)
- [CVE-2014-0197](https://cve.now/CVE-2014-0197.md): CFME: CSRF protection vulnerability via permissive check of the referrer header (no CVSS, CFME)
- [CVE-2014-0175](https://cve.now/CVE-2014-0175.md): mcollective has a default password set at install (no CVSS, mcollective)
- [CVE-2019-19501](https://cve.now/CVE-2019-19501.md): VeraCrypt 1.24 allows Local Privilege Escalation during execution of VeraCryptExpander.exe. (no CVSS)
- [CVE-2019-18838](https://cve.now/CVE-2019-18838.md): An issue was discovered in Envoy 1.12.0. (no CVSS)
- [CVE-2019-18802](https://cve.now/CVE-2019-18802.md): An issue was discovered in Envoy 1.12.0. (no CVSS)
- [CVE-2019-18801](https://cve.now/CVE-2019-18801.md): An issue was discovered in Envoy 1.12.0. (no CVSS)
- [CVE-2019-13347](https://cve.now/CVE-2019-13347.md): An issue was discovered in the SAML Single Sign On (SSO) plugin for several Atlassian products affecting versions 3.1.0 through 3.2.2 for Ji (no CVSS)
- [CVE-2019-19782](https://cve.now/CVE-2019-19782.md): The FTP client in AceaXe Plus 1.0 allows a buffer overflow via a long EHLO response from an FTP server. (no CVSS)
- [CVE-2019-19778](https://cve.now/CVE-2019-19778.md): An issue was discovered in libsixel 1.8.2. (no CVSS)
- [CVE-2019-19777](https://cve.now/CVE-2019-19777.md): stb\_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap-based buffer over-read in stbi\_\_load\_main. (no CVSS)
- [CVE-2019-16777](https://cve.now/CVE-2019-16777.md): Arbitrary File Overwrite in npm CLI (CVSS 7.7, npm cli · npm)
- [CVE-2019-16776](https://cve.now/CVE-2019-16776.md): Unauthorized File Access in npm CLI before before version 6.13.3 (CVSS 7.7, npm cli · npm)
- [CVE-2019-16775](https://cve.now/CVE-2019-16775.md): Unauthorized File Access in npm CLI before before version 6.13.3 (CVSS 7.7, npm cli · npm)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.