# CVEs published 2019-12-27

66 CVEs were published on December 27, 2019: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-20052](https://cve.now/CVE-2019-20052.md): A memory leak was discovered in Mat\_VarCalloc in mat.c in matio 1.5.17 because SafeMulDims does not consider the rank==0 case. (no CVSS)
- [CVE-2019-20053](https://cve.now/CVE-2019-20053.md): An invalid memory address dereference was discovered in the canUnpack function in p\_mach.cpp in UPX 3.95 via a crafted Mach-O file. (no CVSS)
- [CVE-2019-20051](https://cve.now/CVE-2019-20051.md): A floating-point exception was discovered in PackLinuxElf::elf\_hash in p\_lx\_elf.cpp in UPX 3.95. (no CVSS)
- [CVE-2014-6420](https://cve.now/CVE-2014-6420.md): Cross-site scripting (XSS) vulnerability in Livefyre LiveComments 3.0 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2014-5289](https://cve.now/CVE-2014-5289.md): Buffer overflow in Senkas Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a POST request. (no CVSS)
- [CVE-2012-4980](https://cve.now/CVE-2012-4980.md): Multiple stack-based buffer overflows in CFProfile.exe in Toshiba ConfigFree Utility 8.0.38 allow user-assisted attackers to execute arbitra (no CVSS)
- [CVE-2014-3136](https://cve.now/CVE-2014-3136.md): Cross-site request forgery (CSRF) vulnerability in D-Link DWR-113 (Rev. (no CVSS)
- [CVE-2014-4550](https://cve.now/CVE-2014-4550.md): Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allow (no CVSS)
- [CVE-2014-4535](https://cve.now/CVE-2014-4535.md): Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject a (no CVSS)
- [CVE-2014-4536](https://cve.now/CVE-2014-4536.md): Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto\_test\_ContactService\_pauseCampaign.php in the Infusionsoft Gravity Forms (no CVSS)
- [CVE-2014-4558](https://cve.now/CVE-2014-4558.md): Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress all (no CVSS)
- [CVE-2014-4548](https://cve.now/CVE-2014-4548.md): Cross-site scripting (XSS) vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress allows remote attack (no CVSS)
- [CVE-2014-4544](https://cve.now/CVE-2014-4544.md): Cross-site scripting (XSS) vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arb (no CVSS)
- [CVE-2014-4539](https://cve.now/CVE-2014-4539.md): Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2014-4567](https://cve.now/CVE-2014-4567.md): Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r\_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downlo (no CVSS)
- [CVE-2019-20047](https://cve.now/CVE-2019-20047.md): An issue was discovered on Alcatel-Lucent OmniVista 4760 devices, and 8770 devices before 4.1.2. (no CVSS)
- [CVE-2019-20048](https://cve.now/CVE-2019-20048.md): An issue was discovered on Alcatel-Lucent OmniVista 8770 devices before 4.1.2. (no CVSS)
- [CVE-2019-20049](https://cve.now/CVE-2019-20049.md): An issue was discovered on Alcatel-Lucent OmniVista 4760 devices. (no CVSS)
- [CVE-2007-0158](https://cve.now/CVE-2007-0158.md): thttpd 2007 has buffer underflow. (no CVSS)
- [CVE-2013-5027](https://cve.now/CVE-2013-5027.md): Collabtive 1.0 has incorrect access control (no CVSS)
- [CVE-2013-4985](https://cve.now/CVE-2013-4985.md): Multiple Vivotek IP Cameras remote authentication bypass that could allow access to the video stream (no CVSS)
- [CVE-2013-4982](https://cve.now/CVE-2013-4982.md): AVTECH AVN801 DVR has a security bypass via the administration login captcha (no CVSS)
- [CVE-2014-4592](https://cve.now/CVE-2014-4592.md): Cross-site scripting (XSS) vulnerability in rss.class/scripts/magpie\_debug.php in the WP-Planet plugin 0.1 and earlier for WordPress allows (no CVSS)
- [CVE-2013-4976](https://cve.now/CVE-2013-4976.md): Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials (no CVSS)
- [CVE-2013-4975](https://cve.now/CVE-2013-4975.md): Hikvision DS-2CD7153-E IP Camera has Privilege Escalation (no CVSS)
- [CVE-2014-4519](https://cve.now/CVE-2014-4519.md): Cross-site scripting (XSS) vulnerability in the Conversador plugin 2.61 and earlier for WordPress allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2013-4868](https://cve.now/CVE-2013-4868.md): Karotz API 12.07.19.00: Session Token Information Disclosure (no CVSS)
- [CVE-2013-4867](https://cve.now/CVE-2013-4867.md): Electronic Arts Karotz Smart Rabbit 12.07.19.00 allows Python module hijacking (no CVSS)
- [CVE-2013-4859](https://cve.now/CVE-2013-4859.md): INSTEON Hub 2242-222 lacks Web and API authentication (no CVSS)
- [CVE-2013-4796](https://cve.now/CVE-2013-4796.md): ReviewBoard 1.6.17 allows code execution by attaching PHP scripts to review request (no CVSS)
- [CVE-2013-4621](https://cve.now/CVE-2013-4621.md): Magnolia CMS before 4.5.9 has multiple access bypass vulnerabilities (no CVSS)
- [CVE-2013-4743](https://cve.now/CVE-2013-4743.md): Static HTTP Server 1.0 has a Local Overflow (no CVSS)
- [CVE-2013-4764](https://cve.now/CVE-2013-4764.md): Samsung Galaxy S3/S4 exposes an unprotected component allowing an unprivileged app to send arbitrary SMS texts to arbitrary destinations wit (no CVSS)
- [CVE-2013-4763](https://cve.now/CVE-2013-4763.md): Samsung Galaxy S3/S4 exposes an unprotected component allowing arbitrary SMS text messages without requesting permission. (no CVSS)
- [CVE-2013-4692](https://cve.now/CVE-2013-4692.md): Xorbin Analog Flash Clock 1.0 extension for Joomia has XSS (no CVSS)
- [CVE-2013-4695](https://cve.now/CVE-2013-4695.md): Winamp 5.63: Invalid Pointer Dereference leading to Arbitrary Code Execution (no CVSS)
- [CVE-2013-4693](https://cve.now/CVE-2013-4693.md): WordPress Xorbin Digital Flash Clock 1.0 has XSS (no CVSS)
- [CVE-2013-4665](https://cve.now/CVE-2013-4665.md): SPBAS Business Automation Software 2012 has CSRF. (no CVSS)
- [CVE-2013-4664](https://cve.now/CVE-2013-4664.md): SPBAS Business Automation Software 2012 has XSS. (no CVSS)
- [CVE-2013-4691](https://cve.now/CVE-2013-4691.md): Sencha Labs Connect has XSS with connect.methodOverride() (no CVSS)
- [CVE-2019-16896](https://cve.now/CVE-2019-16896.md): In K7 Ultimate Security 16.0.0117, the module K7BKCExt.dll (aka the backup module) improperly validates the administrative privileges of the (no CVSS)
- [CVE-2016-1000029](https://cve.now/CVE-2016-1000029.md): Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would potentially impact oth (no CVSS)
- [CVE-2016-1000028](https://cve.now/CVE-2016-1000028.md): Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would only potentially impac (no CVSS)
- [CVE-2014-4559](https://cve.now/CVE-2014-4559.md): Multiple cross-site scripting (XSS) vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for (no CVSS)
- [CVE-2014-4525](https://cve.now/CVE-2014-4525.md): Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie\_slashbox.php in the Ebay Feeds for WordPress plugin 1.1 and earlier for Wo (no CVSS)
- [CVE-2014-4523](https://cve.now/CVE-2014-4523.md): Cross-site scripting (XSS) vulnerability in the Easy Career Openings plugin 0.4 and earlier for WordPress allows remote attackers to inject (no CVSS)
- [CVE-2019-19781](https://cve.now/CVE-2019-19781.md): An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. (CVSS 9.8, KEV)
- [CVE-2019-20041](https://cve.now/CVE-2019-20041.md): wp\_kses\_bad\_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass (no CVSS)
- [CVE-2019-20042](https://cve.now/CVE-2019-20042.md): In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp\_targeted\_link\_rel() can be used in a particular way to result in a (no CVSS)
- [CVE-2019-20043](https://cve.now/CVE-2019-20043.md): In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the r (no CVSS)
- [CVE-2019-20016](https://cve.now/CVE-2019-20016.md): libmysofa before 2019-11-24 does not properly restrict recursive function calls, as demonstrated by reports of stack consumption in readOHDR (no CVSS)
- [CVE-2019-20017](https://cve.now/CVE-2019-20017.md): A stack-based buffer over-read was discovered in Mat\_VarReadNextInfo5 in mat5.c in matio 1.5.17. (no CVSS)
- [CVE-2019-20018](https://cve.now/CVE-2019-20018.md): A stack-based buffer over-read was discovered in ReadNextCell in mat5.c in matio 1.5.17. (no CVSS)
- [CVE-2019-20019](https://cve.now/CVE-2019-20019.md): An attempted excessive memory allocation was discovered in Mat\_VarRead5 in mat5.c in matio 1.5.17. (no CVSS)
- [CVE-2019-20020](https://cve.now/CVE-2019-20020.md): A stack-based buffer over-read was discovered in ReadNextStructField in mat5.c in matio 1.5.17. (no CVSS)
- [CVE-2019-20021](https://cve.now/CVE-2019-20021.md): A heap-based buffer over-read was discovered in canUnpack in p\_mach.cpp in UPX 3.95 via a crafted Mach-O file. (no CVSS)
- [CVE-2019-20022](https://cve.now/CVE-2019-20022.md): An invalid memory address dereference was discovered in load\_pnm in frompnm.c in libsixel before 1.8.3. (no CVSS)
- [CVE-2019-20024](https://cve.now/CVE-2019-20024.md): A heap-based buffer overflow was discovered in image\_buffer\_resize in fromsixel.c in libsixel before 1.8.4. (no CVSS)
- [CVE-2019-20023](https://cve.now/CVE-2019-20023.md): A memory leak was discovered in image\_buffer\_resize in fromsixel.c in libsixel 1.8.4. (no CVSS)
- [CVE-2019-20009](https://cve.now/CVE-2019-20009.md): An issue was discovered in GNU LibreDWG before 0.93. (no CVSS)
- [CVE-2019-20011](https://cve.now/CVE-2019-20011.md): An issue was discovered in GNU LibreDWG 0.92. (no CVSS)
- [CVE-2019-20012](https://cve.now/CVE-2019-20012.md): An issue was discovered in GNU LibreDWG 0.92. (no CVSS)
- [CVE-2019-20013](https://cve.now/CVE-2019-20013.md): An issue was discovered in GNU LibreDWG before 0.93. (no CVSS)
- [CVE-2019-20014](https://cve.now/CVE-2019-20014.md): An issue was discovered in GNU LibreDWG before 0.93. (no CVSS)
- [CVE-2019-20015](https://cve.now/CVE-2019-20015.md): An issue was discovered in GNU LibreDWG 0.92. (no CVSS)
- [CVE-2019-20010](https://cve.now/CVE-2019-20010.md): An issue was discovered in GNU LibreDWG 0.92. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.