CVEs published December 16, 2019
48 CVEs were published on December 16, 2019: 0 critical, 5 high.
- Published
- 48
- Critical
- 0
- High
- 5
- Medium
- 3
- Low
- 1
- Unrated
- 39
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Intel(R) NUC
- 5
- Apache Incubator Superset · apache-superset
- 2
- Intel® Quartus® Prime Pro Edition
- 2
- Omron PLC CJ and CS Series
- 2
- AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;A…
- 1
- Control Center-I
- 1
- CZ.NIC knot-resolver
- 1
- Dell CPG BIOS
- 1
- excon
- 1
- IBM API Connect
- 1
High 5
- CVE-2019-19826The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/views_handler_filter_dynamic_
- CVE-2019-18579Settings for the Dell XPS 13 2-in-1 (7390) BIOS versions prior to 1.1.3 contain a configuration vulnerability.Dell CPG BIOS
- CVE-2019-13533In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between the PLC and the contrOmron PLC CJ and CS Series
- CVE-2019-18269Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability.Omron PLC CJ Series · Omron PLC CS series +1
- CVE-2019-19331knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization.CZ.NIC knot-resolver
Medium, low and unrated 43
- CVE-2019-12413In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specApache Incubator Superset · apache-superset
- CVE-2019-12414In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLabApache Incubator Superset · apache-superset
- CVE-2019-5259There is an information leakage vulnerability on some Huawei products(AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;AR2200;AR220AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;A…
- CVE-2018-11751Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL.Puppet Agent, Puppet
- CVE-2019-18191A privilege escalation vulnerability in the Trend Micro Deep Security as a Service Quick Setup cloud formation template could allow an autheTrend Micro Deep Security as a Service
- CVE-2019-13182A stored cross-site scripting (XSS) vulnerability exists in the web UI of SolarWinds Serv-U FTP Server 15.1.7.
- CVE-2019-13181A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7.
- CVE-2019-16778Heap buffer overflow in `UnsortedSegmentSum` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2019-19817The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x2e8a Out-
- CVE-2019-19819The JBIG2Globals library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x90ec NUL
- CVE-2019-19820An invalid pointer vulnerability in IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve
- CVE-2019-19818The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0xa08a Out-
- CVE-2019-16779In RubyGem excon, interrupted Persistent Connections May Leak Response Dataexcon
- CVE-2019-10773In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using speciaYarn
- CVE-2019-18261In Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series, all versions, the software does not implemOmron PLC CJ, CS and NJ Series
- CVE-2019-18259In Omron PLC CJ series, all versions and Omron PLC CS series, all versions, an attacker could spoof arbitrary messages or execute commands.Omron PLC CJ and CS Series
- CVE-2019-0134Improper permissions in the Intel(R) Dynamic Platform and Thermal Framework v8.3.10208.5643 and before may allow an authenticated user to poIntel(R) Dynamic Platform and Thermal Framework
- CVE-2019-0159Insufficient memory protection in the Linux Administrative Tools for Intel(R) Network Adapters before version 24.3 may allow an authenticateLinux Administrative Tools for Intel(R) Network Adapters
- CVE-2019-11096Insufficient memory protection for Intel(R) Ethernet I218 Adapter driver for Windows* 10 before version 24.1 may allow an authenticated userIntel(R) Ethernet I218 Adapter driver for Windows*
- CVE-2019-11165Improper conditions check in the Linux kernel driver for the Intel(R) FPGA SDK for OpenCL(TM) Pro Edition before version 19.4 may allow an aIntel(R) FPGA SDK for OpenCL(TM) Pro Edition
- CVE-2019-11157Improper conditions check in voltage settings for some Intel(R) Processors may allow a privileged user to potentially enable escalation of pIntel(R) Processors
- CVE-2019-14568Improper permissions in the executable for Intel(R) RST before version 17.7.0.1006 may allow an authenticated user to potentially enable escIntel(R) RST
- CVE-2019-14612Out of bounds write in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local acceIntel(R) NUC
- CVE-2019-14611Integer overflow in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access.Intel(R) NUC
- CVE-2019-14609Improper input validation in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via locaIntel(R) NUC
- CVE-2019-14610Improper access control in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escalation of privilege via loIntel(R) NUC
- CVE-2019-14608Improper buffer restrictions in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escalation of privilege vIntel(R) NUC
- CVE-2019-14607Improper conditions check in multiple Intel® Processors may allow an authenticated user to potentially enable partial escalation of privilegIntel® Processors
- CVE-2019-14605Improper permissions in the installer for the Intel(R) SCS Platform Discovery Utility, all versions, may allow an authenticated user to poteIntel(R) SCS Platform Discovery Utility
- CVE-2019-14603Improper permissions in the installer for the License Server software for Intel® Quartus® Prime Pro Edition before version 19.3 may allow anIntel® Quartus® Prime Pro Edition
- CVE-2019-14604Null pointer dereference in the FPGA kernel driver for Intel(R) Quartus(R) Prime Pro Edition before version 19.3 may allow an authenticated Intel® Quartus® Prime Pro Edition
- CVE-2019-14599Unquoted service path in Control Center-I version 2.1.0.0 and earlier may allow an authenticated user to potentially enable escalation of prControl Center-I
- CVE-2019-19743On D-Link DIR-615 devices, a normal user is able to create a root(admin) user from the D-Link portal.
- CVE-2019-19731Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal.
- CVE-2019-18831Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information Exposure.
- CVE-2019-18830Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection.
- CVE-2019-18828Barco ClickShare Button R9861500D01 devices before 1.9.0 have Insufficiently Protected Credentials.
- CVE-2019-18827On Barco ClickShare Button R9861500D01 devices (before firmware version 1.9.0) JTAG access is disabled after ROM code execution.
- CVE-2019-18826Barco ClickShare Button R9861500D01 devices before 1.9.0 have Improper Following of a Certificate's Chain of Trust.
- CVE-2019-19368A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1.
- CVE-2019-4560IBM MQ and IBM MQ Appliance 9.1 CD, 9.1 LTS, 9.0 LTS, and 8.0 is vulnerable to a denial of service attack caused by channels processing poorIBM MQ
- CVE-2019-4444IBM API Connect 2018.1 through 2018.4.1.7 Developer Portal's user registration page does not disable password autocomplete.IBM API Connect
- CVE-2019-19783An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8.