# CVEs published 2019-12-19

56 CVEs were published on December 19, 2019: 1 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-19141](https://cve.now/CVE-2019-19141.md): The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user (no CVSS)
- [CVE-2019-19915](https://cve.now/CVE-2019-19915.md): The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, del (CVSS 9.0)
- [CVE-2019-16871](https://cve.now/CVE-2019-16871.md): Beckhoff Embedded Windows PLCs through 3.1.4024.0, and Beckhoff Twincat on Windows Engineering stations, allow an attacker to achieve Remote (no CVSS)
- [CVE-2019-17527](https://cve.now/CVE-2019-17527.md): dataForDepandantField in models/custormfields.php in the JS JOBS FREE extension before 1.2.7 for Joomla! allows SQL Injection via the index. (no CVSS)
- [CVE-2019-19232](https://cve.now/CVE-2019-19232.md): In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a num (no CVSS)
- [CVE-2019-19234](https://cve.now/CVE-2019-19234.md): In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) (no CVSS)
- [CVE-2019-19341](https://cve.now/CVE-2019-19341.md): A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-readable. (CVSS 5.9, RedHat Tower)
- [CVE-2019-19342](https://cve.now/CVE-2019-19342.md): A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contain (CVSS 5.3, Red Hat Tower)
- [CVE-2019-19340](https://cve.now/CVE-2019-19340.md): A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '- (CVSS 8.2, Red Hat Tower)
- [CVE-2019-8253](https://cve.now/CVE-2019-8253.md): Adobe Photoshop CC versions before 20.0.8 and 21.0.x before 21.0.2 have a memory corruption vulnerability. (no CVSS, Adobe Photoshop CC)
- [CVE-2019-8254](https://cve.now/CVE-2019-8254.md): Adobe Photoshop CC versions before 20.0.8 and 21.0.x before 21.0.2 have a memory corruption vulnerability. (no CVSS, Adobe Photoshop CC)
- [CVE-2019-8256](https://cve.now/CVE-2019-8256.md): ColdFusion versions Update 6 and earlier have an insecure inherited permissions of default installation directory vulnerability. (no CVSS, Adobe ColdFusion)
- [CVE-2019-8255](https://cve.now/CVE-2019-8255.md): Brackets versions 1.14 and earlier have a command injection vulnerability. (no CVSS, Adobe Brackets)
- [CVE-2019-11294](https://cve.now/CVE-2019-11294.md): CAPI leaks service broker URLs and GUIDs to space developers (CVSS 4.3, Cloud Foundry CAPI)
- [CVE-2019-19910](https://cve.now/CVE-2019-19910.md): The MinervaNeue Skin in MediaWiki from 2019-11-05 to 2019-12-13 (1.35 and/or 1.34) mishandles certain HTML attributes, as demonstrated by IM (no CVSS)
- [CVE-2019-18181](https://cve.now/CVE-2019-18181.md): In CloudVision Portal all releases in the 2018.1 and 2018.2 Code train allows users with read-only permissions to bypass permissions for res (no CVSS)
- [CVE-2019-19909](https://cve.now/CVE-2019-19909.md): An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2. (no CVSS)
- [CVE-2019-19905](https://cve.now/CVE-2019-19905.md): NetHack 3.6.x before 3.6.4 is prone to a buffer overflow vulnerability when reading very long lines from configuration files. (no CVSS)
- [CVE-2019-19906](https://cve.now/CVE-2019-19906.md): cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malforme (no CVSS)
- [CVE-2019-17633](https://cve.now/CVE-2019-17633.md): For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of (no CVSS, The Eclipse Foundation Eclipse Che)
- [CVE-2019-18955](https://cve.now/CVE-2019-18955.md): The web console in Lansweeper 7.2.105.2 has XSS via the URL path. (no CVSS)
- [CVE-2019-18615](https://cve.now/CVE-2019-18615.md): In CloudVision Portal (CVP) for all releases in the 2018.2 Train, under certain conditions, the application logs user passwords in plain tex (no CVSS)
- [CVE-2019-11780](https://cve.now/CVE-2019-11780.md): Improper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 allows remote authent (CVSS 8.1, Odoo Community · Odoo Enterprise)
- [CVE-2019-16465](https://cve.now/CVE-2019-16465.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16464](https://cve.now/CVE-2019-16464.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16463](https://cve.now/CVE-2019-16463.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16462](https://cve.now/CVE-2019-16462.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16461](https://cve.now/CVE-2019-16461.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16460](https://cve.now/CVE-2019-16460.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16459](https://cve.now/CVE-2019-16459.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16458](https://cve.now/CVE-2019-16458.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16457](https://cve.now/CVE-2019-16457.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16456](https://cve.now/CVE-2019-16456.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16455](https://cve.now/CVE-2019-16455.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16454](https://cve.now/CVE-2019-16454.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16453](https://cve.now/CVE-2019-16453.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16452](https://cve.now/CVE-2019-16452.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16451](https://cve.now/CVE-2019-16451.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16450](https://cve.now/CVE-2019-16450.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16449](https://cve.now/CVE-2019-16449.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16448](https://cve.now/CVE-2019-16448.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16446](https://cve.now/CVE-2019-16446.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16445](https://cve.now/CVE-2019-16445.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-16444](https://cve.now/CVE-2019-16444.md): Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-19900](https://cve.now/CVE-2019-19900.md): An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. (no CVSS)
- [CVE-2019-19902](https://cve.now/CVE-2019-19902.md): An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. (no CVSS)
- [CVE-2019-19903](https://cve.now/CVE-2019-19903.md): An issue was discovered in Backdrop CMS 1.14.x before 1.14.2. (no CVSS)
- [CVE-2019-19901](https://cve.now/CVE-2019-19901.md): An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. (no CVSS)
- [CVE-2019-15006](https://cve.now/CVE-2019-15006.md): There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center (no CVSS, Atlassian Confluence Server)
- [CVE-2019-7487](https://cve.now/CVE-2019-7487.md): Installation of the SonicOS SSLVPN NACagent 3.5 on the Windows operating system, an autorun value is created does not put the path in quotes (no CVSS, SonicWall SonicOS)
- [CVE-2019-7484](https://cve.now/CVE-2019-7484.md): Authenticated SQL Injection in SonicWall SMA100 allow user to gain read-only access to unauthorized resources using viewcacert CGI script. (no CVSS, SonicWall SMA100)
- [CVE-2019-7485](https://cve.now/CVE-2019-7485.md): Buffer overflow in SonicWall SMA100 allows an authenticated user to execute arbitrary code in DEARegister CGI script. (no CVSS, SonicWall SMA100)
- [CVE-2019-7486](https://cve.now/CVE-2019-7486.md): Code injection in SonicWall SMA100 allows an authenticated user to execute arbitrary code in viewcacert CGI script. (no CVSS, SonicWall SMA100)
- [CVE-2019-7482](https://cve.now/CVE-2019-7482.md): Stack-based buffer overflow in SonicWall SMA100 allows an unauthenticated user to execute arbitrary code in function libSys.so. (no CVSS, SonicWall SMA100)
- [CVE-2019-7483](https://cve.now/CVE-2019-7483.md): In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the prese (CVSS 7.5, KEV, SonicWall SMA100)
- [CVE-2019-19907](https://cve.now/CVE-2019-19907.md): HrAddFBBlock in libfreebusy/freebusyutil.cpp in Kopano Groupware Core before 8.7.7 allows out-of-bounds access, as demonstrated by mishandli (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.