CVEs published December 27, 2019
66 CVEs were published on December 27, 2019: 1 critical, 0 high. 1 is now in CISA KEV.
- Published
- 66
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 65
- Now in CISA KEV
- 1
- Fix available
- 0
Critical 1
Medium, low and unrated 65
- CVE-2019-20052A memory leak was discovered in Mat_VarCalloc in mat.c in matio 1.5.17 because SafeMulDims does not consider the rank==0 case.
- CVE-2019-20053An invalid memory address dereference was discovered in the canUnpack function in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.
- CVE-2019-20051A floating-point exception was discovered in PackLinuxElf::elf_hash in p_lx_elf.cpp in UPX 3.95.
- CVE-2014-6420Cross-site scripting (XSS) vulnerability in Livefyre LiveComments 3.0 allows remote attackers to inject arbitrary web script or HTML via the
- CVE-2014-5289Buffer overflow in Senkas Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a POST request.
- CVE-2012-4980Multiple stack-based buffer overflows in CFProfile.exe in Toshiba ConfigFree Utility 8.0.38 allow user-assisted attackers to execute arbitra
- CVE-2014-3136Cross-site request forgery (CSRF) vulnerability in D-Link DWR-113 (Rev.
- CVE-2014-4550Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allow
- CVE-2014-4535Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject a
- CVE-2014-4536Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms
- CVE-2014-4558Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress all
- CVE-2014-4548Cross-site scripting (XSS) vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress allows remote attack
- CVE-2014-4544Cross-site scripting (XSS) vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arb
- CVE-2014-4539Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web
- CVE-2014-4567Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downlo
- CVE-2019-20047An issue was discovered on Alcatel-Lucent OmniVista 4760 devices, and 8770 devices before 4.1.2.
- CVE-2019-20048An issue was discovered on Alcatel-Lucent OmniVista 8770 devices before 4.1.2.
- CVE-2019-20049An issue was discovered on Alcatel-Lucent OmniVista 4760 devices.
- CVE-2007-0158thttpd 2007 has buffer underflow.
- CVE-2013-5027Collabtive 1.0 has incorrect access control
- CVE-2013-4985Multiple Vivotek IP Cameras remote authentication bypass that could allow access to the video stream
- CVE-2013-4982AVTECH AVN801 DVR has a security bypass via the administration login captcha
- CVE-2014-4592Cross-site scripting (XSS) vulnerability in rss.class/scripts/magpie_debug.php in the WP-Planet plugin 0.1 and earlier for WordPress allows
- CVE-2013-4976Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials
- CVE-2013-4975Hikvision DS-2CD7153-E IP Camera has Privilege Escalation
- CVE-2014-4519Cross-site scripting (XSS) vulnerability in the Conversador plugin 2.61 and earlier for WordPress allows remote attackers to inject arbitrar
- CVE-2013-4868Karotz API 12.07.19.00: Session Token Information Disclosure
- CVE-2013-4867Electronic Arts Karotz Smart Rabbit 12.07.19.00 allows Python module hijacking
- CVE-2013-4859INSTEON Hub 2242-222 lacks Web and API authentication
- CVE-2013-4796ReviewBoard 1.6.17 allows code execution by attaching PHP scripts to review request
- CVE-2013-4621Magnolia CMS before 4.5.9 has multiple access bypass vulnerabilities
- CVE-2013-4743Static HTTP Server 1.0 has a Local Overflow
- CVE-2013-4764Samsung Galaxy S3/S4 exposes an unprotected component allowing an unprivileged app to send arbitrary SMS texts to arbitrary destinations wit
- CVE-2013-4763Samsung Galaxy S3/S4 exposes an unprotected component allowing arbitrary SMS text messages without requesting permission.
- CVE-2013-4692Xorbin Analog Flash Clock 1.0 extension for Joomia has XSS
- CVE-2013-4695Winamp 5.63: Invalid Pointer Dereference leading to Arbitrary Code Execution
- CVE-2013-4693WordPress Xorbin Digital Flash Clock 1.0 has XSS
- CVE-2013-4665SPBAS Business Automation Software 2012 has CSRF.
- CVE-2013-4664SPBAS Business Automation Software 2012 has XSS.
- CVE-2013-4691Sencha Labs Connect has XSS with connect.methodOverride()
- CVE-2019-16896In K7 Ultimate Security 16.0.0117, the module K7BKCExt.dll (aka the backup module) improperly validates the administrative privileges of the
- CVE-2016-1000029Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would potentially impact oth
- CVE-2016-1000028Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would only potentially impac
- CVE-2014-4559Multiple cross-site scripting (XSS) vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for
- CVE-2014-4525Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in the Ebay Feeds for WordPress plugin 1.1 and earlier for Wo
- CVE-2014-4523Cross-site scripting (XSS) vulnerability in the Easy Career Openings plugin 0.4 and earlier for WordPress allows remote attackers to inject
- CVE-2019-20041wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass
- CVE-2019-20042In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a
- CVE-2019-20043In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the r
- CVE-2019-20016libmysofa before 2019-11-24 does not properly restrict recursive function calls, as demonstrated by reports of stack consumption in readOHDR
- CVE-2019-20017A stack-based buffer over-read was discovered in Mat_VarReadNextInfo5 in mat5.c in matio 1.5.17.
- CVE-2019-20018A stack-based buffer over-read was discovered in ReadNextCell in mat5.c in matio 1.5.17.
- CVE-2019-20019An attempted excessive memory allocation was discovered in Mat_VarRead5 in mat5.c in matio 1.5.17.
- CVE-2019-20020A stack-based buffer over-read was discovered in ReadNextStructField in mat5.c in matio 1.5.17.
- CVE-2019-20021A heap-based buffer over-read was discovered in canUnpack in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.
- CVE-2019-20022An invalid memory address dereference was discovered in load_pnm in frompnm.c in libsixel before 1.8.3.
- CVE-2019-20024A heap-based buffer overflow was discovered in image_buffer_resize in fromsixel.c in libsixel before 1.8.4.
- CVE-2019-20023A memory leak was discovered in image_buffer_resize in fromsixel.c in libsixel 1.8.4.
- CVE-2019-20009An issue was discovered in GNU LibreDWG before 0.93.
- CVE-2019-20011An issue was discovered in GNU LibreDWG 0.92.
- CVE-2019-20012An issue was discovered in GNU LibreDWG 0.92.
- CVE-2019-20013An issue was discovered in GNU LibreDWG before 0.93.
- CVE-2019-20014An issue was discovered in GNU LibreDWG before 0.93.
- CVE-2019-20015An issue was discovered in GNU LibreDWG 0.92.
- CVE-2019-20010An issue was discovered in GNU LibreDWG 0.92.