# CVEs published 2019-12-23

57 CVEs were published on December 23, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2019-19947](https://cve.now/CVE-2019-19947.md): In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser\_usb (no CVSS)
- [CVE-2019-12568](https://cve.now/CVE-2019-12568.md): Stack-based overflow vulnerability in the logMess function in Open TFTP Server SP 1.66 and earlier allows remote attackers to perform a deni (no CVSS)
- [CVE-2019-12567](https://cve.now/CVE-2019-12567.md): Stack-based overflow vulnerability in the logMess function in Open TFTP Server MT 1.65 and earlier allows remote attackers to perform a deni (no CVSS)
- [CVE-2018-10389](https://cve.now/CVE-2018-10389.md): Format string vulnerability in the logMess function in TFTP Server MT 1.65 and earlier allows remote attackers to perform a denial of servic (no CVSS)
- [CVE-2018-10388](https://cve.now/CVE-2018-10388.md): Format string vulnerability in the logMess function in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of servic (no CVSS)
- [CVE-2018-10387](https://cve.now/CVE-2018-10387.md): Heap-based overflow vulnerability in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or possibly exec (no CVSS)
- [CVE-2019-18211](https://cve.now/CVE-2019-18211.md): An issue was discovered in Orckestra C1 CMS through 6.6. (no CVSS)
- [CVE-2019-7488](https://cve.now/CVE-2019-7488.md): Weak default password cause vulnerability in SonicWall Email Security appliance which leads to attacker gain access to appliance database. (no CVSS, SonicWall Email Security Appliance)
- [CVE-2019-7489](https://cve.now/CVE-2019-7489.md): A vulnerability in SonicWall Email Security appliance allow an unauthenticated user to perform remote code execution. (no CVSS, SonicWall Email Security Appliance)
- [CVE-2019-8293](https://cve.now/CVE-2019-8293.md): Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution. (no CVSS, abcprintf upload-image-with-ajax)
- [CVE-2019-18236](https://cve.now/CVE-2019-18236.md): Multiple buffer overflow vulnerabilities exist when the PLC Editor Version 1.3.5\_20190129 processes project files. (no CVSS, WECON PLC Editor)
- [CVE-2019-5539](https://cve.now/CVE-2019-5539.md): VMware Workstation (15.x prior to 15.5.1) and Horizon View Agent (7.10.x prior to 7.10.1 and 7.5.x prior to 7.5.4) contain a DLL hijacking v (no CVSS, VMware Workstation · VMware Horizon View Agent)
- [CVE-2019-6147](https://cve.now/CVE-2019-6147.md): Forcepoint NGFW Security Management Center (SMC) versions lower than 6.5.12 or 6.7.1 have a rare issue that in specific circumstances can co (no CVSS, Forcepoint NGFW Security Management Center)
- [CVE-2019-5108](https://cve.now/CVE-2019-5108.md): An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. (CVSS 7.4, Linux kernel)
- [CVE-2019-19944](https://cve.now/CVE-2019-19944.md): In libIEC61850 1.4.0, BerDecoder\_decodeUint32 in mms/asn1/ber\_decode.c has an out-of-bounds read, related to intLen and bufPos. (no CVSS)
- [CVE-2019-18234](https://cve.now/CVE-2019-18234.md): Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely execute arbitrary cod (no CVSS, Equinox Control Expert)
- [CVE-2019-8463](https://cve.now/CVE-2019-8463.md): A denial of service vulnerability was reported in Check Point Endpoint Security Client for Windows before E82.10, that could allow service l (no CVSS, Check Point Endpoint Security Client for Windows)
- [CVE-2019-3431](https://cve.now/CVE-2019-3431.md): All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have encryption problems vulnerability. (no CVSS, ZTE ZXCLOUD GoldenData VAP)
- [CVE-2019-3430](https://cve.now/CVE-2019-3430.md): All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have an information disclosure vulnerability. (no CVSS, ZTE ZXCLOUD GoldenData VAP)
- [CVE-2019-3429](https://cve.now/CVE-2019-3429.md): All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have a file reading vulnerability. (no CVSS, ZTE ZXCLOUD GoldenData VAP)
- [CVE-2019-3467](https://cve.now/CVE-2019-3467.md): Debian-edu-config all versions \< 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config \< 0.26, configured too per (no CVSS, Debian Edu)
- [CVE-2019-19151](https://cve.now/CVE-2019-19151.md): On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, (no CVSS, F5 BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager)
- [CVE-2019-6688](https://cve.now/CVE-2019-6688.md): On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5 and BIG-IQ versions 6. (no CVSS, F5 BIG-IP · F5 BIG-IQ)
- [CVE-2019-5265](https://cve.now/CVE-2019-5265.md): Huawei Share function in P30 9.1.0.193(C00E190R2P1) smartphone has an improper access control vulnerability. (no CVSS, Huawei P30)
- [CVE-2019-5276](https://cve.now/CVE-2019-5276.md): Huawei smart phones with earlier versions than ELLE-AL00B 9.1.0.222(C00E220R2P1) have a buffer overflow vulnerability. (no CVSS, Huawei ELLE-AL00B)
- [CVE-2019-5266](https://cve.now/CVE-2019-5266.md): Huawei Share function in P30 9.1.0.193(C00E190R2P1) smartphone has an insufficient input validation vulnerability. (no CVSS, Huawei Share function P30)
- [CVE-2019-6687](https://cve.now/CVE-2019-6687.md): On versions 15.0.0-15.0.1.1, the BIG-IP ASM Cloud Security Services profile uses a built-in verification mechanism that fails to properly au (no CVSS, F5 BIG-IP ASM)
- [CVE-2019-19150](https://cve.now/CVE-2019-19150.md): On versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, the BIG-IP APM system logs t (no CVSS, F5 BIG-IP APM)
- [CVE-2019-6685](https://cve.now/CVE-2019-6685.md): On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, users with access t (no CVSS, F5 BIG-IP)
- [CVE-2019-6684](https://cve.now/CVE-2019-6684.md): On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, under certain conditions, a multi-bladed (no CVSS, F5 BIG-IP)
- [CVE-2019-6680](https://cve.now/CVE-2019-6680.md): On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5, while processing traffic (no CVSS, F5 BIG-IP)
- [CVE-2019-5267](https://cve.now/CVE-2019-5267.md): Huawei OceanStor SNS3096 V100R002C01 have an information disclosure vulnerability. (no CVSS, Huawei OceanStor SNS3096)
- [CVE-2019-6686](https://cve.now/CVE-2019-6686.md): On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, the Traffic Management Microkernel (TMM) might stop respo (no CVSS, F5 BIG-IP)
- [CVE-2019-12418](https://cve.now/CVE-2019-12418.md): When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attac (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2019-6681](https://cve.now/CVE-2019-6681.md): On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, a memory leak in Multicast Forwarding (no CVSS, F5 BIG-IP)
- [CVE-2019-6679](https://cve.now/CVE-2019-6679.md): On BIG-IP versions 15.0.0-15.0.1, 14.1.0.2-14.1.2.2, 14.0.0.5-14.0.1, 13.1.1.5-13.1.3.1, 12.1.4.1-12.1.5, 11.6.4-11.6.5, and 11.5.9-11.5.10, (no CVSS, F5 BIG-IP)
- [CVE-2019-6683](https://cve.now/CVE-2019-6683.md): On versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IP virtual servers wit (no CVSS, F5 BIG-IP Virtual Edition)
- [CVE-2019-6678](https://cve.now/CVE-2019-6678.md): On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, the TMM process may restart when the packet filter fe (no CVSS, F5 BIG-IP)
- [CVE-2019-6682](https://cve.now/CVE-2019-6682.md): On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, the BIG-IP ASM system may consume excessi (no CVSS, F5 BIG-IP ASM)
- [CVE-2019-6677](https://cve.now/CVE-2019-6677.md): On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, under certain conditions when using cust (no CVSS, F5 BIG-IP)
- [CVE-2019-6676](https://cve.now/CVE-2019-6676.md): On versions 15.0.0-15.0.1, 14.0.0-14.1.2.2, and 13.1.0-13.1.3.1, TMM may restart on BIG-IP Virtual Edition (VE) when using virtio direct des (no CVSS, F5 BIG-IP)
- [CVE-2019-17563](https://cve.now/CVE-2019-17563.md): When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2019-19337](https://cve.now/CVE-2019-19337.md): A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. (CVSS 6.5, Red Hat Ceph Storage)
- [CVE-2019-11050](https://cve.now/CVE-2019-11050.md): Use-after-free in exif parsing under memory sanitizer (CVSS 4.8, PHP Group PHP)
- [CVE-2019-11049](https://cve.now/CVE-2019-11049.md): mail() may release string with refcount==1 twice (CVSS 6.5, PHP Group PHP)
- [CVE-2019-11047](https://cve.now/CVE-2019-11047.md): Heap-buffer-overflow READ in exif (CVSS 4.8, PHP Group PHP)
- [CVE-2019-11046](https://cve.now/CVE-2019-11046.md): Buffer underflow in bc\_shift\_addsub (CVSS 3.7, PHP Group PHP)
- [CVE-2019-11045](https://cve.now/CVE-2019-11045.md): DirectoryIterator class silently truncates after a null byte (CVSS 3.7, PHP Group PHP)
- [CVE-2019-11044](https://cve.now/CVE-2019-11044.md): link() silently truncates after a null byte on Windows (CVSS 3.7, PHP Group PHP)
- [CVE-2019-19930](https://cve.now/CVE-2019-19930.md): In libIEC61850 1.4.0, MmsValue\_newOctetString in mms/iso\_mms/common/mms\_value.c has an integer signedness error that can lead to an attempte (no CVSS)
- [CVE-2019-19931](https://cve.now/CVE-2019-19931.md): In libIEC61850 1.4.0, MmsValue\_decodeMmsData in mms/iso\_mms/server/mms\_access\_result.c has a heap-based buffer overflow. (no CVSS)
- [CVE-2019-19929](https://cve.now/CVE-2019-19929.md): An Untrusted Search Path vulnerability in Malwarebytes AdwCleaner before 8.0.1 could cause arbitrary code execution with SYSTEM privileges w (no CVSS)
- [CVE-2019-19926](https://cve.now/CVE-2019-19926.md): multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() cal (no CVSS)
- [CVE-2019-18388](https://cve.now/CVE-2019-18388.md): A NULL pointer dereference in vrend\_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via malform (no CVSS)
- [CVE-2019-18389](https://cve.now/CVE-2019-18389.md): A heap-based buffer overflow in the vrend\_renderer\_transfer\_write\_iov function in vrend\_renderer.c in virglrenderer through 0.8.0 allows gue (no CVSS)
- [CVE-2019-18390](https://cve.now/CVE-2019-18390.md): An out-of-bounds read in the vrend\_blit\_need\_swizzle function in vrend\_renderer.c in virglrenderer through 0.8.0 allows guest OS users to ca (no CVSS)
- [CVE-2019-18391](https://cve.now/CVE-2019-18391.md): A heap-based buffer overflow in the vrend\_renderer\_transfer\_write\_iov function in vrend\_renderer.c in virglrenderer through 0.8.0 allows gue (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.