CVEs published December 26, 2019
72 CVEs were published on December 26, 2019: 0 critical, 2 high.
- Published
- 72
- Critical
- 0
- High
- 2
- Medium
- 8
- Low
- 0
- Unrated
- 62
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Kaspersky TigerVNC
- 5
- Huawei USG9500
- 4
- Andrei Lupu Custom Body Class
- 2
- appleple a-blog cms
- 2
- Cybozu Office
- 2
- D-Link Japan K.K. DBA-1510P
- 2
- REMISE Payment Module
- 2
- TMS-Plugins wpDataTables Lite
- 2
- WordPress
- 2
- Alfasado PowerCMS
- 1
High 2
Medium, low and unrated 70
- CVE-2013-3088Belkin N900 router (F9K1104v1) contains an Authentication Bypass using "Javascript debugging".
- CVE-2019-20008In Archery before 1.3, inserting an XSS payload into a project name (either by creating a new project or editing an existing one) will resulpyarchery
- CVE-2013-3085An authentication bypass exists in the web management interface in Belkin F5D8236-4 v2.
- CVE-2019-20005An issue was discovered in ezXML 0.8.3 through 0.8.6.
- CVE-2019-20006An issue was discovered in ezXML 0.8.3 through 0.8.6.
- CVE-2019-20007An issue was discovered in ezXML 0.8.2 through 0.8.6.
- CVE-2013-2011WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitrSuper Cache Plugin
- CVE-2013-4318File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory.Features
- CVE-2012-4420An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incojava-1.7.0-openjdk
- CVE-2015-5290A Denial of Service vulnerability exists in ircd-ratbox 3.0.9 in the MONITOR Command Handler.ircd-ratbox
- CVE-2019-19389JetBrains Ktor framework before version 1.2.6 was vulnerable to HTTP Response Splitting.
- CVE-2012-3462A flaw was found in SSSD version 1.9.0.sssd
- CVE-2012-2736In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an open/insecure networknetwork-manager
- CVE-2019-5273USG9500 with versions of V500R001C30;V500R001C60 have a denial of service vulnerability.Huawei USG9500
- CVE-2011-1474A locally locally exploitable DOS vulnerability was found in pax-linux versions 2.6.32.33-test79.patch, 2.6.38-test3.patch, and 2.6.37.4-tes
- CVE-2019-5274USG9500 with versions of V500R001C30;V500R001C60 have a denial of service vulnerability.Huawei USG9500
- CVE-2019-5275USG9500 with versions of V500R001C30;V500R001C60 have a denial of service vulnerability.Huawei USG9500
- CVE-2019-5272USG9500 with versions of V500R001C30;V500R001C60 have a missing integrity checking vulnerability.Huawei USG9500
- CVE-2019-19398M5 lite 10 with versions of 8.0.0.182(C00) have an insufficient input validation vulnerability.Huawei M5 lite
- CVE-2019-19996An issue was discovered on Intelbras IWR 3000N 1.8.7 devices.
- CVE-2019-19995A CSRF issue was discovered on Intelbras IWR 3000N 1.8.7 devices, leading to complete control of the router, as demonstrated by v1/system/us
- CVE-2019-16327D-Link DIR-601 B1 2.00NA devices are vulnerable to authentication bypass.
- CVE-2019-16326D-Link DIR-601 B1 2.00NA devices have CSRF because no anti-CSRF token is implemented.
- CVE-2019-16781Stored cross-site scripting (XSS) in WordPress block editorWordPress
- CVE-2019-16780Stored cross-site scripting (XSS) in WordPress block editorWordPress
- CVE-2018-20492An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1.
- CVE-2019-19681Pandora FMS 7.x suffers from remote code execution vulnerability.
- CVE-2019-15695TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor.Kaspersky TigerVNC
- CVE-2019-6011Cross-site scripting vulnerability in wpDataTables Lite Version 2.0.11 and earlier allows remote attackers to inject arbitrary web script orTMS-Plugins wpDataTables Lite
- CVE-2019-6012SQL injection vulnerability in the wpDataTables Lite Version 2.0.11 and earlier allows remote authenticated attackers to execute arbitrary STMS-Plugins wpDataTables Lite
- CVE-2019-6013DBA-1510P firmware 1.70b009 and earlier allows authenticated attackers to execute arbitrary OS commands via Command Line Interface (CLI).D-Link Japan K.K. DBA-1510P
- CVE-2019-6014DBA-1510P firmware 1.70b009 and earlier allows an attacker to execute arbitrary OS commands via Web User Interface.D-Link Japan K.K. DBA-1510P
- CVE-2019-6016Cross-site scripting vulnerability in REMISE Payment Module (2.11, 2.12 and 2.13) version 3.0.12 and earlier allows remote attackers to injeREMISE Payment Module
- CVE-2019-6017REMISE Payment Module (2.11, 2.12 and 2.13) version 3.0.12 and earlier allow remote attackers to [Disclosed_Information_type] via unspecifieREMISE Payment Module
- CVE-2019-6018Cross-site scripting vulnerability in NetCommons 3.2.2 and earlier (NetCommons3.x) allows remote attackers to inject arbitrary web script orThe NetCommons Project NetCommons
- CVE-2019-6019Untrusted search path vulnerability in STAMP Workbench installer all versions allows an attacker to gain privileges via a Trojan horse DLL iINFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) STAMP…
- CVE-2019-6020Open redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3.Alfasado PowerCMS
- CVE-2019-6021Open redirect vulnerability in Library Information Management System LIMEDIO all versions allows remote attackers to redirect users to arbitRICOH COMPANY Library Information Management System LIMEDIO
- CVE-2019-6022Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.3 allows remote authenticated attackers to alter arbitrary files via the 'Cybozu Office
- CVE-2019-6023Cybozu Office 10.0.0 to 10.8.3 allows remote authenticated attackers to bypass access restriction which may result in obtaining data withoutCybozu Office
- CVE-2019-6024Rakuma App for Android version 7.15.0 and earlier, and for iOS version 7.16.4 and earlier allows an attacker to bypass authentication and obRakuten Rakuma App
- CVE-2019-6025Open redirect vulnerability in Movable Type series Movable Type 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type 6.5.0 and 6.5.1 Six Apart Movable Type series
- CVE-2019-6026Privilege escalation vulnerability in Multiple MOTEX products (LanScope Cat client program (MR) and LanScope Cat client program (MR)LanScopeMOTEX.Inc Multiple MOTEX products
- CVE-2019-6027Cross-site request forgery (CSRF) vulnerability in WP Spell Check 7.1.9 and earlier allows remote attackers to hijack the authentication of WP Spell Check
- CVE-2019-6029Cross-site scripting vulnerability in Custom Body Class 0.6.0 and earlier allows remote attackers to inject arbitrary web script or HTML viaAndrei Lupu Custom Body Class
- CVE-2019-6030Cross-site request forgery (CSRF) vulnerability in Custom Body Class 0.6.0 and earlier allows remote attackers to hijack the authentication Andrei Lupu Custom Body Class
- CVE-2019-6031Cross-site scripting vulnerability in KINZA for Windows version 5.9.2 and earlier and for Mac version 5.0.0 and earlier allows remote attackDayz KINZA
- CVE-2019-6032The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serNippon Television Network NTV News24
- CVE-2019-6033Cross-site scripting vulnerability in a-blog cms versions prior to Ver.2.10.23 (Ver.2.10.x), Ver.2.9.26 (Ver.2.9.x), and Ver.2.8.64 (Ver.2.8appleple a-blog cms
- CVE-2019-6034a-blog cms versions prior to Ver.2.10.23 (Ver.2.10.x), Ver.2.9.26 (Ver.2.9.x), and Ver.2.8.64 (Ver.2.8.x) allows arbitrary scripts to be exeappleple a-blog cms
- CVE-2019-6035Open redirect vulnerability in Athenz v1.8.24 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishVerison Media Athenz · com.yahoo.athenz:athenz
- CVE-2019-6008An unquoted search path vulnerability in Multiple Yokogawa products for Windows (Exaopc (R1.01.00 ? R3.77.00), Exaplog (R1.10.00 ? R3.40.00)Yokogawa Electric Multiple Yokogawa products for Windows
- CVE-2019-15694TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect.Kaspersky TigerVNC
- CVE-2019-15693TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient.Kaspersky TigerVNC
- CVE-2019-15692TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow.Kaspersky TigerVNC
- CVE-2019-15691TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoderKaspersky TigerVNC
- CVE-2019-19540The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.
- CVE-2019-19541The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page.
- CVE-2019-19542The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page.
- CVE-2019-20000The malware scan function in BullGuard Premium Protection 20.0.371.8 has a TOCTOU issue that enables a symbolic link attack, allowing privil
- CVE-2019-19999Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMa
- CVE-2019-19998Xiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php.
- CVE-2019-19980The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users (Subscriber
- CVE-2019-19981The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings.
- CVE-2019-19982The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation.
- CVE-2019-19983In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered.
- CVE-2019-19984The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plug
- CVE-2019-19985The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user informat
- CVE-2019-19977libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a st
- CVE-2018-18288CrushFTP through 8.3.0 is vulnerable to credentials theft via URL redirection.