CVEs published December 23, 2019
57 CVEs were published on December 23, 2019: 0 critical, 1 high.
- Published
- 57
- Critical
- 0
- High
- 1
- Medium
- 4
- Low
- 3
- Unrated
- 49
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- F5 BIG-IP
- 9
- PHP Group PHP
- 6
- ZTE ZXCLOUD GoldenData VAP
- 3
- Apache Software Foundation Apache Tomcat · org.apache.tomca…
- 2
- F5 BIG-IP ASM
- 2
- SonicWall Email Security Appliance
- 2
- abcprintf upload-image-with-ajax
- 1
- Check Point Endpoint Security Client for Windows
- 1
- Debian Edu
- 1
- Equinox Control Expert
- 1
High 1
Medium, low and unrated 56
- CVE-2019-19947In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser_usb
- CVE-2019-12568Stack-based overflow vulnerability in the logMess function in Open TFTP Server SP 1.66 and earlier allows remote attackers to perform a deni
- CVE-2019-12567Stack-based overflow vulnerability in the logMess function in Open TFTP Server MT 1.65 and earlier allows remote attackers to perform a deni
- CVE-2018-10389Format string vulnerability in the logMess function in TFTP Server MT 1.65 and earlier allows remote attackers to perform a denial of servic
- CVE-2018-10388Format string vulnerability in the logMess function in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of servic
- CVE-2018-10387Heap-based overflow vulnerability in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or possibly exec
- CVE-2019-18211An issue was discovered in Orckestra C1 CMS through 6.6.
- CVE-2019-7488Weak default password cause vulnerability in SonicWall Email Security appliance which leads to attacker gain access to appliance database.SonicWall Email Security Appliance
- CVE-2019-7489A vulnerability in SonicWall Email Security appliance allow an unauthenticated user to perform remote code execution.SonicWall Email Security Appliance
- CVE-2019-8293Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution.abcprintf upload-image-with-ajax
- CVE-2019-18236Multiple buffer overflow vulnerabilities exist when the PLC Editor Version 1.3.5_20190129 processes project files.WECON PLC Editor
- CVE-2019-5539VMware Workstation (15.x prior to 15.5.1) and Horizon View Agent (7.10.x prior to 7.10.1 and 7.5.x prior to 7.5.4) contain a DLL hijacking vVMware Workstation · VMware Horizon View Agent
- CVE-2019-6147Forcepoint NGFW Security Management Center (SMC) versions lower than 6.5.12 or 6.7.1 have a rare issue that in specific circumstances can coForcepoint NGFW Security Management Center
- CVE-2019-19944In libIEC61850 1.4.0, BerDecoder_decodeUint32 in mms/asn1/ber_decode.c has an out-of-bounds read, related to intLen and bufPos.
- CVE-2019-18234Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely execute arbitrary codEquinox Control Expert
- CVE-2019-8463A denial of service vulnerability was reported in Check Point Endpoint Security Client for Windows before E82.10, that could allow service lCheck Point Endpoint Security Client for Windows
- CVE-2019-3431All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have encryption problems vulnerability.ZTE ZXCLOUD GoldenData VAP
- CVE-2019-3430All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have an information disclosure vulnerability.ZTE ZXCLOUD GoldenData VAP
- CVE-2019-3429All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have a file reading vulnerability.ZTE ZXCLOUD GoldenData VAP
- CVE-2019-3467Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too perDebian Edu
- CVE-2019-19151On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, F5 BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager
- CVE-2019-6688On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5 and BIG-IQ versions 6.F5 BIG-IP · F5 BIG-IQ
- CVE-2019-5265Huawei Share function in P30 9.1.0.193(C00E190R2P1) smartphone has an improper access control vulnerability.Huawei P30
- CVE-2019-5276Huawei smart phones with earlier versions than ELLE-AL00B 9.1.0.222(C00E220R2P1) have a buffer overflow vulnerability.Huawei ELLE-AL00B
- CVE-2019-5266Huawei Share function in P30 9.1.0.193(C00E190R2P1) smartphone has an insufficient input validation vulnerability.Huawei Share function P30
- CVE-2019-6687On versions 15.0.0-15.0.1.1, the BIG-IP ASM Cloud Security Services profile uses a built-in verification mechanism that fails to properly auF5 BIG-IP ASM
- CVE-2019-19150On versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, the BIG-IP APM system logs tF5 BIG-IP APM
- CVE-2019-6685On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, users with access tF5 BIG-IP
- CVE-2019-6684On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, under certain conditions, a multi-bladed F5 BIG-IP
- CVE-2019-6680On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5, while processing traffic F5 BIG-IP
- CVE-2019-5267Huawei OceanStor SNS3096 V100R002C01 have an information disclosure vulnerability.Huawei OceanStor SNS3096
- CVE-2019-6686On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, the Traffic Management Microkernel (TMM) might stop respoF5 BIG-IP
- CVE-2019-12418When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacApache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2019-6681On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, a memory leak in Multicast Forwarding F5 BIG-IP
- CVE-2019-6679On BIG-IP versions 15.0.0-15.0.1, 14.1.0.2-14.1.2.2, 14.0.0.5-14.0.1, 13.1.1.5-13.1.3.1, 12.1.4.1-12.1.5, 11.6.4-11.6.5, and 11.5.9-11.5.10,F5 BIG-IP
- CVE-2019-6683On versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IP virtual servers witF5 BIG-IP Virtual Edition
- CVE-2019-6678On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, the TMM process may restart when the packet filter feF5 BIG-IP
- CVE-2019-6682On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, the BIG-IP ASM system may consume excessiF5 BIG-IP ASM
- CVE-2019-6677On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, under certain conditions when using custF5 BIG-IP
- CVE-2019-6676On versions 15.0.0-15.0.1, 14.0.0-14.1.2.2, and 13.1.0-13.1.3.1, TMM may restart on BIG-IP Virtual Edition (VE) when using virtio direct desF5 BIG-IP
- CVE-2019-17563When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where anApache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2019-19337A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests.Red Hat Ceph Storage
- CVE-2019-11050Use-after-free in exif parsing under memory sanitizerPHP Group PHP
- CVE-2019-11049mail() may release string with refcount==1 twicePHP Group PHP
- CVE-2019-11047Heap-buffer-overflow READ in exifPHP Group PHP
- CVE-2019-11046Buffer underflow in bc_shift_addsubPHP Group PHP
- CVE-2019-11045DirectoryIterator class silently truncates after a null bytePHP Group PHP
- CVE-2019-11044link() silently truncates after a null byte on WindowsPHP Group PHP
- CVE-2019-19930In libIEC61850 1.4.0, MmsValue_newOctetString in mms/iso_mms/common/mms_value.c has an integer signedness error that can lead to an attempte
- CVE-2019-19931In libIEC61850 1.4.0, MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c has a heap-based buffer overflow.
- CVE-2019-19929An Untrusted Search Path vulnerability in Malwarebytes AdwCleaner before 8.0.1 could cause arbitrary code execution with SYSTEM privileges w
- CVE-2019-19926multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() cal
- CVE-2019-18388A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via malform
- CVE-2019-18389A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows gue
- CVE-2019-18390An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to ca
- CVE-2019-18391A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows gue