CVEs published December 31, 2019
44 CVEs were published on December 31, 2019: 0 critical, 1 high.
- Published
- 44
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 0
- Unrated
- 43
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- Amazon Blink XT2 Sync Module firmware
- 1
- AVIRA Antivirus Free Antivirus
- 1
- bolt/bolt
- 1
- eglibc
- 1
- gksu-polkit-0.0.3-6.fc18
- 1
- Samba
- 1
- SonicWall SonicOS · SonicWall SonicOSv
- 1
- sylius/grid · sylius/grid-bundle +1
- 1
High 1
Medium, low and unrated 43
- CVE-2015-5595Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack the authentication o
- CVE-2015-5593The sanitize_string function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross
- CVE-2015-5592Incomplete blacklist in sanitize_string in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scripting (XSS) attacks.
- CVE-2015-5591SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands.
- CVE-2019-20198An issue was discovered in ezXML 0.8.3 through 0.8.6.
- CVE-2019-20199An issue was discovered in ezXML 0.8.3 through 0.8.6.
- CVE-2019-20200An issue was discovered in ezXML 0.8.3 through 0.8.6.
- CVE-2019-20201An issue was discovered in ezXML 0.8.3 through 0.8.6.
- CVE-2019-20202An issue was discovered in ezXML 0.8.3 through 0.8.6.
- CVE-2013-7071Cross-site scripting (XSS) vulnerability in the handle_request function in lib/HTTPServer.pm in Monitorix before 3.4.0 allows remote attacke
- CVE-2013-7070The handle_request function in lib/HTTPServer.pm in Monitorix before 3.3.1 allows remote attackers to execute arbitrary commands via shell m
- CVE-2004-2776go.cgi in GoScript 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) query string or (2) artarch
- CVE-2011-3585Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mouSamba
- CVE-2019-20197In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to scheduler
- CVE-2013-4357The eglibc package before 2.14 incorrectly handled the getaddrinfo() function.eglibc
- CVE-2013-4161gksu-polkit-0.0.3-6.fc18 was reported as fixing the issue in CVE-2012-5617 but the patch was improperly applied and it did not fixed the secgksu-polkit-0.0.3-6.fc18
- CVE-2019-3984Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitiAmazon Blink XT2 Sync Module firmware
- CVE-2019-10227openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.
- CVE-2019-14466The GOsa_Filter_Settings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attack
- CVE-2019-12837The Java API in accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several
- CVE-2019-7751A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, formerly PTI Marketing,
- CVE-2019-9197The com.unity3d.kharma protocol handler in Unity Editor 2018.3 allows remote attackers to execute arbitrary code.
- CVE-2019-9207PRTG Network Monitor v7.1.3.3378 allows XSS via the /search.htm searchtext parameter.
- CVE-2019-9206PRTG Network Monitor v7.1.3.3378 allows XSS via the /public/login.htm errormsg or loginurl parameter.
- CVE-2019-9553Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933.bolt/bolt
- CVE-2019-9554In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/
- CVE-2019-9556FiberHome an5506-04-f RP2669 devices have XSS.
- CVE-2019-9668An issue was discovered in rovinbhandari FTP through 2012-03-28.
- CVE-2018-14476GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation.
- CVE-2018-19833The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the
- CVE-2018-19831The ToOwner() function of a smart contract implementation for Cryptbond Network (CBN), an tradable Ethereum ERC20 token, allows attackers to
- CVE-2018-19832The NETM() function of a smart contract implementation for NewIntelTechMedia (NETM), an tradable Ethereum ERC20 token, allows attackers to c
- CVE-2018-19830The UBSexToken() function of a smart contract implementation for Business Alliance Financial Circle (BAFC), an tradable Ethereum ERC20 token
- CVE-2018-19834The quaker function of a smart contract implementation for BOMBBA (BOMB), an tradable Ethereum ERC20 token, allows attackers to change the o
- CVE-2019-10229An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2.
- CVE-2019-12186An issue was discovered in Sylius products.sylius/grid · sylius/grid-bundle +1
- CVE-2019-12273OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications and file uploads.
- CVE-2019-7162An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607.
- CVE-2019-20176In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c.
- CVE-2019-20175An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0.
- CVE-2019-20172Kernel/VM/MemoryManager.cpp in SerenityOS before 2019-12-30 does not reject syscalls with pointers into the kernel-only virtual address spac
- CVE-2019-19927In the Linux kernel 5.0.0-rc7 (as distributed in ubuntu/linux.git on kernel.ubuntu.com), mounting a crafted f2fs filesystem image and perfor
- CVE-2019-7479A vulnerability in SonicOS allow authenticated read-only admin can elevate permissions to configuration mode.SonicWall SonicOS · SonicWall SonicOSv