# CVEs published 2019-12-26

72 CVEs were published on December 26, 2019: 0 critical, 2 high. Days are UTC.

- [CVE-2013-3088](https://cve.now/CVE-2013-3088.md): Belkin N900 router (F9K1104v1) contains an Authentication Bypass using "Javascript debugging". (no CVSS)
- [CVE-2019-20008](https://cve.now/CVE-2019-20008.md): In Archery before 1.3, inserting an XSS payload into a project name (either by creating a new project or editing an existing one) will resul (no CVSS, pyarchery)
- [CVE-2013-3085](https://cve.now/CVE-2013-3085.md): An authentication bypass exists in the web management interface in Belkin F5D8236-4 v2. (no CVSS)
- [CVE-2019-20005](https://cve.now/CVE-2019-20005.md): An issue was discovered in ezXML 0.8.3 through 0.8.6. (no CVSS)
- [CVE-2019-20006](https://cve.now/CVE-2019-20006.md): An issue was discovered in ezXML 0.8.3 through 0.8.6. (no CVSS)
- [CVE-2019-20007](https://cve.now/CVE-2019-20007.md): An issue was discovered in ezXML 0.8.2 through 0.8.6. (no CVSS)
- [CVE-2013-2011](https://cve.now/CVE-2013-2011.md): WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitr (no CVSS, Super Cache Plugin)
- [CVE-2013-4318](https://cve.now/CVE-2013-4318.md): File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory. (no CVSS, Features)
- [CVE-2012-4420](https://cve.now/CVE-2012-4420.md): An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 inco (no CVSS, java-1.7.0-openjdk)
- [CVE-2015-5290](https://cve.now/CVE-2015-5290.md): A Denial of Service vulnerability exists in ircd-ratbox 3.0.9 in the MONITOR Command Handler. (no CVSS, ircd-ratbox)
- [CVE-2019-19389](https://cve.now/CVE-2019-19389.md): JetBrains Ktor framework before version 1.2.6 was vulnerable to HTTP Response Splitting. (no CVSS)
- [CVE-2012-3462](https://cve.now/CVE-2012-3462.md): A flaw was found in SSSD version 1.9.0. (no CVSS, sssd)
- [CVE-2012-2736](https://cve.now/CVE-2012-2736.md): In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an open/insecure network (no CVSS, network-manager)
- [CVE-2019-5273](https://cve.now/CVE-2019-5273.md): USG9500 with versions of V500R001C30;V500R001C60 have a denial of service vulnerability. (no CVSS, Huawei USG9500)
- [CVE-2011-1474](https://cve.now/CVE-2011-1474.md): A locally locally exploitable DOS vulnerability was found in pax-linux versions 2.6.32.33-test79.patch, 2.6.38-test3.patch, and 2.6.37.4-tes (no CVSS)
- [CVE-2019-5274](https://cve.now/CVE-2019-5274.md): USG9500 with versions of V500R001C30;V500R001C60 have a denial of service vulnerability. (no CVSS, Huawei USG9500)
- [CVE-2019-5275](https://cve.now/CVE-2019-5275.md): USG9500 with versions of V500R001C30;V500R001C60 have a denial of service vulnerability. (no CVSS, Huawei USG9500)
- [CVE-2019-5272](https://cve.now/CVE-2019-5272.md): USG9500 with versions of V500R001C30;V500R001C60 have a missing integrity checking vulnerability. (no CVSS, Huawei USG9500)
- [CVE-2019-19398](https://cve.now/CVE-2019-19398.md): M5 lite 10 with versions of 8.0.0.182(C00) have an insufficient input validation vulnerability. (no CVSS, Huawei M5 lite)
- [CVE-2019-19996](https://cve.now/CVE-2019-19996.md): An issue was discovered on Intelbras IWR 3000N 1.8.7 devices. (no CVSS)
- [CVE-2019-19995](https://cve.now/CVE-2019-19995.md): A CSRF issue was discovered on Intelbras IWR 3000N 1.8.7 devices, leading to complete control of the router, as demonstrated by v1/system/us (no CVSS)
- [CVE-2019-16327](https://cve.now/CVE-2019-16327.md): D-Link DIR-601 B1 2.00NA devices are vulnerable to authentication bypass. (no CVSS)
- [CVE-2019-16326](https://cve.now/CVE-2019-16326.md): D-Link DIR-601 B1 2.00NA devices have CSRF because no anti-CSRF token is implemented. (no CVSS)
- [CVE-2019-16781](https://cve.now/CVE-2019-16781.md): Stored cross-site scripting (XSS) in WordPress block editor (CVSS 5.8, WordPress)
- [CVE-2019-16780](https://cve.now/CVE-2019-16780.md): Stored cross-site scripting (XSS) in WordPress block editor (CVSS 5.8, WordPress)
- [CVE-2018-20492](https://cve.now/CVE-2018-20492.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. (no CVSS)
- [CVE-2019-16789](https://cve.now/CVE-2019-16789.md): HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (CVSS 7.1, Pylons Waitress · waitress)
- [CVE-2019-19681](https://cve.now/CVE-2019-19681.md): Pandora FMS 7.x suffers from remote code execution vulnerability. (no CVSS)
- [CVE-2019-15695](https://cve.now/CVE-2019-15695.md): TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. (no CVSS, Kaspersky TigerVNC)
- [CVE-2019-6011](https://cve.now/CVE-2019-6011.md): Cross-site scripting vulnerability in wpDataTables Lite Version 2.0.11 and earlier allows remote attackers to inject arbitrary web script or (no CVSS, TMS-Plugins wpDataTables Lite)
- [CVE-2019-6012](https://cve.now/CVE-2019-6012.md): SQL injection vulnerability in the wpDataTables Lite Version 2.0.11 and earlier allows remote authenticated attackers to execute arbitrary S (no CVSS, TMS-Plugins wpDataTables Lite)
- [CVE-2019-6013](https://cve.now/CVE-2019-6013.md): DBA-1510P firmware 1.70b009 and earlier allows authenticated attackers to execute arbitrary OS commands via Command Line Interface (CLI). (no CVSS, D-Link Japan K.K. DBA-1510P)
- [CVE-2019-6014](https://cve.now/CVE-2019-6014.md): DBA-1510P firmware 1.70b009 and earlier allows an attacker to execute arbitrary OS commands via Web User Interface. (no CVSS, D-Link Japan K.K. DBA-1510P)
- [CVE-2019-6016](https://cve.now/CVE-2019-6016.md): Cross-site scripting vulnerability in REMISE Payment Module (2.11, 2.12 and 2.13) version 3.0.12 and earlier allows remote attackers to inje (no CVSS, REMISE Payment Module)
- [CVE-2019-6017](https://cve.now/CVE-2019-6017.md): REMISE Payment Module (2.11, 2.12 and 2.13) version 3.0.12 and earlier allow remote attackers to \[Disclosed\_Information\_type\] via unspecifie (no CVSS, REMISE Payment Module)
- [CVE-2019-6018](https://cve.now/CVE-2019-6018.md): Cross-site scripting vulnerability in NetCommons 3.2.2 and earlier (NetCommons3.x) allows remote attackers to inject arbitrary web script or (no CVSS, The NetCommons Project NetCommons)
- [CVE-2019-6019](https://cve.now/CVE-2019-6019.md): Untrusted search path vulnerability in STAMP Workbench installer all versions allows an attacker to gain privileges via a Trojan horse DLL i (no CVSS, INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) STAMP…)
- [CVE-2019-6020](https://cve.now/CVE-2019-6020.md): Open redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier (PowerCMS 4.x), and 3.293 and earlier (PowerCMS 3. (no CVSS, Alfasado PowerCMS)
- [CVE-2019-6021](https://cve.now/CVE-2019-6021.md): Open redirect vulnerability in Library Information Management System LIMEDIO all versions allows remote attackers to redirect users to arbit (no CVSS, RICOH COMPANY Library Information Management System LIMEDIO)
- [CVE-2019-6022](https://cve.now/CVE-2019-6022.md): Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.3 allows remote authenticated attackers to alter arbitrary files via the ' (no CVSS, Cybozu Office)
- [CVE-2019-6023](https://cve.now/CVE-2019-6023.md): Cybozu Office 10.0.0 to 10.8.3 allows remote authenticated attackers to bypass access restriction which may result in obtaining data without (no CVSS, Cybozu Office)
- [CVE-2019-6024](https://cve.now/CVE-2019-6024.md): Rakuma App for Android version 7.15.0 and earlier, and for iOS version 7.16.4 and earlier allows an attacker to bypass authentication and ob (no CVSS, Rakuten Rakuma App)
- [CVE-2019-6025](https://cve.now/CVE-2019-6025.md): Open redirect vulnerability in Movable Type series Movable Type 7 r.4602 (7.1.3) and earlier (Movable Type 7), Movable Type 6.5.0 and 6.5.1 (no CVSS, Six Apart Movable Type series)
- [CVE-2019-6026](https://cve.now/CVE-2019-6026.md): Privilege escalation vulnerability in Multiple MOTEX products (LanScope Cat client program (MR) and LanScope Cat client program (MR)LanScope (no CVSS, MOTEX.Inc Multiple MOTEX products)
- [CVE-2019-6027](https://cve.now/CVE-2019-6027.md): Cross-site request forgery (CSRF) vulnerability in WP Spell Check 7.1.9 and earlier allows remote attackers to hijack the authentication of (no CVSS, WP Spell Check)
- [CVE-2019-6029](https://cve.now/CVE-2019-6029.md): Cross-site scripting vulnerability in Custom Body Class 0.6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via (no CVSS, Andrei Lupu Custom Body Class)
- [CVE-2019-6030](https://cve.now/CVE-2019-6030.md): Cross-site request forgery (CSRF) vulnerability in Custom Body Class 0.6.0 and earlier allows remote attackers to hijack the authentication (no CVSS, Andrei Lupu Custom Body Class)
- [CVE-2019-6031](https://cve.now/CVE-2019-6031.md): Cross-site scripting vulnerability in KINZA for Windows version 5.9.2 and earlier and for Mac version 5.0.0 and earlier allows remote attack (no CVSS, Dayz KINZA)
- [CVE-2019-6032](https://cve.now/CVE-2019-6032.md): The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof ser (no CVSS, Nippon Television Network NTV News24)
- [CVE-2019-6033](https://cve.now/CVE-2019-6033.md): Cross-site scripting vulnerability in a-blog cms versions prior to Ver.2.10.23 (Ver.2.10.x), Ver.2.9.26 (Ver.2.9.x), and Ver.2.8.64 (Ver.2.8 (no CVSS, appleple a-blog cms)
- [CVE-2019-6034](https://cve.now/CVE-2019-6034.md): a-blog cms versions prior to Ver.2.10.23 (Ver.2.10.x), Ver.2.9.26 (Ver.2.9.x), and Ver.2.8.64 (Ver.2.8.x) allows arbitrary scripts to be exe (no CVSS, appleple a-blog cms)
- [CVE-2019-6035](https://cve.now/CVE-2019-6035.md): Open redirect vulnerability in Athenz v1.8.24 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phish (no CVSS, Verison Media Athenz · com.yahoo.athenz:athenz)
- [CVE-2019-6008](https://cve.now/CVE-2019-6008.md): An unquoted search path vulnerability in Multiple Yokogawa products for Windows (Exaopc (R1.01.00 ? R3.77.00), Exaplog (R1.10.00 ? R3.40.00) (no CVSS, Yokogawa Electric Multiple Yokogawa products for Windows)
- [CVE-2019-15694](https://cve.now/CVE-2019-15694.md): TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. (no CVSS, Kaspersky TigerVNC)
- [CVE-2019-15693](https://cve.now/CVE-2019-15693.md): TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. (no CVSS, Kaspersky TigerVNC)
- [CVE-2019-15692](https://cve.now/CVE-2019-15692.md): TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. (no CVSS, Kaspersky TigerVNC)
- [CVE-2019-15691](https://cve.now/CVE-2019-15691.md): TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder (no CVSS, Kaspersky TigerVNC)
- [CVE-2019-19540](https://cve.now/CVE-2019-19540.md): The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage. (no CVSS)
- [CVE-2019-19541](https://cve.now/CVE-2019-19541.md): The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page. (no CVSS)
- [CVE-2019-19542](https://cve.now/CVE-2019-19542.md): The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page. (no CVSS)
- [CVE-2019-20000](https://cve.now/CVE-2019-20000.md): The malware scan function in BullGuard Premium Protection 20.0.371.8 has a TOCTOU issue that enables a symbolic link attack, allowing privil (no CVSS)
- [CVE-2019-19999](https://cve.now/CVE-2019-19999.md): Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER\_RESOLVER is not used in the FreeMa (no CVSS)
- [CVE-2019-19998](https://cve.now/CVE-2019-19998.md): Xiuno BBS 4.0 allows XXE via plugin/xn\_wechat\_public/route/token.php. (no CVSS)
- [CVE-2019-19979](https://cve.now/CVE-2019-19979.md): A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject mal (CVSS 8.8)
- [CVE-2019-19980](https://cve.now/CVE-2019-19980.md): The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users (Subscriber (CVSS 4.3)
- [CVE-2019-19981](https://cve.now/CVE-2019-19981.md): The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings. (CVSS 5.4)
- [CVE-2019-19982](https://cve.now/CVE-2019-19982.md): The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. (CVSS 6.5)
- [CVE-2019-19983](https://cve.now/CVE-2019-19983.md): In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. (CVSS 4.3)
- [CVE-2019-19984](https://cve.now/CVE-2019-19984.md): The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit\_post capabilities to manage plug (CVSS 6.3)
- [CVE-2019-19985](https://cve.now/CVE-2019-19985.md): The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user informat (CVSS 5.8)
- [CVE-2019-19977](https://cve.now/CVE-2019-19977.md): libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm\_build\_type\_2 in ntlm/ntlmstruct.c, as demonstrated by a st (no CVSS)
- [CVE-2018-18288](https://cve.now/CVE-2018-18288.md): CrushFTP through 8.3.0 is vulnerable to credentials theft via URL redirection. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.