# CVEs published 2019-12-31

44 CVEs were published on December 31, 2019: 0 critical, 1 high. Days are UTC.

- [CVE-2015-5595](https://cve.now/CVE-2015-5595.md): Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack the authentication o (no CVSS)
- [CVE-2015-5593](https://cve.now/CVE-2015-5593.md): The sanitize\_string function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross (no CVSS)
- [CVE-2015-5592](https://cve.now/CVE-2015-5592.md): Incomplete blacklist in sanitize\_string in Zenphoto before 1.4.9 allows remote attackers to conduct cross-site scripting (XSS) attacks. (no CVSS)
- [CVE-2015-5591](https://cve.now/CVE-2015-5591.md): SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands. (no CVSS)
- [CVE-2019-20198](https://cve.now/CVE-2019-20198.md): An issue was discovered in ezXML 0.8.3 through 0.8.6. (no CVSS)
- [CVE-2019-20199](https://cve.now/CVE-2019-20199.md): An issue was discovered in ezXML 0.8.3 through 0.8.6. (no CVSS)
- [CVE-2019-20200](https://cve.now/CVE-2019-20200.md): An issue was discovered in ezXML 0.8.3 through 0.8.6. (no CVSS)
- [CVE-2019-20201](https://cve.now/CVE-2019-20201.md): An issue was discovered in ezXML 0.8.3 through 0.8.6. (no CVSS)
- [CVE-2019-20202](https://cve.now/CVE-2019-20202.md): An issue was discovered in ezXML 0.8.3 through 0.8.6. (no CVSS)
- [CVE-2013-7071](https://cve.now/CVE-2013-7071.md): Cross-site scripting (XSS) vulnerability in the handle\_request function in lib/HTTPServer.pm in Monitorix before 3.4.0 allows remote attacke (no CVSS)
- [CVE-2013-7070](https://cve.now/CVE-2013-7070.md): The handle\_request function in lib/HTTPServer.pm in Monitorix before 3.3.1 allows remote attackers to execute arbitrary commands via shell m (no CVSS)
- [CVE-2004-2776](https://cve.now/CVE-2004-2776.md): go.cgi in GoScript 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) query string or (2) artarch (no CVSS)
- [CVE-2011-3585](https://cve.now/CVE-2011-3585.md): Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mou (no CVSS, Samba)
- [CVE-2019-18568](https://cve.now/CVE-2019-18568.md): Avira Free Antivirus is proned to a local privilege escalation through the execution of kernel code from a restricted user. (CVSS 8.1, AVIRA Antivirus Free Antivirus)
- [CVE-2019-20197](https://cve.now/CVE-2019-20197.md): In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to scheduler (no CVSS)
- [CVE-2013-4357](https://cve.now/CVE-2013-4357.md): The eglibc package before 2.14 incorrectly handled the getaddrinfo() function. (no CVSS, eglibc)
- [CVE-2013-4161](https://cve.now/CVE-2013-4161.md): gksu-polkit-0.0.3-6.fc18 was reported as fixing the issue in CVE-2012-5617 but the patch was improperly applied and it did not fixed the sec (no CVSS, gksu-polkit-0.0.3-6.fc18)
- [CVE-2019-3984](https://cve.now/CVE-2019-3984.md): Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly saniti (no CVSS, Amazon Blink XT2 Sync Module firmware)
- [CVE-2019-10227](https://cve.now/CVE-2019-10227.md): openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component. (no CVSS)
- [CVE-2019-14466](https://cve.now/CVE-2019-14466.md): The GOsa\_Filter\_Settings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attack (no CVSS)
- [CVE-2019-12837](https://cve.now/CVE-2019-12837.md): The Java API in accesuniversitat.gencat.cat 1.7.5 allows remote attackers to get personal information of all registered students via several (no CVSS)
- [CVE-2019-7751](https://cve.now/CVE-2019-7751.md): A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, formerly PTI Marketing, (no CVSS)
- [CVE-2019-9197](https://cve.now/CVE-2019-9197.md): The com.unity3d.kharma protocol handler in Unity Editor 2018.3 allows remote attackers to execute arbitrary code. (no CVSS)
- [CVE-2019-9207](https://cve.now/CVE-2019-9207.md): PRTG Network Monitor v7.1.3.3378 allows XSS via the /search.htm searchtext parameter. (no CVSS)
- [CVE-2019-9206](https://cve.now/CVE-2019-9206.md): PRTG Network Monitor v7.1.3.3378 allows XSS via the /public/login.htm errormsg or loginurl parameter. (no CVSS)
- [CVE-2019-9553](https://cve.now/CVE-2019-9553.md): Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933. (no CVSS, bolt/bolt)
- [CVE-2019-9554](https://cve.now/CVE-2019-9554.md): In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/ (no CVSS)
- [CVE-2019-9556](https://cve.now/CVE-2019-9556.md): FiberHome an5506-04-f RP2669 devices have XSS. (no CVSS)
- [CVE-2019-9668](https://cve.now/CVE-2019-9668.md): An issue was discovered in rovinbhandari FTP through 2012-03-28. (no CVSS)
- [CVE-2018-14476](https://cve.now/CVE-2018-14476.md): GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation. (no CVSS)
- [CVE-2018-19833](https://cve.now/CVE-2018-19833.md): The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the (no CVSS)
- [CVE-2018-19831](https://cve.now/CVE-2018-19831.md): The ToOwner() function of a smart contract implementation for Cryptbond Network (CBN), an tradable Ethereum ERC20 token, allows attackers to (no CVSS)
- [CVE-2018-19832](https://cve.now/CVE-2018-19832.md): The NETM() function of a smart contract implementation for NewIntelTechMedia (NETM), an tradable Ethereum ERC20 token, allows attackers to c (no CVSS)
- [CVE-2018-19830](https://cve.now/CVE-2018-19830.md): The UBSexToken() function of a smart contract implementation for Business Alliance Financial Circle (BAFC), an tradable Ethereum ERC20 token (no CVSS)
- [CVE-2018-19834](https://cve.now/CVE-2018-19834.md): The quaker function of a smart contract implementation for BOMBBA (BOMB), an tradable Ethereum ERC20 token, allows attackers to change the o (no CVSS)
- [CVE-2019-10229](https://cve.now/CVE-2019-10229.md): An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2. (no CVSS)
- [CVE-2019-12186](https://cve.now/CVE-2019-12186.md): An issue was discovered in Sylius products. (no CVSS, sylius/grid · sylius/grid-bundle +1)
- [CVE-2019-12273](https://cve.now/CVE-2019-12273.md): OutSystems Platform 10 through 11 allows ImageResourceDetail.aspx CSRF for content modifications and file uploads. (no CVSS)
- [CVE-2019-7162](https://cve.now/CVE-2019-7162.md): An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. (no CVSS)
- [CVE-2019-20176](https://cve.now/CVE-2019-20176.md): In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c. (no CVSS)
- [CVE-2019-20175](https://cve.now/CVE-2019-20175.md): An issue was discovered in ide\_dma\_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. (no CVSS)
- [CVE-2019-20172](https://cve.now/CVE-2019-20172.md): Kernel/VM/MemoryManager.cpp in SerenityOS before 2019-12-30 does not reject syscalls with pointers into the kernel-only virtual address spac (no CVSS)
- [CVE-2019-19927](https://cve.now/CVE-2019-19927.md): In the Linux kernel 5.0.0-rc7 (as distributed in ubuntu/linux.git on kernel.ubuntu.com), mounting a crafted f2fs filesystem image and perfor (no CVSS)
- [CVE-2019-7479](https://cve.now/CVE-2019-7479.md): A vulnerability in SonicOS allow authenticated read-only admin can elevate permissions to configuration mode. (no CVSS, SonicWall SonicOS · SonicWall SonicOSv)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-12-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.