# CVEs published 2019-12-17

71 CVEs were published on December 17, 2019: 0 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-18257](https://cve.now/CVE-2019-18257.md): In Advantech DiagAnywhere Server, Versions 3.07.11 and prior, multiple stack-based buffer overflow vulnerabilities exist in the file transfe (no CVSS, Advantech DiagAnywhere Server)
- [CVE-2019-7481](https://cve.now/CVE-2019-7481.md): Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. (CVSS 7.5, KEV, SonicWall SMA100)
- [CVE-2019-11657](https://cve.now/CVE-2019-11657.md): Cross-Site Request Forgery vulnerability in all Micro Focus ArcSight Logger affecting all product versions below version 7.0. (no CVSS, Micro Focus International ArcSight Logger)
- [CVE-2019-3996](https://cve.now/CVE-2019-3996.md): ELOG 3.1.4-57bea22 and below can be used as an HTTP GET request proxy when unauthenticated remote attackers send crafted HTTP POST requests. (no CVSS, ELOG)
- [CVE-2019-3995](https://cve.now/CVE-2019-3995.md): ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference. (no CVSS, ELOG)
- [CVE-2019-3994](https://cve.now/CVE-2019-3994.md): ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a use after free. (no CVSS, ELOG)
- [CVE-2019-3993](https://cve.now/CVE-2019-3993.md): ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. (no CVSS, ELOG)
- [CVE-2019-3992](https://cve.now/CVE-2019-3992.md): ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability. (no CVSS, ELOG)
- [CVE-2019-17337](https://cve.now/CVE-2019-17337.md): TIBCO Spotfire Server Library Vulnerable to Reflected Cross-Site Scripting (CVSS 8.1, TIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…)
- [CVE-2019-17336](https://cve.now/CVE-2019-17336.md): TIBCO Spotfire Web Player Potentially Exposes Credentials For Shared Data Sources (CVSS 7.7, TIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…)
- [CVE-2019-17335](https://cve.now/CVE-2019-17335.md): TIBCO Spotfire Server Exposes User-Specific Cached Data To Others Users (CVSS 5.3, TIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…)
- [CVE-2019-17334](https://cve.now/CVE-2019-17334.md): TIBCO Spotfire Analyst and Desktop Remote Code Execution Via Shared Files (CVSS 7.6, TIBCO Software TIBCO Spotfire Analyst · TIBCO Software T… +2)
- [CVE-2019-0384](https://cve.now/CVE-2019-0384.md): Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, (no CVSS, SAP SE SAP Treasury and Risk Management)
- [CVE-2019-0383](https://cve.now/CVE-2019-0383.md): Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, (no CVSS, SAP SE SAP Treasury and Risk Management)
- [CVE-2019-19241](https://cve.now/CVE-2019-19241.md): In the Linux kernel before 5.4.2, the io\_uring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e44 (no CVSS)
- [CVE-2019-19497](https://cve.now/CVE-2019-19497.md): MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message. (no CVSS)
- [CVE-2019-19634](https://cve.now/CVE-2019-19634.md): class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, (no CVSS, verot/class.upload.php)
- [CVE-2019-19849](https://cve.now/CVE-2019-19849.md): An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. (CVSS 8.8, typo3/cms-core · typo3/cms)
- [CVE-2019-19850](https://cve.now/CVE-2019-19850.md): An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. (CVSS 5.5, typo3/cms · typo3/cms-core)
- [CVE-2019-19848](https://cve.now/CVE-2019-19848.md): An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. (CVSS 6.8, typo3/cms-core · typo3/cms)
- [CVE-2019-14782](https://cve.now/CVE-2019-14782.md): CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the / (no CVSS)
- [CVE-2019-15235](https://cve.now/CVE-2019-15235.md): CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/\[USERNAME\]/tmp/se (no CVSS)
- [CVE-2019-18670](https://cve.now/CVE-2019-18670.md): In the Quick Access Service (QAAdminAgent.exe) in Acer Quick Access V2.01.3000 through 2.01.3027 and V3.00.3000 through V3.00.3008, a REGULA (no CVSS)
- [CVE-2019-18956](https://cve.now/CVE-2019-18956.md): Divisa Proxia Suite 9 \< 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 \< 10.0.32, and 10.1 \< 10.1.5, SparkSpace 1.0 \< 1.0.30, 1.1 (no CVSS)
- [CVE-2019-19847](https://cve.now/CVE-2019-19847.md): Libspiro through 20190731 has a stack-based buffer overflow in the spiro\_to\_bpath0() function in spiro.c. (no CVSS)
- [CVE-2019-19315](https://cve.now/CVE-2019-19315.md): NLSSRV32.EXE in Nalpeiron Licensing Service 7.3.4.0, as used with Nitro PDF and other products, allows Elevation of Privilege via the \\\\.\\ma (no CVSS)
- [CVE-2019-19675](https://cve.now/CVE-2019-19675.md): In Ivanti Workspace Control before 10.3.180.0. (no CVSS)
- [CVE-2019-16576](https://cve.now/CVE-2019-16576.md): A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to con (no CVSS, Jenkins project Jenkins Alauda Kubernetes Suport Plugin · i…)
- [CVE-2019-16574](https://cve.now/CVE-2019-16574.md): A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to conne (no CVSS, Jenkins project Jenkins Alauda DevOps Pipeline Plugin · com…)
- [CVE-2019-16575](https://cve.now/CVE-2019-16575.md): A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an at (no CVSS, Jenkins project Jenkins Alauda Kubernetes Suport Plugin · i…)
- [CVE-2019-16571](https://cve.now/CVE-2019-16571.md): A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an atta (no CVSS, Jenkins project Jenkins RapidDeploy Plugin · org.jenkins-ci…)
- [CVE-2019-16572](https://cve.now/CVE-2019-16572.md): Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can (no CVSS, Jenkins project Jenkins Weibo Plugin · org.jenkins-ci.plugi…)
- [CVE-2019-16573](https://cve.now/CVE-2019-16573.md): A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an atta (no CVSS, Jenkins project Jenkins Alauda DevOps Pipeline Plugin · com…)
- [CVE-2019-16569](https://cve.now/CVE-2019-16569.md): A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to connect to an attacker-specified we (no CVSS, Jenkins project Jenkins Mantis Plugin · org.jenkins-ci.plug…)
- [CVE-2019-16570](https://cve.now/CVE-2019-16570.md): A cross-site request forgery vulnerability in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers to connect to an attacker-specifie (no CVSS, Jenkins project Jenkins RapidDeploy Plugin · org.jenkins-ci…)
- [CVE-2019-16567](https://cve.now/CVE-2019-16567.md): A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access t (no CVSS, Jenkins project Jenkins Team Concert Plugin · org.jenkins-c…)
- [CVE-2019-16568](https://cve.now/CVE-2019-16568.md): Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configur (no CVSS, Jenkins project Jenkins SCTMExecutor Plugin · hudson.plugin…)
- [CVE-2019-16565](https://cve.now/CVE-2019-16565.md): A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-speci (no CVSS, Jenkins project Jenkins Team Concert Plugin · org.jenkins-c…)
- [CVE-2019-16566](https://cve.now/CVE-2019-16566.md): A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an a (no CVSS, Jenkins project Jenkins Team Concert Plugin · org.jenkins-c…)
- [CVE-2019-16563](https://cve.now/CVE-2019-16563.md): Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a stored (no CVSS, Jenkins project Jenkins Mission Control Plugin · tech.andre…)
- [CVE-2019-16564](https://cve.now/CVE-2019-16564.md): Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a stored XSS vulnerabili (no CVSS, Jenkins project Jenkins Pipeline Aggregator View Plugin · c…)
- [CVE-2019-16560](https://cve.now/CVE-2019-16560.md): A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tes (no CVSS, Jenkins project Jenkins WebSphere Deployer Plugin · org.jen…)
- [CVE-2019-16561](https://cve.now/CVE-2019-16561.md): Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname valida (no CVSS, Jenkins project Jenkins WebSphere Deployer Plugin · org.jen…)
- [CVE-2019-16562](https://cve.now/CVE-2019-16562.md): Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored XSS vulner (no CVSS, Jenkins project Jenkins buildgraph-view Plugin · org.jenkin…)
- [CVE-2019-16558](https://cve.now/CVE-2019-16558.md): Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM. (no CVSS, Jenkins project Jenkins Spira Importer Plugin · com.inflect…)
- [CVE-2019-16559](https://cve.now/CVE-2019-16559.md): A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform c (no CVSS, Jenkins project Jenkins WebSphere Deployer Plugin · org.jen…)
- [CVE-2019-16556](https://cve.now/CVE-2019-16556.md): Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the (no CVSS, Jenkins project Jenkins Rundeck Plugin · org.jenkins-ci.plu…)
- [CVE-2019-16557](https://cve.now/CVE-2019-16557.md): Jenkins Redgate SQL Change Automation Plugin 2.0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master (no CVSS, Jenkins project Jenkins Redgate SQL Change Automation Plugi…)
- [CVE-2019-16554](https://cve.now/CVE-2019-16554.md): A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have (no CVSS, Jenkins project Jenkins Build Failure Analyzer Plugin · com…)
- [CVE-2019-16555](https://cve.now/CVE-2019-16555.md): A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interrupti (no CVSS, Jenkins project Jenkins Build Failure Analyzer Plugin · com…)
- [CVE-2019-16552](https://cve.now/CVE-2019-16552.md): A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to a (no CVSS, Jenkins project Jenkins Gerrit Trigger Plugin · com.sonyeri…)
- [CVE-2019-16553](https://cve.now/CVE-2019-16553.md): A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins eval (no CVSS, Jenkins project Jenkins Build Failure Analyzer Plugin · com…)
- [CVE-2019-16549](https://cve.now/CVE-2019-16549.md): Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man (no CVSS, Jenkins project Jenkins Maven Release Plugin · org.jenkins-…)
- [CVE-2019-16550](https://cve.now/CVE-2019-16550.md): A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attack (no CVSS, Jenkins project Jenkins Maven Release Plugin · org.jenkins-…)
- [CVE-2019-16551](https://cve.now/CVE-2019-16551.md): A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-sp (no CVSS, Jenkins project Jenkins Gerrit Trigger Plugin · com.sonyeri…)
- [CVE-2019-19745](https://cve.now/CVE-2019-19745.md): Contao 4.0 through 4.8.5 allows PHP local file inclusion. (no CVSS, contao/core-bundle · contao/contao)
- [CVE-2019-19714](https://cve.now/CVE-2019-19714.md): Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. (no CVSS, contao/core-bundle · contao/contao)
- [CVE-2019-19712](https://cve.now/CVE-2019-19712.md): Contao 4.0 through 4.8.5 has Insecure Permissions. (no CVSS, contao/core-bundle · contao/contao)
- [CVE-2019-19264](https://cve.now/CVE-2019-19264.md): In Simplifile RecordFusion through 2019-11-25, the logs and hist parameters allow remote attackers to access local files via a logger/logs?/ (no CVSS)
- [CVE-2019-18833](https://cve.now/CVE-2019-18833.md): Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information exposure (issue 2 of 2).. (no CVSS)
- [CVE-2019-18832](https://cve.now/CVE-2019-18832.md): Barco ClickShare Button R9861500D01 devices before 1.9.0 have incorrect Credentials Management. (no CVSS)
- [CVE-2019-18829](https://cve.now/CVE-2019-18829.md): Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. (no CVSS)
- [CVE-2019-18825](https://cve.now/CVE-2019-18825.md): Barco ClickShare Huddle CS-100 devices before 1.9.0 and CSE-200 devices before 1.9.0 have incorrect Credentials Management. (no CVSS)
- [CVE-2019-18824](https://cve.now/CVE-2019-18824.md): Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. (no CVSS)
- [CVE-2019-19815](https://cve.now/CVE-2019-19815.md): In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause a NULL pointer dereference in f2fs\_recover\_fsync\_data in fs/f (no CVSS)
- [CVE-2019-19816](https://cve.now/CVE-2019-19816.md): In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write acce (no CVSS)
- [CVE-2019-19813](https://cve.now/CVE-2019-19813.md): In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can (no CVSS)
- [CVE-2019-19814](https://cve.now/CVE-2019-19814.md): In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause \_\_remove\_dirty\_segment slab-out-of-bounds write access becaus (no CVSS)
- [CVE-2019-19830](https://cve.now/CVE-2019-19830.md): \_core\_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database. (no CVSS)
- [CVE-2019-15011](https://cve.now/CVE-2019-15011.md): The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 (no CVSS, Atlassian Application Links)
- [CVE-2017-18107](https://cve.now/CVE-2017-18107.md): Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and del (no CVSS, Atlassian Crowd)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.