# CVEs published 2019-12-30

79 CVEs were published on December 30, 2019: 1 critical, 2 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2019-20159](https://cve.now/CVE-2019-20159.md): An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. (no CVSS)
- [CVE-2019-20160](https://cve.now/CVE-2019-20160.md): An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. (no CVSS)
- [CVE-2019-20161](https://cve.now/CVE-2019-20161.md): An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. (no CVSS)
- [CVE-2019-20162](https://cve.now/CVE-2019-20162.md): An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. (no CVSS)
- [CVE-2019-20163](https://cve.now/CVE-2019-20163.md): An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. (no CVSS)
- [CVE-2019-20164](https://cve.now/CVE-2019-20164.md): An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. (no CVSS)
- [CVE-2019-20165](https://cve.now/CVE-2019-20165.md): An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. (no CVSS)
- [CVE-2019-20166](https://cve.now/CVE-2019-20166.md): An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. (no CVSS)
- [CVE-2019-20167](https://cve.now/CVE-2019-20167.md): An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. (no CVSS)
- [CVE-2019-20168](https://cve.now/CVE-2019-20168.md): An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. (no CVSS)
- [CVE-2019-20169](https://cve.now/CVE-2019-20169.md): An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. (no CVSS)
- [CVE-2019-20170](https://cve.now/CVE-2019-20170.md): An issue was discovered in GPAC version 0.8.0 and 0.9.0-development-20191109. (no CVSS)
- [CVE-2019-20171](https://cve.now/CVE-2019-20171.md): An issue was discovered in GPAC version 0.5.2 and 0.9.0-development-20191109. (no CVSS)
- [CVE-2019-7478](https://cve.now/CVE-2019-7478.md): A vulnerability in GMS allow unauthenticated user to SQL injection in Webservice module. (no CVSS, SonicWall GMS)
- [CVE-2013-2016](https://cve.now/CVE-2013-2016.md): A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. (no CVSS, qemu)
- [CVE-2013-0264](https://cve.now/CVE-2013-0264.md): An import error was introduced in Cumin in the code refactoring in r5310. (no CVSS, cumin)
- [CVE-2018-20488](https://cve.now/CVE-2018-20488.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. (no CVSS)
- [CVE-2018-20489](https://cve.now/CVE-2018-20489.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. (no CVSS)
- [CVE-2018-20490](https://cve.now/CVE-2018-20490.md): An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x be (no CVSS)
- [CVE-2018-20491](https://cve.now/CVE-2018-20491.md): An issue was discovered in GitLab Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. (no CVSS)
- [CVE-2018-20493](https://cve.now/CVE-2018-20493.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. (no CVSS)
- [CVE-2018-20494](https://cve.now/CVE-2018-20494.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. (no CVSS)
- [CVE-2018-20495](https://cve.now/CVE-2018-20495.md): An issue was discovered in GitLab Community and Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before (no CVSS)
- [CVE-2018-20496](https://cve.now/CVE-2018-20496.md): An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x be (no CVSS)
- [CVE-2018-20497](https://cve.now/CVE-2018-20497.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. (no CVSS)
- [CVE-2018-20498](https://cve.now/CVE-2018-20498.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. (no CVSS)
- [CVE-2018-20499](https://cve.now/CVE-2018-20499.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6. (no CVSS)
- [CVE-2018-20501](https://cve.now/CVE-2018-20501.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. (no CVSS)
- [CVE-2018-20507](https://cve.now/CVE-2018-20507.md): An issue was discovered in GitLab Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. (no CVSS)
- [CVE-2013-0196](https://cve.now/CVE-2013-0196.md): A CSRF issue was found in OpenShift Enterprise 1.2. (no CVSS, OpenShift Enterprise)
- [CVE-2012-5663](https://cve.now/CVE-2012-5663.md): The isearch package (textproc/isearch) before 1.47.01nb1 uses the tempnam() function to create insecure temporary files into a publicly-writ (no CVSS, textproc/isearch package)
- [CVE-2012-5645](https://cve.now/CVE-2012-5645.md): A denial of service flaw was found in the way the server component of Freeciv before 2.3.4 processed certain packets. (no CVSS, freeciv)
- [CVE-2012-5474](https://cve.now/CVE-2012-5474.md): The file /etc/openstack-dashboard/local\_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package (no CVSS, python-django-horizon)
- [CVE-2018-7859](https://cve.now/CVE-2018-7859.md): A security vulnerability in D-Link DGS-1510-series switches with firmware 1.20.011, 1.30.007, 1.31.B003 and older that may allow a remote at (no CVSS)
- [CVE-2019-19032](https://cve.now/CVE-2019-19032.md): XMLBlueprint through 16.191112 is affected by XML External Entity Injection. (no CVSS)
- [CVE-2019-16790](https://cve.now/CVE-2019-16790.md): Remote Code Execution in Tiny File Manager (CVSS 6.5, Tiny File Manager)
- [CVE-2019-19031](https://cve.now/CVE-2019-19031.md): Easy XML Editor through v1.7.8 is affected by: XML External Entity Injection. (no CVSS)
- [CVE-2012-5476](https://cve.now/CVE-2012-5476.md): Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which expose (no CVSS, openstack-dashboard)
- [CVE-2019-20149](https://cve.now/CVE-2019-20149.md): ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demons (no CVSS, kind-of)
- [CVE-2019-13445](https://cve.now/CVE-2019-13445.md): An issue was discovered in the ROS communications-related packages (aka ros\_comm or ros-melodic-ros-comm) through 1.14.3. (no CVSS)
- [CVE-2019-13465](https://cve.now/CVE-2019-13465.md): An issue was discovered in the ROS communications-related packages (aka ros\_comm or ros-melodic-ros-comm) through 1.14.3. (no CVSS)
- [CVE-2019-19470](https://cve.now/CVE-2019-19470.md): Unsafe usage of .NET deserialization in Named Pipe message processing allows privilege escalation to NT AUTHORITY\\SYSTEM for a local attacke (no CVSS)
- [CVE-2019-19806](https://cve.now/CVE-2019-19806.md): \_account\_forgot\_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message indicating whether an email address is confi (no CVSS)
- [CVE-2019-19805](https://cve.now/CVE-2019-19805.md): \_account\_forgot\_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether (no CVSS)
- [CVE-2019-19738](https://cve.now/CVE-2019-19738.md): log\_file\_viewer.php in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the lFile parameter on the page, (no CVSS)
- [CVE-2019-19737](https://cve.now/CVE-2019-19737.md): MFScripts YetiShare 3.5.2 through 4.5.3 does not set the SameSite flag on session cookies, allowing the cookie to be sent in cross-site requ (no CVSS)
- [CVE-2019-19736](https://cve.now/CVE-2019-19736.md): MFScripts YetiShare 3.5.2 through 4.5.3 does not set the HttpOnly flag on session cookies, allowing the cookie to be read by script, which c (no CVSS)
- [CVE-2019-19735](https://cve.now/CVE-2019-19735.md): class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on micro (no CVSS)
- [CVE-2019-19734](https://cve.now/CVE-2019-19734.md): \_account\_move\_file\_in\_folder.ajax.php in MFScripts YetiShare 3.5.2 directly inserts values from the fileIds parameter into a SQL string. (no CVSS)
- [CVE-2019-19733](https://cve.now/CVE-2019-19733.md): \_get\_all\_file\_server\_paths.ajax.php (aka get\_all\_file\_server\_paths.ajax.php) in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or (no CVSS)
- [CVE-2019-19732](https://cve.now/CVE-2019-19732.md): translation\_manage\_text.ajax.php and various \*\_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 directly insert values from the aS (no CVSS)
- [CVE-2019-20141](https://cve.now/CVE-2019-20141.md): An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter. (no CVSS)
- [CVE-2019-19739](https://cve.now/CVE-2019-19739.md): MFScripts YetiShare 3.5.2 through 4.5.3 does not set the Secure flag on session cookies, allowing the cookie to be sent over cleartext chann (no CVSS)
- [CVE-2019-17558](https://cve.now/CVE-2019-17558.md): Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. (CVSS 7.5, KEV, Apache Solr · org.apache.solr:solr-core)
- [CVE-2019-20140](https://cve.now/CVE-2019-20140.md): An issue was discovered in libsixel 1.8.4. (no CVSS)
- [CVE-2019-10774](https://cve.now/CVE-2019-10774.md): php-shellcommand versions before 1.6.1 have a command injection vulnerability. (no CVSS, php-shellcommand · mikehaertl/php-shellcommand)
- [CVE-2019-17621](https://cve.now/CVE-2019-17621.md): The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to exec (CVSS 9.8, KEV)
- [CVE-2019-4655](https://cve.now/CVE-2019-4655.md): IBM MQ 9.1.0.0, 9.1.0.1, 9.1.0.2, 9.1.0.3, 9.1.1, 9.1.2, and 9.1.3 is vulnerable to a denial of service attack that would allow an authentic (CVSS 4.3, IBM MQ)
- [CVE-2019-4623](https://cve.now/CVE-2019-4623.md): IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Cognos Analytics)
- [CVE-2019-4343](https://cve.now/CVE-2019-4343.md): IBM Cognos Analytics 11.0 and 11.1 allows overly permissive cross-origin resource sharing which could allow an attacker to transfer private (CVSS 6.5, IBM Cognos Analytics)
- [CVE-2019-4335](https://cve.now/CVE-2019-4335.md): IBM Watson Studio Local 1.2.3 stores key files in the user's home directory which could be obtained by another local user. (CVSS 6.2, IBM Watson Studio Local)
- [CVE-2018-1682](https://cve.now/CVE-2018-1682.md): IBM Watson Studio Local 1.2.3 could disclose sensitive information over the network that an attacked could use in further attacks against th (CVSS 5.3, IBM Watson Studio Local)
- [CVE-2019-20139](https://cve.now/CVE-2019-20139.md): In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or freque (no CVSS)
- [CVE-2019-15024](https://cve.now/CVE-2019-15024.md): In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available (no CVSS, ClickHouse)
- [CVE-2019-16535](https://cve.now/CVE-2019-16535.md): In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve (no CVSS, ClickHouse)
- [CVE-2019-20138](https://cve.now/CVE-2019-20138.md): The HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the default algorithm for libsodium's crypto\_pwh (no CVSS)
- [CVE-2019-20095](https://cve.now/CVE-2019-20095.md): mwifiex\_tm\_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1.6 has some error-handling cases that did no (no CVSS)
- [CVE-2019-20096](https://cve.now/CVE-2019-20096.md): In the Linux kernel before 5.1, there is a memory leak in \_\_feat\_register\_sp() in net/dccp/feat.c, which may cause denial of service, aka CI (no CVSS)
- [CVE-2019-20086](https://cve.now/CVE-2019-20086.md): GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF\_Next in GPMF\_parser.c. (no CVSS)
- [CVE-2019-20087](https://cve.now/CVE-2019-20087.md): GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF\_seekToSamples in GPMF-parse.c for the "matching tags" feature. (no CVSS)
- [CVE-2019-20088](https://cve.now/CVE-2019-20088.md): GoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GetPayload in GPMF\_mp4reader.c. (no CVSS)
- [CVE-2019-20089](https://cve.now/CVE-2019-20089.md): GoPro GPMF-parser 1.2.3 has an heap-based buffer over-read in GPMF\_SeekToSamples in GPMF\_parse.c for the size calculation. (no CVSS)
- [CVE-2019-20090](https://cve.now/CVE-2019-20090.md): An issue was discovered in Bento4 1.5.1.0. (no CVSS)
- [CVE-2019-20091](https://cve.now/CVE-2019-20091.md): An issue was discovered in Bento4 1.5.1.0. (no CVSS)
- [CVE-2019-20092](https://cve.now/CVE-2019-20092.md): An issue was discovered in Bento4 1.5.1.0. (no CVSS)
- [CVE-2019-20093](https://cve.now/CVE-2019-20093.md): The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (NULL poin (no CVSS)
- [CVE-2019-20094](https://cve.now/CVE-2019-20094.md): An issue was discovered in libsixel 1.8.4. (no CVSS)
- [CVE-2019-20085](https://cve.now/CVE-2019-20085.md): TVT NVMS-1000 devices allow GET /.. (CVSS 7.5, KEV)
- [CVE-2019-20079](https://cve.now/CVE-2019-20079.md): The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.