# CVEs published 2019-12-29

12 CVEs were published on December 29, 2019: 0 critical, 0 high. Days are UTC.

- [CVE-2019-20070](https://cve.now/CVE-2019-20070.md): On Netis DL4323 devices, XSS exists via the urlFQDN parameter to form2url.cgi (aka the Keyword field of the URL Blocking Configuration). (no CVSS)
- [CVE-2019-20071](https://cve.now/CVE-2019-20071.md): On Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs. (no CVSS)
- [CVE-2019-20072](https://cve.now/CVE-2019-20072.md): On Netis DL4323 devices, XSS exists via the form2Ddns.cgi hostname parameter (Dynamic DNS Configuration). (no CVSS)
- [CVE-2019-20073](https://cve.now/CVE-2019-20073.md): On Netis DL4323 devices, XSS exists via the form2userconfig.cgi username parameter (User Account Configuration). (no CVSS)
- [CVE-2019-20074](https://cve.now/CVE-2019-20074.md): On Netis DL4323 devices, any user role can view sensitive information, such as a user password or the FTP password, via the form2saveConf.cg (no CVSS)
- [CVE-2019-20075](https://cve.now/CVE-2019-20075.md): On Netis DL4323 devices, pingrtt\_v6.html has XSS (Ping6 Diagnostic). (no CVSS)
- [CVE-2019-20076](https://cve.now/CVE-2019-20076.md): On Netis DL4323 devices, XSS exists via the form2Ddns.cgi username parameter (DynDns settings of the Dynamic DNS Configuration). (no CVSS)
- [CVE-2019-20063](https://cve.now/CVE-2019-20063.md): hdf/dataobject.c in libmysofa before 0.8 has an uninitialized use of memory, as demonstrated by mysofa2json. (no CVSS)
- [CVE-2019-20058](https://cve.now/CVE-2019-20058.md): Bolt 3.7.0, if Symfony Web Profiler is used, allows XSS because unsanitized search?search= input is shown on the \_profiler page. (no CVSS)
- [CVE-2019-20057](https://cve.now/CVE-2019-20057.md): com.proxyman.NSProxy.HelperTool in Privileged Helper Tool in Proxyman for macOS 1.11.0 and earlier allows an attacker to change the System P (no CVSS)
- [CVE-2019-20056](https://cve.now/CVE-2019-20056.md): stb\_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi\_\_shiftsigned. (no CVSS)
- [CVE-2019-20055](https://cve.now/CVE-2019-20055.md): LuquidPixels LiquiFire OS 4.8.0 allows SSRF via the call%3Durl substring followed by a URL in square brackets. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.