CVEs published December 30, 2019
79 CVEs were published on December 30, 2019: 1 critical, 2 high. 3 are now in CISA KEV.
- Published
- 79
- Critical
- 1
- High
- 2
- Medium
- 6
- Low
- 0
- Unrated
- 70
- Now in CISA KEV
- 3
- Fix available
- 3
Most affected products
- ClickHouse
- 2
- IBM Cognos Analytics
- 2
- IBM Watson Studio Local
- 2
- Apache Solr · org.apache.solr:solr-core
- 1
- cumin
- 1
- freeciv
- 1
- IBM MQ
- 1
- kind-of
- 1
- OpenShift Enterprise
- 1
- openstack-dashboard
- 1
Critical 1
High 2
Medium, low and unrated 76
- CVE-2019-20159An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109.
- CVE-2019-20160An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109.
- CVE-2019-20161An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109.
- CVE-2019-20162An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109.
- CVE-2019-20163An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109.
- CVE-2019-20164An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109.
- CVE-2019-20165An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109.
- CVE-2019-20166An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109.
- CVE-2019-20167An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109.
- CVE-2019-20168An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109.
- CVE-2019-20169An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109.
- CVE-2019-20170An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109.
- CVE-2019-20171An issue was discovered in GPAC version 0.5.2 and 0.9.0-development-20191109.
- CVE-2019-7478A vulnerability in GMS allow unauthenticated user to SQL injection in Webservice module.SonicWall GMS
- CVE-2013-2016A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device.qemu
- CVE-2013-0264An import error was introduced in Cumin in the code refactoring in r5310.cumin
- CVE-2018-20488An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1.
- CVE-2018-20489An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1.
- CVE-2018-20490An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x be
- CVE-2018-20491An issue was discovered in GitLab Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1.
- CVE-2018-20493An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1.
- CVE-2018-20494An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1.
- CVE-2018-20495An issue was discovered in GitLab Community and Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before
- CVE-2018-20496An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x be
- CVE-2018-20497An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1.
- CVE-2018-20498An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1.
- CVE-2018-20499An issue was discovered in GitLab Community and Enterprise Edition before 11.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.
- CVE-2018-20501An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1.
- CVE-2018-20507An issue was discovered in GitLab Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1.
- CVE-2013-0196A CSRF issue was found in OpenShift Enterprise 1.2.OpenShift Enterprise
- CVE-2012-5663The isearch package (textproc/isearch) before 1.47.01nb1 uses the tempnam() function to create insecure temporary files into a publicly-writtextproc/isearch package
- CVE-2012-5645A denial of service flaw was found in the way the server component of Freeciv before 2.3.4 processed certain packets.freeciv
- CVE-2012-5474The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon packagepython-django-horizon
- CVE-2018-7859A security vulnerability in D-Link DGS-1510-series switches with firmware 1.20.011, 1.30.007, 1.31.B003 and older that may allow a remote at
- CVE-2019-19032XMLBlueprint through 16.191112 is affected by XML External Entity Injection.
- CVE-2019-16790Remote Code Execution in Tiny File ManagerTiny File Manager
- CVE-2019-19031Easy XML Editor through v1.7.8 is affected by: XML External Entity Injection.
- CVE-2012-5476Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposeopenstack-dashboard
- CVE-2019-20149ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonskind-of
- CVE-2019-13445An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3.
- CVE-2019-13465An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3.
- CVE-2019-19470Unsafe usage of .NET deserialization in Named Pipe message processing allows privilege escalation to NT AUTHORITY\SYSTEM for a local attacke
- CVE-2019-19806_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message indicating whether an email address is confi
- CVE-2019-19805_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether
- CVE-2019-19738log_file_viewer.php in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the lFile parameter on the page,
- CVE-2019-19737MFScripts YetiShare 3.5.2 through 4.5.3 does not set the SameSite flag on session cookies, allowing the cookie to be sent in cross-site requ
- CVE-2019-19736MFScripts YetiShare 3.5.2 through 4.5.3 does not set the HttpOnly flag on session cookies, allowing the cookie to be read by script, which c
- CVE-2019-19735class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on micro
- CVE-2019-19734_account_move_file_in_folder.ajax.php in MFScripts YetiShare 3.5.2 directly inserts values from the fileIds parameter into a SQL string.
- CVE-2019-19733_get_all_file_server_paths.ajax.php (aka get_all_file_server_paths.ajax.php) in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or
- CVE-2019-19732translation_manage_text.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 directly insert values from the aS
- CVE-2019-20141An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.
- CVE-2019-19739MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Secure flag on session cookies, allowing the cookie to be sent over cleartext chann
- CVE-2019-20140An issue was discovered in libsixel 1.8.4.
- CVE-2019-10774php-shellcommand versions before 1.6.1 have a command injection vulnerability.php-shellcommand · mikehaertl/php-shellcommand
- CVE-2019-4655IBM MQ 9.1.0.0, 9.1.0.1, 9.1.0.2, 9.1.0.3, 9.1.1, 9.1.2, and 9.1.3 is vulnerable to a denial of service attack that would allow an authenticIBM MQ
- CVE-2019-4623IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting.IBM Cognos Analytics
- CVE-2019-4343IBM Cognos Analytics 11.0 and 11.1 allows overly permissive cross-origin resource sharing which could allow an attacker to transfer private IBM Cognos Analytics
- CVE-2019-4335IBM Watson Studio Local 1.2.3 stores key files in the user's home directory which could be obtained by another local user.IBM Watson Studio Local
- CVE-2018-1682IBM Watson Studio Local 1.2.3 could disclose sensitive information over the network that an attacked could use in further attacks against thIBM Watson Studio Local
- CVE-2019-20139In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or freque
- CVE-2019-15024In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available ClickHouse
- CVE-2019-16535In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve ClickHouse
- CVE-2019-20138The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's crypto_pwh
- CVE-2019-20095mwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handling cases that did no
- CVE-2019-20096In the Linux kernel before 5.1, there is a memory leak in __feat_register_sp() in net/dccp/feat.c, which may cause denial of service, aka CI
- CVE-2019-20086GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_Next in GPMF_parser.c.
- CVE-2019-20087GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_seekToSamples in GPMF-parse.c for the "matching tags" feature.
- CVE-2019-20088GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GetPayload in GPMF_mp4reader.c.
- CVE-2019-20089GoPro GPMF-parser 1.2.3 has an heap-based buffer over-read in GPMF_SeekToSamples in GPMF_parse.c for the size calculation.
- CVE-2019-20090An issue was discovered in Bento4 1.5.1.0.
- CVE-2019-20091An issue was discovered in Bento4 1.5.1.0.
- CVE-2019-20092An issue was discovered in Bento4 1.5.1.0.
- CVE-2019-20093The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (NULL poin
- CVE-2019-20094An issue was discovered in libsixel 1.8.4.
- CVE-2019-20079The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory.