CVEs published December 17, 2019
71 CVEs were published on December 17, 2019: 0 critical, 5 high. 1 is now in CISA KEV.
- Published
- 71
- Critical
- 0
- High
- 5
- Medium
- 3
- Low
- 0
- Unrated
- 63
- Now in CISA KEV
- 1
- Fix available
- 21
Most affected products
- ELOG
- 5
- contao/core-bundle · contao/contao
- 3
- Jenkins project Jenkins Build Failure Analyzer Plugin · com…
- 3
- Jenkins project Jenkins Team Concert Plugin · org.jenkins-c…
- 3
- Jenkins project Jenkins WebSphere Deployer Plugin · org.jen…
- 3
- TIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…
- 3
- Jenkins project Jenkins Alauda DevOps Pipeline Plugin · com…
- 2
- Jenkins project Jenkins Alauda Kubernetes Suport Plugin · i…
- 2
- Jenkins project Jenkins Gerrit Trigger Plugin · com.sonyeri…
- 2
- Jenkins project Jenkins Maven Release Plugin · org.jenkins-…
- 2
High 5
- CVE-2019-7481Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources.SonicWall SMA100
- CVE-2019-17337TIBCO Spotfire Server Library Vulnerable to Reflected Cross-Site ScriptingTIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…
- CVE-2019-17336TIBCO Spotfire Web Player Potentially Exposes Credentials For Shared Data SourcesTIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…
- CVE-2019-17334TIBCO Spotfire Analyst and Desktop Remote Code Execution Via Shared FilesTIBCO Software TIBCO Spotfire Analyst · TIBCO Software T… +2
- CVE-2019-19849An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.typo3/cms-core · typo3/cms
Medium, low and unrated 66
- CVE-2019-18257In Advantech DiagAnywhere Server, Versions 3.07.11 and prior, multiple stack-based buffer overflow vulnerabilities exist in the file transfeAdvantech DiagAnywhere Server
- CVE-2019-11657Cross-Site Request Forgery vulnerability in all Micro Focus ArcSight Logger affecting all product versions below version 7.0.Micro Focus International ArcSight Logger
- CVE-2019-3996ELOG 3.1.4-57bea22 and below can be used as an HTTP GET request proxy when unauthenticated remote attackers send crafted HTTP POST requests.ELOG
- CVE-2019-3995ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference.ELOG
- CVE-2019-3994ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a use after free.ELOG
- CVE-2019-3993ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability.ELOG
- CVE-2019-3992ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability.ELOG
- CVE-2019-17335TIBCO Spotfire Server Exposes User-Specific Cached Data To Others UsersTIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…
- CVE-2019-0384Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0,SAP SE SAP Treasury and Risk Management
- CVE-2019-0383Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0,SAP SE SAP Treasury and Risk Management
- CVE-2019-19241In the Linux kernel before 5.4.2, the io_uring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e44
- CVE-2019-19497MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message.
- CVE-2019-19634class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, verot/class.upload.php
- CVE-2019-19850An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.typo3/cms · typo3/cms-core
- CVE-2019-19848An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.typo3/cms-core · typo3/cms
- CVE-2019-14782CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the /
- CVE-2019-15235CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/se
- CVE-2019-18670In the Quick Access Service (QAAdminAgent.exe) in Acer Quick Access V2.01.3000 through 2.01.3027 and V3.00.3000 through V3.00.3008, a REGULA
- CVE-2019-18956Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1
- CVE-2019-19847Libspiro through 20190731 has a stack-based buffer overflow in the spiro_to_bpath0() function in spiro.c.
- CVE-2019-19315NLSSRV32.EXE in Nalpeiron Licensing Service 7.3.4.0, as used with Nitro PDF and other products, allows Elevation of Privilege via the \\.\ma
- CVE-2019-19675In Ivanti Workspace Control before 10.3.180.0.
- CVE-2019-16576A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to conJenkins project Jenkins Alauda Kubernetes Suport Plugin · i…
- CVE-2019-16574A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to conneJenkins project Jenkins Alauda DevOps Pipeline Plugin · com…
- CVE-2019-16575A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an atJenkins project Jenkins Alauda Kubernetes Suport Plugin · i…
- CVE-2019-16571A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an attaJenkins project Jenkins RapidDeploy Plugin · org.jenkins-ci…
- CVE-2019-16572Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can Jenkins project Jenkins Weibo Plugin · org.jenkins-ci.plugi…
- CVE-2019-16573A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attaJenkins project Jenkins Alauda DevOps Pipeline Plugin · com…
- CVE-2019-16569A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to connect to an attacker-specified weJenkins project Jenkins Mantis Plugin · org.jenkins-ci.plug…
- CVE-2019-16570A cross-site request forgery vulnerability in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers to connect to an attacker-specifieJenkins project Jenkins RapidDeploy Plugin · org.jenkins-ci…
- CVE-2019-16567A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access tJenkins project Jenkins Team Concert Plugin · org.jenkins-c…
- CVE-2019-16568Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configurJenkins project Jenkins SCTMExecutor Plugin · hudson.plugin…
- CVE-2019-16565A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-speciJenkins project Jenkins Team Concert Plugin · org.jenkins-c…
- CVE-2019-16566A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an aJenkins project Jenkins Team Concert Plugin · org.jenkins-c…
- CVE-2019-16563Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a storedJenkins project Jenkins Mission Control Plugin · tech.andre…
- CVE-2019-16564Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a stored XSS vulnerabiliJenkins project Jenkins Pipeline Aggregator View Plugin · c…
- CVE-2019-16560A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tesJenkins project Jenkins WebSphere Deployer Plugin · org.jen…
- CVE-2019-16561Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validaJenkins project Jenkins WebSphere Deployer Plugin · org.jen…
- CVE-2019-16562Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored XSS vulnerJenkins project Jenkins buildgraph-view Plugin · org.jenkin…
- CVE-2019-16558Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM.Jenkins project Jenkins Spira Importer Plugin · com.inflect…
- CVE-2019-16559A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform cJenkins project Jenkins WebSphere Deployer Plugin · org.jen…
- CVE-2019-16556Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins project Jenkins Rundeck Plugin · org.jenkins-ci.plu…
- CVE-2019-16557Jenkins Redgate SQL Change Automation Plugin 2.0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master Jenkins project Jenkins Redgate SQL Change Automation Plugi…
- CVE-2019-16554A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to haveJenkins project Jenkins Build Failure Analyzer Plugin · com…
- CVE-2019-16555A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptiJenkins project Jenkins Build Failure Analyzer Plugin · com…
- CVE-2019-16552A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to aJenkins project Jenkins Gerrit Trigger Plugin · com.sonyeri…
- CVE-2019-16553A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evalJenkins project Jenkins Build Failure Analyzer Plugin · com…
- CVE-2019-16549Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing manJenkins project Jenkins Maven Release Plugin · org.jenkins-…
- CVE-2019-16550A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackJenkins project Jenkins Maven Release Plugin · org.jenkins-…
- CVE-2019-16551A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-spJenkins project Jenkins Gerrit Trigger Plugin · com.sonyeri…
- CVE-2019-19745Contao 4.0 through 4.8.5 allows PHP local file inclusion.contao/core-bundle · contao/contao
- CVE-2019-19714Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output.contao/core-bundle · contao/contao
- CVE-2019-19712Contao 4.0 through 4.8.5 has Insecure Permissions.contao/core-bundle · contao/contao
- CVE-2019-19264In Simplifile RecordFusion through 2019-11-25, the logs and hist parameters allow remote attackers to access local files via a logger/logs?/
- CVE-2019-18833Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information exposure (issue 2 of 2)..
- CVE-2019-18832Barco ClickShare Button R9861500D01 devices before 1.9.0 have incorrect Credentials Management.
- CVE-2019-18829Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check.
- CVE-2019-18825Barco ClickShare Huddle CS-100 devices before 1.9.0 and CSE-200 devices before 1.9.0 have incorrect Credentials Management.
- CVE-2019-18824Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check.
- CVE-2019-19815In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause a NULL pointer dereference in f2fs_recover_fsync_data in fs/f
- CVE-2019-19816In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write acce
- CVE-2019-19813In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can
- CVE-2019-19814In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause __remove_dirty_segment slab-out-of-bounds write access becaus
- CVE-2019-19830_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database.
- CVE-2019-15011The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0Atlassian Application Links
- CVE-2017-18107Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delAtlassian Crowd