CVEs published December 20, 2019
36 CVEs were published on December 20, 2019: 2 critical, 3 high.
- Published
- 36
- Critical
- 2
- High
- 3
- Medium
- 7
- Low
- 0
- Unrated
- 24
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- IBM Financial Transaction Manager
- 4
- IBM Cognos Analytics
- 2
- Pylons Waitress · waitress
- 2
- Apache Software Foundation Log4j · log4j:log4j +1
- 1
- CA Technologies, Broadcom Company CA Client Automation
- 1
- cups
- 1
- ecryptfs-utils
- 1
- GitLab CE/EE
- 1
- gnome-keyring
- 1
- handlebars · bootstrap-wysihtml5-rails
- 1
Critical 2
- CVE-2019-17571Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely exeApache Software Foundation Log4j · log4j:log4j +1
- CVE-2019-17440PAN-OS on PA-7000 Series: Improper restriction of communication to Log Forwarding Card (LFC) allows root accessPalo Alto Networks PAN-OS
High 3
- CVE-2019-16785HTTP Request Smuggling: LF vs CRLF handling in WaitressPylons Waitress · waitress
- CVE-2019-16786HTTP Request Smuggling: Invalid Transfer-Encoding in WaitressPylons Waitress · waitress
- CVE-2019-19231An insecure file access vulnerability exists in CA Client Automation 14.0, 14.1, 14.2, and 14.3 Agent for Windows that can allow a local attCA Technologies, Broadcom Company CA Client Automation
Medium, low and unrated 31
- CVE-2019-19919Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution.handlebars · bootstrap-wysihtml5-rails
- CVE-2019-15584A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fieldsGitLab CE/EE
- CVE-2019-19917Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c.
- CVE-2019-19918Lout 3.40 has a heap-based buffer overflow in the srcnext() function in z02.c.
- CVE-2019-19747NeuVector 3.1 when configured to allow authentication via Active Directory, does not enforce non-empty passwords which allows an attacker wi
- CVE-2019-4744IBM Financial Transaction Manager 3.0 is vulnerable to cross-site scripting.IBM Financial Transaction Manager
- CVE-2019-4743IBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens or session cookies.IBM Financial Transaction Manager
- CVE-2019-4742IBM Financial Transaction Manager 3.0 could allow a remote attacker to hijack the clicking action of the victim.IBM Financial Transaction Manager
- CVE-2019-4736IBM Financial Transaction Manager 3.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unaIBM Financial Transaction Manager
- CVE-2019-4555IBM Cognos Analytics 11.0 and 11.0 is vulnerable to cross-site scripting.IBM Cognos Analytics
- CVE-2019-4231IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthIBM Cognos Analytics
- CVE-2018-1934IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and uIBM Cognos Business Intelligence
- CVE-2019-15914An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices.
- CVE-2019-15913An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices.
- CVE-2019-15912An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO.
- CVE-2019-15911An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO.
- CVE-2019-15910An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO.
- CVE-2019-15915An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, RTCGQ01LM devices.
- CVE-2019-18263An issue was found in Philips Veradius Unity, Pulsera, and Endura Dual WAN Router, Veradius Unity (718132) with wireless option (shipped betPhilips Veradius Unity, Pulsera, and Endura Dual WAN Router
- CVE-2019-19916In Midori Browser 0.5.11 (on Windows 10), Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with
- CVE-2012-6111gnome-keyring does not discard stored secrets when using gnome_keyring_lock_all_sync functiongnome-keyring
- CVE-2012-6094cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the systemcups
- CVE-2012-5639LibreOffice and OpenOffice automatically open embedded contentLibreOffice; OpenOffice LibreOffice, OpenOffice
- CVE-2012-3409ecryptfs-utils: suid helper does not restrict mounting filesystems with nosuid,nodev which creates a possible privilege escalationecryptfs-utils
- CVE-2015-8313GnuTLS incorrectly validates the first byte of padding in CBC modes
- CVE-2016-1000229swagger-ui has XSS in key namesswagger-ui
- CVE-2019-19908phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL.
- CVE-2019-197893S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.5
- CVE-2019-19692Trend Micro Apex One (2019) is affected by a cross-site scripting (XSS) vulnerability on the product console.Trend Micro Apex Central
- CVE-2019-19693The Trend Micro Security 2020 consumer family of products contains a vulnerability that could allow a local attacker to disclose sensitive iTrend Micro Security
- CVE-2019-19691A vulnerability in Trend Micro Apex One and OfficeScan XG could allow an attacker to expose a masked credential key by manipulating page eleTrend Micro Apex One and OfficeScan