CVEs published December 29, 2019
12 CVEs were published on December 29, 2019: 0 critical, 0 high.
- Published
- 12
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 12
- Now in CISA KEV
- 0
- Fix available
- 0
Medium, low and unrated 12
- CVE-2019-20070On Netis DL4323 devices, XSS exists via the urlFQDN parameter to form2url.cgi (aka the Keyword field of the URL Blocking Configuration).
- CVE-2019-20071On Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs.
- CVE-2019-20072On Netis DL4323 devices, XSS exists via the form2Ddns.cgi hostname parameter (Dynamic DNS Configuration).
- CVE-2019-20073On Netis DL4323 devices, XSS exists via the form2userconfig.cgi username parameter (User Account Configuration).
- CVE-2019-20074On Netis DL4323 devices, any user role can view sensitive information, such as a user password or the FTP password, via the form2saveConf.cg
- CVE-2019-20075On Netis DL4323 devices, pingrtt_v6.html has XSS (Ping6 Diagnostic).
- CVE-2019-20076On Netis DL4323 devices, XSS exists via the form2Ddns.cgi username parameter (DynDns settings of the Dynamic DNS Configuration).
- CVE-2019-20063hdf/dataobject.c in libmysofa before 0.8 has an uninitialized use of memory, as demonstrated by mysofa2json.
- CVE-2019-20058Bolt 3.7.0, if Symfony Web Profiler is used, allows XSS because unsanitized search?search= input is shown on the _profiler page.
- CVE-2019-20057com.proxyman.NSProxy.HelperTool in Privileged Helper Tool in Proxyman for macOS 1.11.0 and earlier allows an attacker to change the System P
- CVE-2019-20056stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.
- CVE-2019-20055LuquidPixels LiquiFire OS 4.8.0 allows SSRF via the call%3Durl substring followed by a URL in square brackets.