# CVEs published 2019-12-16

48 CVEs were published on December 16, 2019: 0 critical, 5 high. Days are UTC.

- [CVE-2019-19826](https://cve.now/CVE-2019-19826.md): The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/views\_handler\_filter\_dynamic\_ (CVSS 8.1)
- [CVE-2019-12413](https://cve.now/CVE-2019-12413.md): In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a spec (no CVSS, Apache Incubator Superset · apache-superset)
- [CVE-2019-12414](https://cve.now/CVE-2019-12414.md): In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab (no CVSS, Apache Incubator Superset · apache-superset)
- [CVE-2019-5259](https://cve.now/CVE-2019-5259.md): There is an information leakage vulnerability on some Huawei products(AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;AR2200;AR220 (no CVSS, AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;A…)
- [CVE-2018-11751](https://cve.now/CVE-2018-11751.md): Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. (no CVSS, Puppet Agent, Puppet)
- [CVE-2019-18191](https://cve.now/CVE-2019-18191.md): A privilege escalation vulnerability in the Trend Micro Deep Security as a Service Quick Setup cloud formation template could allow an authe (no CVSS, Trend Micro Deep Security as a Service)
- [CVE-2019-13182](https://cve.now/CVE-2019-13182.md): A stored cross-site scripting (XSS) vulnerability exists in the web UI of SolarWinds Serv-U FTP Server 15.1.7. (no CVSS)
- [CVE-2019-13181](https://cve.now/CVE-2019-13181.md): A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7. (no CVSS)
- [CVE-2019-16778](https://cve.now/CVE-2019-16778.md): Heap buffer overflow in \`UnsortedSegmentSum\` in TensorFlow (CVSS 2.6, tensorflow · tensorflow-cpu +1)
- [CVE-2019-19817](https://cve.now/CVE-2019-19817.md): The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x2e8a Out- (no CVSS)
- [CVE-2019-19819](https://cve.now/CVE-2019-19819.md): The JBIG2Globals library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x90ec NUL (no CVSS)
- [CVE-2019-19820](https://cve.now/CVE-2019-19820.md): An invalid pointer vulnerability in IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve (no CVSS)
- [CVE-2019-19818](https://cve.now/CVE-2019-19818.md): The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0xa08a Out- (no CVSS)
- [CVE-2019-18579](https://cve.now/CVE-2019-18579.md): Settings for the Dell XPS 13 2-in-1 (7390) BIOS versions prior to 1.1.3 contain a configuration vulnerability. (CVSS 7.6, Dell CPG BIOS)
- [CVE-2019-16779](https://cve.now/CVE-2019-16779.md): In RubyGem excon, interrupted Persistent Connections May Leak Response Data (CVSS 5.8, excon)
- [CVE-2019-10773](https://cve.now/CVE-2019-10773.md): In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specia (no CVSS, Yarn)
- [CVE-2019-18261](https://cve.now/CVE-2019-18261.md): In Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series, all versions, the software does not implem (no CVSS, Omron PLC CJ, CS and NJ Series)
- [CVE-2019-13533](https://cve.now/CVE-2019-13533.md): In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between the PLC and the contr (CVSS 8.1, Omron PLC CJ and CS Series)
- [CVE-2019-18269](https://cve.now/CVE-2019-18269.md): Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability. (CVSS 8.6, Omron PLC CJ Series · Omron PLC CS series +1)
- [CVE-2019-18259](https://cve.now/CVE-2019-18259.md): In Omron PLC CJ series, all versions and Omron PLC CS series, all versions, an attacker could spoof arbitrary messages or execute commands. (no CVSS, Omron PLC CJ and CS Series)
- [CVE-2019-0134](https://cve.now/CVE-2019-0134.md): Improper permissions in the Intel(R) Dynamic Platform and Thermal Framework v8.3.10208.5643 and before may allow an authenticated user to po (no CVSS, Intel(R) Dynamic Platform and Thermal Framework)
- [CVE-2019-0159](https://cve.now/CVE-2019-0159.md): Insufficient memory protection in the Linux Administrative Tools for Intel(R) Network Adapters before version 24.3 may allow an authenticate (no CVSS, Linux Administrative Tools for Intel(R) Network Adapters)
- [CVE-2019-11096](https://cve.now/CVE-2019-11096.md): Insufficient memory protection for Intel(R) Ethernet I218 Adapter driver for Windows\* 10 before version 24.1 may allow an authenticated user (no CVSS, Intel(R) Ethernet I218 Adapter driver for Windows\*)
- [CVE-2019-11165](https://cve.now/CVE-2019-11165.md): Improper conditions check in the Linux kernel driver for the Intel(R) FPGA SDK for OpenCL(TM) Pro Edition before version 19.4 may allow an a (no CVSS, Intel(R) FPGA SDK for OpenCL(TM) Pro Edition)
- [CVE-2019-11157](https://cve.now/CVE-2019-11157.md): Improper conditions check in voltage settings for some Intel(R) Processors may allow a privileged user to potentially enable escalation of p (no CVSS, Intel(R) Processors)
- [CVE-2019-14568](https://cve.now/CVE-2019-14568.md): Improper permissions in the executable for Intel(R) RST before version 17.7.0.1006 may allow an authenticated user to potentially enable esc (no CVSS, Intel(R) RST)
- [CVE-2019-14612](https://cve.now/CVE-2019-14612.md): Out of bounds write in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local acce (no CVSS, Intel(R) NUC)
- [CVE-2019-14611](https://cve.now/CVE-2019-14611.md): Integer overflow in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access. (no CVSS, Intel(R) NUC)
- [CVE-2019-14609](https://cve.now/CVE-2019-14609.md): Improper input validation in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via loca (no CVSS, Intel(R) NUC)
- [CVE-2019-14610](https://cve.now/CVE-2019-14610.md): Improper access control in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escalation of privilege via lo (no CVSS, Intel(R) NUC)
- [CVE-2019-14608](https://cve.now/CVE-2019-14608.md): Improper buffer restrictions in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escalation of privilege v (no CVSS, Intel(R) NUC)
- [CVE-2019-14607](https://cve.now/CVE-2019-14607.md): Improper conditions check in multiple Intel® Processors may allow an authenticated user to potentially enable partial escalation of privileg (no CVSS, Intel® Processors)
- [CVE-2019-14605](https://cve.now/CVE-2019-14605.md): Improper permissions in the installer for the Intel(R) SCS Platform Discovery Utility, all versions, may allow an authenticated user to pote (no CVSS, Intel(R) SCS Platform Discovery Utility)
- [CVE-2019-14603](https://cve.now/CVE-2019-14603.md): Improper permissions in the installer for the License Server software for Intel® Quartus® Prime Pro Edition before version 19.3 may allow an (no CVSS, Intel® Quartus® Prime Pro Edition)
- [CVE-2019-14604](https://cve.now/CVE-2019-14604.md): Null pointer dereference in the FPGA kernel driver for Intel(R) Quartus(R) Prime Pro Edition before version 19.3 may allow an authenticated (no CVSS, Intel® Quartus® Prime Pro Edition)
- [CVE-2019-14599](https://cve.now/CVE-2019-14599.md): Unquoted service path in Control Center-I version 2.1.0.0 and earlier may allow an authenticated user to potentially enable escalation of pr (no CVSS, Control Center-I)
- [CVE-2019-19743](https://cve.now/CVE-2019-19743.md): On D-Link DIR-615 devices, a normal user is able to create a root(admin) user from the D-Link portal. (no CVSS)
- [CVE-2019-19731](https://cve.now/CVE-2019-19731.md): Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. (no CVSS)
- [CVE-2019-18831](https://cve.now/CVE-2019-18831.md): Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information Exposure. (no CVSS)
- [CVE-2019-18830](https://cve.now/CVE-2019-18830.md): Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection. (no CVSS)
- [CVE-2019-18828](https://cve.now/CVE-2019-18828.md): Barco ClickShare Button R9861500D01 devices before 1.9.0 have Insufficiently Protected Credentials. (no CVSS)
- [CVE-2019-18827](https://cve.now/CVE-2019-18827.md): On Barco ClickShare Button R9861500D01 devices (before firmware version 1.9.0) JTAG access is disabled after ROM code execution. (no CVSS)
- [CVE-2019-18826](https://cve.now/CVE-2019-18826.md): Barco ClickShare Button R9861500D01 devices before 1.9.0 have Improper Following of a Certificate's Chain of Trust. (no CVSS)
- [CVE-2019-19368](https://cve.now/CVE-2019-19368.md): A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. (no CVSS)
- [CVE-2019-4560](https://cve.now/CVE-2019-4560.md): IBM MQ and IBM MQ Appliance 9.1 CD, 9.1 LTS, 9.0 LTS, and 8.0 is vulnerable to a denial of service attack caused by channels processing poor (CVSS 5.3, IBM MQ)
- [CVE-2019-4444](https://cve.now/CVE-2019-4444.md): IBM API Connect 2018.1 through 2018.4.1.7 Developer Portal's user registration page does not disable password autocomplete. (CVSS 5.1, IBM API Connect)
- [CVE-2019-19783](https://cve.now/CVE-2019-19783.md): An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. (no CVSS)
- [CVE-2019-19331](https://cve.now/CVE-2019-19331.md): knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. (CVSS 7.5, CZ.NIC knot-resolver)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.