# CVEs published 2019-12-20

36 CVEs were published on December 20, 2019: 2 critical, 3 high. Days are UTC.

- [CVE-2019-16785](https://cve.now/CVE-2019-16785.md): HTTP Request Smuggling: LF vs CRLF handling in Waitress (CVSS 7.1, Pylons Waitress · waitress)
- [CVE-2019-16786](https://cve.now/CVE-2019-16786.md): HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress (CVSS 7.1, Pylons Waitress · waitress)
- [CVE-2019-19919](https://cve.now/CVE-2019-19919.md): Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. (no CVSS, handlebars · bootstrap-wysihtml5-rails)
- [CVE-2019-19231](https://cve.now/CVE-2019-19231.md): An insecure file access vulnerability exists in CA Client Automation 14.0, 14.1, 14.2, and 14.3 Agent for Windows that can allow a local att (CVSS 7.3, CA Technologies, Broadcom Company CA Client Automation)
- [CVE-2019-15584](https://cve.now/CVE-2019-15584.md): A denial of service exists in gitlab \<v12.3.2, \<v12.2.6, and \<v12.1.10 that would let an attacker bypass input validation in markdown fields (no CVSS, GitLab CE/EE)
- [CVE-2019-19917](https://cve.now/CVE-2019-19917.md): Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c. (no CVSS)
- [CVE-2019-19918](https://cve.now/CVE-2019-19918.md): Lout 3.40 has a heap-based buffer overflow in the srcnext() function in z02.c. (no CVSS)
- [CVE-2019-19747](https://cve.now/CVE-2019-19747.md): NeuVector 3.1 when configured to allow authentication via Active Directory, does not enforce non-empty passwords which allows an attacker wi (no CVSS)
- [CVE-2019-4744](https://cve.now/CVE-2019-4744.md): IBM Financial Transaction Manager 3.0 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Financial Transaction Manager)
- [CVE-2019-4743](https://cve.now/CVE-2019-4743.md): IBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens or session cookies. (CVSS 4.3, IBM Financial Transaction Manager)
- [CVE-2019-4742](https://cve.now/CVE-2019-4742.md): IBM Financial Transaction Manager 3.0 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 6.1, IBM Financial Transaction Manager)
- [CVE-2019-4736](https://cve.now/CVE-2019-4736.md): IBM Financial Transaction Manager 3.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and una (CVSS 4.3, IBM Financial Transaction Manager)
- [CVE-2019-4555](https://cve.now/CVE-2019-4555.md): IBM Cognos Analytics 11.0 and 11.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Cognos Analytics)
- [CVE-2019-4231](https://cve.now/CVE-2019-4231.md): IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauth (CVSS 4.3, IBM Cognos Analytics)
- [CVE-2018-1934](https://cve.now/CVE-2018-1934.md): IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and u (CVSS 4.3, IBM Cognos Business Intelligence)
- [CVE-2019-15914](https://cve.now/CVE-2019-15914.md): An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices. (no CVSS)
- [CVE-2019-15913](https://cve.now/CVE-2019-15913.md): An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices. (no CVSS)
- [CVE-2019-15912](https://cve.now/CVE-2019-15912.md): An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. (no CVSS)
- [CVE-2019-15911](https://cve.now/CVE-2019-15911.md): An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. (no CVSS)
- [CVE-2019-15910](https://cve.now/CVE-2019-15910.md): An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. (no CVSS)
- [CVE-2019-15915](https://cve.now/CVE-2019-15915.md): An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, RTCGQ01LM devices. (no CVSS)
- [CVE-2019-17571](https://cve.now/CVE-2019-17571.md): Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely exe (CVSS 9.8, Apache Software Foundation Log4j · log4j:log4j +1)
- [CVE-2019-18263](https://cve.now/CVE-2019-18263.md): An issue was found in Philips Veradius Unity, Pulsera, and Endura Dual WAN Router, Veradius Unity (718132) with wireless option (shipped bet (no CVSS, Philips Veradius Unity, Pulsera, and Endura Dual WAN Router)
- [CVE-2019-17440](https://cve.now/CVE-2019-17440.md): PAN-OS on PA-7000 Series: Improper restriction of communication to Log Forwarding Card (LFC) allows root access (CVSS 10.0, Palo Alto Networks PAN-OS)
- [CVE-2019-19916](https://cve.now/CVE-2019-19916.md): In Midori Browser 0.5.11 (on Windows 10), Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with (no CVSS)
- [CVE-2012-6111](https://cve.now/CVE-2012-6111.md): gnome-keyring does not discard stored secrets when using gnome\_keyring\_lock\_all\_sync function (no CVSS, gnome-keyring)
- [CVE-2012-6094](https://cve.now/CVE-2012-6094.md): cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the system (no CVSS, cups)
- [CVE-2012-5639](https://cve.now/CVE-2012-5639.md): LibreOffice and OpenOffice automatically open embedded content (no CVSS, LibreOffice; OpenOffice LibreOffice, OpenOffice)
- [CVE-2012-3409](https://cve.now/CVE-2012-3409.md): ecryptfs-utils: suid helper does not restrict mounting filesystems with nosuid,nodev which creates a possible privilege escalation (no CVSS, ecryptfs-utils)
- [CVE-2015-8313](https://cve.now/CVE-2015-8313.md): GnuTLS incorrectly validates the first byte of padding in CBC modes (no CVSS)
- [CVE-2016-1000229](https://cve.now/CVE-2016-1000229.md): swagger-ui has XSS in key names (no CVSS, swagger-ui)
- [CVE-2019-19908](https://cve.now/CVE-2019-19908.md): phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. (no CVSS)
- [CVE-2019-19789](https://cve.now/CVE-2019-19789.md): 3S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.5 (no CVSS)
- [CVE-2019-19692](https://cve.now/CVE-2019-19692.md): Trend Micro Apex One (2019) is affected by a cross-site scripting (XSS) vulnerability on the product console. (no CVSS, Trend Micro Apex Central)
- [CVE-2019-19693](https://cve.now/CVE-2019-19693.md): The Trend Micro Security 2020 consumer family of products contains a vulnerability that could allow a local attacker to disclose sensitive i (no CVSS, Trend Micro Security)
- [CVE-2019-19691](https://cve.now/CVE-2019-19691.md): A vulnerability in Trend Micro Apex One and OfficeScan XG could allow an attacker to expose a masked credential key by manipulating page ele (no CVSS, Trend Micro Apex One and OfficeScan)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.