Weekly Vulnerabilities Reports > December 16 to 22, 2019

Overview

579 new vulnerabilities reported during this period, including 80 critical vulnerabilities and 83 high severity vulnerabilities. This weekly summary report vulnerabilities in 846 products from 124 vendors including Apple, Intel, Jenkins, Qualcomm, and Adobe. Vulnerabilities are notably categorized as "Out-of-bounds Write", "Improper Input Validation", "Cross-site Scripting", "Out-of-bounds Read", and "Improper Restriction of Operations within the Bounds of a Memory Buffer".

  • 449 reported vulnerabilities are remotely exploitables.
  • 2 reported vulnerabilities have public exploit available.
  • 101 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
  • 508 reported vulnerabilities are exploitable by an anonymous user.
  • Apple has the most reported vulnerabilities, with 247 reported vulnerabilities.
  • Apple has the most reported critical vulnerabilities, with 45 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

80 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2019-12-20 CVE-2019-17440 Paloaltonetworks Unspecified vulnerability in Paloaltonetworks Pan-Os

Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Switch Management Card (SMC) may allow an attacker with network access to the LFC to gain root access to PAN-OS.

10.0
2019-12-19 CVE-2019-8255 Adobe Command Injection vulnerability in Adobe Brackets 1.14/1.6

Brackets versions 1.14 and earlier have a command injection vulnerability.

10.0
2019-12-19 CVE-2019-16464 Adobe Use After Free vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability.

10.0
2019-12-19 CVE-2019-16463 Adobe Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an untrusted pointer dereference vulnerability.

10.0
2019-12-19 CVE-2019-16462 Adobe Unspecified vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have a buffer error vulnerability.

10.0
2019-12-19 CVE-2019-16460 Adobe Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an untrusted pointer dereference vulnerability.

10.0
2019-12-19 CVE-2019-16459 Adobe Use After Free vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability.

10.0
2019-12-19 CVE-2019-16455 Adobe Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an untrusted pointer dereference vulnerability.

10.0
2019-12-19 CVE-2019-16454 Adobe Out-of-bounds Write vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an out-of-bounds write vulnerability.

10.0
2019-12-19 CVE-2019-16453 Adobe Unspecified vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have a security bypass vulnerability.

10.0
2019-12-19 CVE-2019-16452 Adobe Use After Free vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability.

10.0
2019-12-19 CVE-2019-16451 Adobe Out-of-bounds Write vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have a heap overflow vulnerability.

10.0
2019-12-19 CVE-2019-16450 Adobe Out-of-bounds Write vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an out-of-bounds write vulnerability.

10.0
2019-12-19 CVE-2019-16448 Adobe Use After Free vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability.

10.0
2019-12-19 CVE-2019-16446 Adobe Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an untrusted pointer dereference vulnerability.

10.0
2019-12-19 CVE-2019-16445 Adobe Use After Free vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an use after free vulnerability.

10.0
2019-12-18 CVE-2019-5075 Wago Out-of-bounds Write vulnerability in Wago PFC 100 Firmware and PFC 200 Firmware

An exploitable stack buffer overflow vulnerability exists in the command line utility getcouplerdetails of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12).

10.0
2019-12-18 CVE-2019-5081 Wago Classic Buffer Overflow vulnerability in Wago PFC 100 Firmware and PFC 200 Firmware

An exploitable heap buffer overflow vulnerability exists in the iocheckd service ''I/O-Chec'' functionality of WAGO PFC 200 Firmware version 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12).

10.0
2019-12-18 CVE-2019-5074 Wago Classic Buffer Overflow vulnerability in Wago PFC 100 Firmware and PFC 200 Firmware

An exploitable stack buffer overflow vulnerability exists in the iocheckd service ''I/O-Check'' functionality of WAGO PFC200 Firmware version 03.01.07(13), WAGO PFC200 Firmware version 03.00.39(12) and WAGO PFC100 Firmware version 03.00.39(12).

10.0
2019-12-18 CVE-2019-4716 IBM Path Traversal vulnerability in IBM Planning Analytics

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting.

10.0
2019-12-18 CVE-2019-11399 Trendnet OS Command Injection vulnerability in Trendnet products

An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices.

10.0
2019-12-18 CVE-2019-2242 Qualcomm Integer Overflow or Wraparound vulnerability in Qualcomm products

Device memory may get corrupted because of buffer overflow/underflow.

10.0
2019-12-18 CVE-2019-10557 Qualcomm Out-of-bounds Read vulnerability in Qualcomm products

Out-of-bound read in the wireless driver in the Linux kernel due to lack of check of buffer length.

10.0
2019-12-18 CVE-2019-10525 Qualcomm Out-of-bounds Write vulnerability in Qualcomm products

Buffer overflow during SIB read when network configures complete sib list along with first and last segment of other SIB in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, MDM9150, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130

10.0
2019-12-18 CVE-2019-10516 Qualcomm Out-of-bounds Read vulnerability in Qualcomm products

Multiple read overflows in MM while decoding service accept,service reject,attach reject and MT detach in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130

10.0
2019-12-18 CVE-2019-10500 Qualcomm Incorrect Calculation of Buffer Size vulnerability in Qualcomm products

While processing MT Secondary PDP request, Buffer overflow will happen due to incorrect calculation of buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130

10.0
2019-12-18 CVE-2019-10487 Qualcomm Out-of-bounds Read vulnerability in Qualcomm products

Buffer over read can happen while parsing SMS OTA messages at transport layer if network sends un-intended values in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130

10.0
2019-12-16 CVE-2019-18830 Barco OS Command Injection vulnerability in Barco products

Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection.

10.0
2019-12-18 CVE-2019-5078 Wago Missing Authentication for Critical Function vulnerability in Wago PFC 100 Firmware and PFC 200 Firmware

An exploitable denial of service vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12).

9.4
2019-12-18 CVE-2019-8527 Apple Classic Buffer Overflow vulnerability in Apple products

A buffer overflow was addressed with improved size validation.

9.4
2019-12-19 CVE-2019-16871 Beckhoff Improper Input Validation vulnerability in Beckhoff Twincat 2.0/3.0/3.1

Beckhoff Embedded Windows PLCs through 3.1.4024.0, and Beckhoff Twincat on Windows Engineering stations, allow an attacker to achieve Remote Code Execution (as SYSTEM) via the Beckhoff ADS protocol.

9.3
2019-12-19 CVE-2019-8254 Adobe Out-of-bounds Write vulnerability in Adobe Photoshop CC

Adobe Photoshop CC versions before 20.0.8 and 21.0.x before 21.0.2 have a memory corruption vulnerability.

9.3
2019-12-19 CVE-2019-8253 Adobe Out-of-bounds Write vulnerability in Adobe Photoshop CC

Adobe Photoshop CC versions before 20.0.8 and 21.0.x before 21.0.2 have a memory corruption vulnerability.

9.3
2019-12-18 CVE-2019-8816 Apple
Redhat
Out-of-bounds Write vulnerability in multiple products

Multiple memory corruption issues were addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8815 Apple
Redhat
Out-of-bounds Write vulnerability in multiple products

Multiple memory corruption issues were addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8814 Apple
Redhat
Out-of-bounds Write vulnerability in multiple products

Multiple memory corruption issues were addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8807 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple mac OS X

A memory corruption issue was addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8805 Apple Improper Input Validation vulnerability in Apple mac OS X

A validation issue existed in the entitlement verification.

9.3
2019-12-18 CVE-2019-8802 Apple Improper Input Validation vulnerability in Apple mac OS X

A validation issue was addressed with improved logic.

9.3
2019-12-18 CVE-2019-8797 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple products

A memory corruption issue was addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8795 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple Ipados and Iphone OS

A memory corruption issue was addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8786 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple products

A memory corruption issue was addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8785 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple products

A memory corruption issue was addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8784 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple products

A memory corruption issue was addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8781 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple mac OS X

A memory corruption issue was addressed with improved state management.

9.3
2019-12-18 CVE-2019-8747 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple Watchos

A memory corruption vulnerability was addressed with improved locking.

9.3
2019-12-18 CVE-2019-8724 Apple Improper Input Validation vulnerability in Apple Xcode

Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4.

9.3
2019-12-18 CVE-2019-8723 Apple Improper Input Validation vulnerability in Apple Xcode

Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4.

9.3
2019-12-18 CVE-2019-8722 Apple Improper Input Validation vulnerability in Apple Xcode

Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4.

9.3
2019-12-18 CVE-2019-8721 Apple Improper Input Validation vulnerability in Apple Xcode

Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4.

9.3
2019-12-18 CVE-2019-8695 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple mac OS X

A memory corruption issue was addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8694 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple mac OS X

A memory corruption issue was addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8689 Apple
Redhat
Out-of-bounds Write vulnerability in multiple products

Multiple memory corruption issues were addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8688 Apple
Redhat
Out-of-bounds Write vulnerability in multiple products

Multiple memory corruption issues were addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8685 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8684 Apple
Redhat
Out-of-bounds Write vulnerability in multiple products

Multiple memory corruption issues were addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8676 Apple
Redhat
Out-of-bounds Write vulnerability in multiple products

Multiple memory corruption issues were addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8672 Apple
Redhat
Out-of-bounds Write vulnerability in multiple products

Multiple memory corruption issues were addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8669 Apple
Redhat
Out-of-bounds Write vulnerability in multiple products

Multiple memory corruption issues were addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8637 Apple Improper Input Validation vulnerability in Apple Iphone OS

An input validation issue was addressed with improved input validation.

9.3
2019-12-18 CVE-2019-8629 Apple Improper Initialization vulnerability in Apple mac OS X

A memory initialization issue was addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8605 Apple Use After Free vulnerability in Apple products

A use after free issue was addressed with improved memory management.

9.3
2019-12-18 CVE-2019-8593 Apple Out-of-bounds Write vulnerability in Apple Iphone OS

A memory corruption issue was addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8590 Apple Unspecified vulnerability in Apple mac OS X

A logic issue was addressed with improved restrictions.

9.3
2019-12-18 CVE-2019-8574 Apple Out-of-bounds Write vulnerability in Apple products

A memory corruption issue was addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8555 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple mac OS X

A buffer overflow was addressed with improved size validation.

9.3
2019-12-18 CVE-2019-8549 Apple Improper Input Validation vulnerability in Apple products

Multiple input validation issues existed in MIG generated code.

9.3
2019-12-18 CVE-2019-8544 Apple
Redhat
Out-of-bounds Write vulnerability in multiple products

A memory corruption issue was addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8536 Apple
Redhat
Out-of-bounds Write vulnerability in multiple products

A memory corruption issue was addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8535 Apple
Redhat
Out-of-bounds Write vulnerability in multiple products

A memory corruption issue was addressed with improved state management.

9.3
2019-12-18 CVE-2019-8523 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8518 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8506 Apple
Redhat
Type Confusion vulnerability in multiple products

A type confusion issue was addressed with improved memory handling.

9.3
2019-12-18 CVE-2019-8503 Apple Improper Input Validation vulnerability in Apple products

A logic issue was addressed with improved validation.

9.3
2019-12-18 CVE-2019-7287 Apple Out-of-bounds Write vulnerability in Apple Iphone OS

A memory corruption issue was addressed with improved input validation.

9.3
2019-12-18 CVE-2019-7285 Apple Use After Free vulnerability in Apple products

A use after free issue was addressed with improved memory management.

9.3
2019-12-18 CVE-2019-6201 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

9.3
2019-12-17 CVE-2019-19816 Linux
Canonical
Debian
Netapp
Out-of-bounds Write vulnerability in multiple products

In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in __btrfs_map_block in fs/btrfs/volumes.c, because a value of 1 for the number of data stripes is mishandled.

9.3
2019-12-17 CVE-2019-19814 Linux Out-of-bounds Write vulnerability in Linux Kernel 5.0.21

In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause __remove_dirty_segment slab-out-of-bounds write access because an array is bounded by the number of dirty types (8) but the array index can exceed this.

9.3
2019-12-22 CVE-2019-19920 SA Exim Project
Debian
OS Command Injection vulnerability in multiple products

sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule.

9.0

83 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2019-12-18 CVE-2019-8591 Apple Type Confusion vulnerability in Apple products

A type confusion issue was addressed with improved memory handling.

8.8
2019-12-18 CVE-2019-5077 Wago Missing Authentication for Critical Function vulnerability in Wago PFC 100 Firmware and PFC 200 Firmware

An exploitable denial-of-service vulnerability exists in the iocheckd service ‘’I/O-Chec’’ functionality of WAGO PFC 200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC 100 Firmware version 03.00.39(12).

8.5
2019-12-18 CVE-2019-8512 Apple Incorrect Authorization vulnerability in Apple Iphone OS

This issue was addressed with improved transparency.

7.9
2019-12-18 CVE-2019-8565 Apple Race Condition vulnerability in Apple Iphone OS

A race condition was addressed with additional validation.

7.6
2019-12-18 CVE-2019-6236 Apple Race Condition vulnerability in Apple Icloud

A race condition existed during the installation of iCloud for Windows.

7.6
2019-12-18 CVE-2019-6232 Apple Race Condition vulnerability in Apple Icloud

A race condition existed during the installation of iTunes for Windows.

7.6
2019-12-20 CVE-2019-19919 Handlebars JS Project
Tenable
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution.
7.5
2019-12-20 CVE-2019-19747 Neuvector Weak Password Requirements vulnerability in Neuvector 3.1

NeuVector 3.1 when configured to allow authentication via Active Directory, does not enforce non-empty passwords which allows an attacker with access to the Neuvector portal to authenticate as any valid LDAP user by providing a valid username and an empty password (provided that the active directory server has not been configured to reject empty passwords).

7.5
2019-12-20 CVE-2019-17571 Apache
Debian
Canonical
Opensuse
Netapp
Oracle
Deserialization of Untrusted Data vulnerability in multiple products

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.

7.5
2019-12-20 CVE-2019-15913 MI Authorization Bypass Through User-Controlled Key vulnerability in MI products

An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices.

7.5
2019-12-20 CVE-2019-15911 Asus Cleartext Transmission of Sensitive Information vulnerability in Asus products

An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO.

7.5
2019-12-19 CVE-2019-17527 Joomsky SQL Injection vulnerability in Joomsky JS Jobs

dataForDepandantField in models/custormfields.php in the JS JOBS FREE extension before 1.2.7 for Joomla! allows SQL Injection via the index.php?option=com_jsjobs&task=customfields.getfieldtitlebyfieldandfieldfo child parameter.

7.5
2019-12-19 CVE-2019-8256 Adobe Incorrect Default Permissions vulnerability in Adobe Coldfusion 2018

ColdFusion versions Update 6 and earlier have an insecure inherited permissions of default installation directory vulnerability.

7.5
2019-12-19 CVE-2019-19907 Kopano Classic Buffer Overflow vulnerability in Kopano Groupware Core

HrAddFBBlock in libfreebusy/freebusyutil.cpp in Kopano Groupware Core before 8.7.7 allows out-of-bounds access, as demonstrated by mishandling of an array copy during parsing of ICal data.

7.5
2019-12-19 CVE-2019-19905 Nethack Classic Buffer Overflow vulnerability in Nethack

NetHack 3.6.x before 3.6.4 is prone to a buffer overflow vulnerability when reading very long lines from configuration files.

7.5
2019-12-19 CVE-2019-16444 Adobe Unspecified vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have a binary planting (default folder privilege escalation) vulnerability.

7.5
2019-12-19 CVE-2019-7482 Sonicwall Out-of-bounds Write vulnerability in Sonicwall SMA 100 Firmware

Stack-based buffer overflow in SonicWall SMA100 allows an unauthenticated user to execute arbitrary code in function libSys.so.

7.5
2019-12-19 CVE-2019-19899 Pebbletemplates Improper Input Validation vulnerability in Pebbletemplates Pebble Templates 3.1.2

Pebble Templates 3.1.2 allows attackers to bypass a protection mechanism (intended to block access to instances of java.lang.Class) because getClass is accessible via the public static java.lang.Class java.lang.Class.forName(java.lang.Module,java.lang.String) signature.

7.5
2019-12-18 CVE-2019-11131 Intel Unspecified vulnerability in Intel Active Management Technology Firmware

Logic issue in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable escalation of privilege via network access.

7.5
2019-12-18 CVE-2019-11107 Intel Improper Input Validation vulnerability in Intel Active Management Technology Firmware 12.0/12.0.35

Insufficient input validation in the subsystem for Intel(R) AMT before version 12.0.45 may allow an unauthenticated user to potentially enable escalation of privilege via network access.

7.5
2019-12-18 CVE-2019-5079 Wago Out-of-bounds Write vulnerability in Wago PFC 100 Firmware and PFC 200 Firmware

An exploitable heap buffer overflow vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12).

7.5
2019-12-18 CVE-2019-18572 Dell Insufficiently Protected Credentials vulnerability in Dell RSA Identity Governance and Lifecycle

The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain an Improper Authentication vulnerability.

7.5
2019-12-18 CVE-2019-15599 Tree Kill Project Code Injection vulnerability in Tree-Kill Project Tree-Kill 1.2.1

A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command.

7.5
2019-12-18 CVE-2019-15598 Treekill Project OS Command Injection vulnerability in Treekill Project Treekill 1.0.0

A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command.

7.5
2019-12-18 CVE-2019-15597 Node DF Project Code Injection vulnerability in Node-Df Project Node-Df 0.1.4

A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.

7.5
2019-12-18 CVE-2019-19690 Trendmicro Weak Password Requirements vulnerability in Trendmicro Mobile Security 10.3.1/9.8

Trend Micro Mobile Security for Android (Consumer) versions 10.3.1 and below on Android 8.0+ has an issue in which an attacker could bypass the product's App Password Protection feature.

7.5
2019-12-18 CVE-2019-8849 Apple Unspecified vulnerability in Apple Swiftnio SSL

The issue was addressed by signaling that an executable stack is not required.

7.5
2019-12-18 CVE-2019-8779 Apple Exposure of Resource to Wrong Sphere vulnerability in Apple Ipados and Iphone OS

A logic issue applied the incorrect restrictions.

7.5
2019-12-18 CVE-2019-8750 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple Icloud and Watchos

Multiple memory corruption issues were addressed with improved input validation.

7.5
2019-12-18 CVE-2019-8662 Apple Use After Free vulnerability in Apple products

This issue was addressed with improved checks.

7.5
2019-12-18 CVE-2019-8661 Apple Use After Free vulnerability in Apple mac OS X

A use after free issue was addressed with improved memory management.

7.5
2019-12-18 CVE-2019-8660 Apple Out-of-bounds Write vulnerability in Apple products

A memory corruption issue was addressed with improved input validation.

7.5
2019-12-18 CVE-2019-8648 Apple Out-of-bounds Write vulnerability in Apple products

A memory corruption issue was addressed with improved input validation.

7.5
2019-12-18 CVE-2019-8647 Apple Use After Free vulnerability in Apple Iphone OS

A use after free issue was addressed with improved memory management.

7.5
2019-12-18 CVE-2019-8641 Apple Out-of-bounds Read vulnerability in Apple products

An out-of-bounds read was addressed with improved input validation.

7.5
2019-12-18 CVE-2019-8613 Apple Use After Free vulnerability in Apple Iphone OS

A use after free issue was addressed with improved memory management.

7.5
2019-12-18 CVE-2019-8600 Apple SQL Injection vulnerability in Apple products

A memory corruption issue was addressed with improved input validation.

7.5
2019-12-18 CVE-2019-7290 Apple Externally Controlled Reference to a Resource in Another Sphere vulnerability in Apple Shortcuts

An access issue was addressed with additional sandbox restrictions.

7.5
2019-12-18 CVE-2019-11400 Trendnet Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Trendnet products

An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices.

7.5
2019-12-18 CVE-2019-10614 Qualcomm Out-of-bounds Write vulnerability in Qualcomm products

Out of boundary access is possible as there is no validation of data accessed against the received size of the packet in case of malicious firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCN7605, QCS405, QCS605, QM215, SA6155P, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

7.5
2019-12-18 CVE-2019-10572 Qualcomm Integer Overflow or Wraparound vulnerability in Qualcomm products

Improper check in video driver while processing data from video firmware can lead to integer overflow and then buffer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCS405, QCS605, QM215, SA6155P, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130

7.5
2019-12-18 CVE-2019-19846 Joomla SQL Injection vulnerability in Joomla Joomla!

In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors.

7.5
2019-12-17 CVE-2019-18257 Advantech Out-of-bounds Write vulnerability in Advantech Diaganywhere 3.07.11

In Advantech DiagAnywhere Server, Versions 3.07.11 and prior, multiple stack-based buffer overflow vulnerabilities exist in the file transfer service listening on the TCP port.

7.5
2019-12-17 CVE-2019-3996 Elog Project Externally Controlled Reference to a Resource in Another Sphere vulnerability in Elog Project Elog

ELOG 3.1.4-57bea22 and below can be used as an HTTP GET request proxy when unauthenticated remote attackers send crafted HTTP POST requests.

7.5
2019-12-17 CVE-2019-19634 Verot Project
Getk2
Unrestricted Upload of File with Dangerous Type vulnerability in multiple products

class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.

7.5
2019-12-17 CVE-2019-18956 Divisait Deserialization of Untrusted Data vulnerability in Divisait products

Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 < 1.2.4, and Proxia PHR 1.0 < 1.0.30 and 1.1 < 1.1.2 allows remote code execution via untrusted Java deserialization.

7.5
2019-12-16 CVE-2019-19826 Drupal Deserialization of Untrusted Data vulnerability in Drupal Views Dynamic Field

The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/views_handler_filter_dynamic_fields.inc, as demonstrated by PHP object injection, involving a field_names object and an Archive_Tar object, for file deletion.

7.5
2019-12-16 CVE-2019-16778 Google Incorrect Conversion between Numeric Types vulnerability in Google Tensorflow

In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32.

7.5
2019-12-16 CVE-2019-18269 Omron Unspecified vulnerability in Omron PLC CJ Firmware and PLC CS Firmware

In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, the software properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control.

7.5
2019-12-16 CVE-2019-18259 Omron Authentication Bypass by Spoofing vulnerability in Omron PLC CJ Firmware and PLC CS Firmware

In Omron PLC CJ series, all versions and Omron PLC CS series, all versions, an attacker could spoof arbitrary messages or execute commands.

7.5
2019-12-16 CVE-2019-18826 Barco Improper Certificate Validation vulnerability in Barco products

Barco ClickShare Button R9861500D01 devices before 1.9.0 have Improper Following of a Certificate's Chain of Trust.

7.5
2019-12-18 CVE-2019-8758 Apple Out-of-bounds Write vulnerability in Apple mac OS X

A memory corruption issue was addressed with improved memory handling.

7.2
2019-12-18 CVE-2019-8755 Apple NULL Pointer Dereference vulnerability in Apple mac OS X

A logic issue was addressed with improved restrictions.

7.2
2019-12-18 CVE-2019-8748 Apple Out-of-bounds Write vulnerability in Apple mac OS X

A memory corruption issue was addressed with improved memory handling.

7.2
2019-12-18 CVE-2019-8717 Apple Out-of-bounds Write vulnerability in Apple mac OS X

A memory corruption issue was addressed with improved memory handling.

7.2
2019-12-18 CVE-2019-8701 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple mac OS X

A memory corruption issue was addressed with improved memory handling.

7.2
2019-12-18 CVE-2019-8697 Apple Out-of-bounds Write vulnerability in Apple mac OS X

A memory corruption issue was addressed with improved memory handling.

7.2
2019-12-18 CVE-2019-8635 Apple Double Free vulnerability in Apple mac OS X

A memory corruption issue was addressed with improved memory handling.

7.2
2019-12-18 CVE-2019-8616 Apple Out-of-bounds Write vulnerability in Apple mac OS X

A memory corruption issue was addressed with improved memory handling.

7.2
2019-12-18 CVE-2019-8604 Apple Out-of-bounds Write vulnerability in Apple mac OS X

A memory corruption issue was addressed with improved memory handling.

7.2
2019-12-18 CVE-2019-8529 Apple Out-of-bounds Write vulnerability in Apple Iphone OS

A memory corruption issue was addressed with improved input validation.

7.2
2019-12-18 CVE-2019-8526 Apple Use After Free vulnerability in Apple mac OS X

A use after free issue was addressed with improved memory management.

7.2
2019-12-18 CVE-2019-8513 Apple OS Command Injection vulnerability in Apple mac OS X

This issue was addressed with improved checks.

7.2
2019-12-18 CVE-2019-8508 Apple Classic Buffer Overflow vulnerability in Apple mac OS X

A buffer overflow was addressed with improved bounds checking.

7.2
2019-12-18 CVE-2019-2304 Qualcomm Classic Buffer Overflow vulnerability in Qualcomm products

Integer overflow to buffer overflow due to lack of validation of event arguments received from firmware.

7.2
2019-12-18 CVE-2019-2274 Qualcomm Unspecified vulnerability in Qualcomm products

Improper Access Control for RPU write access from secure processor in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8017, APQ8053, APQ8098, IPQ8074, MDM9150, MDM9650, MDM9655, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8998, Nicobar, QCA8081, QCN7605, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX55, SM6150, SM7150, SM8150, SXR1130

7.2
2019-12-18 CVE-2019-10607 Qualcomm Classic Buffer Overflow vulnerability in Qualcomm products

Out of bounds memcpy can occur by providing the embedded NULL character string and length greater than the actual string length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9615, MDM9640, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8996, MSM8996AU, QCA4531, QCA8081, QCA9531, QCA9558, QCA9886, QCA9980, QCN7605, QCS605, SDA660, SDX20, SDX24, SDX55, SM8150, SXR1130

7.2
2019-12-18 CVE-2019-10605 Qualcomm Classic Buffer Overflow vulnerability in Qualcomm products

Buffer overwrite can occur in IEEE80211 header filling function due to lack of range check of array index received from firmware in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8053, IPQ8074, MDM9607, MDM9650, MSM8909, MSM8939, QCN7605, SDA660, SDM630, SDM636, SDM660, SDX20, SDX24

7.2
2019-12-18 CVE-2019-10601 Qualcomm Improper Validation of Array Index vulnerability in Qualcomm products

Out of bound access can occur while processing firmware event due to lack of validation of WMI message received from firmware in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MSM8996AU, Nicobar, QCA6574AU, QCN7605, QCS405, SDM630, SDM636, SDM660, SDM845, SM6150, SM7150, SM8150

7.2
2019-12-18 CVE-2019-10600 Qualcomm NULL Pointer Dereference vulnerability in Qualcomm products

Use of local variable as argument to netlink CB callback goes out of it scope when callback triggered lead to invalid stack memory in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ8064, IPQ8074, MDM9150, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCA6574AU, QCA8081, QCS405, QCS605, QM215, SA6155P, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

7.2
2019-12-18 CVE-2019-10598 Qualcomm Classic Buffer Overflow vulnerability in Qualcomm products

Out of bound access can occur while processing peer info in IBSS connection mode due to lack of upper bounds check to ensure that for loop further will not cause an overflow in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8053, APQ8096AU, MDM9607, MSM8996AU, QCA6574AU, QCN7605, QCS605, SDA660, SDA845, SDM630, SDM636, SDM660, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130

7.2
2019-12-18 CVE-2019-10595 Qualcomm Improper Input Validation vulnerability in Qualcomm products

Possible buffer overwrite in message handler due to lack of validation of tid value calculated from packets received from firmware in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8053, APQ8064, APQ8096AU, IPQ4019, IPQ8064, MDM9206, MDM9207C, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909, MSM8909W, MSM8939, MSM8996AU, QCA4531, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCA9558, QCA9880, QCA9886, QCA9980, SDA660, SDM630, SDM636, SDM660, SDX20, SDX24

7.2
2019-12-18 CVE-2019-10537 Qualcomm Integer Overflow or Wraparound vulnerability in Qualcomm products

Improper validation of event buffer extracted from FW response can lead to integer overflow, which will allow to pass the length check and eventually will lead to buffer overwrite when event data is copied to context buffer in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9607, Nicobar, QCA6574AU, QCN7605, QCS405, QCS605, SDM660, SDM845, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

7.2
2019-12-18 CVE-2019-10536 Qualcomm Double Free vulnerability in Qualcomm products

Potential double free scenario if driver receives another DIAG_EVENT_LOG_SUPPORTED event from firmware as the pointer is not set to NULL on first call in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCA6174A, QCA6574AU, QCA8081, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM450, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

7.2
2019-12-18 CVE-2019-10481 Qualcomm Improper Validation of Array Index vulnerability in Qualcomm products

Out of bound access occurs while handling the WMI FW event due to lack of check of buffer argument which comes directly from the WLAN FW in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9607, MSM8996AU, QCA6574AU, QCA8081, QCN7605, SDX55, SM6150, SM7150, SM8150

7.2
2019-12-18 CVE-2019-10480 Qualcomm Classic Buffer Overflow vulnerability in Qualcomm products

Out of bound write can happen in WMI firmware event handler due to lack of validation of data received from WLAN firmware in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCA9980, QCN7605, QCS605, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SM6150, SM7150, SM8150, SXR1130

7.2
2019-12-18 CVE-2018-11980 Qualcomm Classic Buffer Overflow vulnerability in Qualcomm products

When a fake broadcast/multicast 11w rmf without mmie received, since no proper length check in wma_process_bip, buffer overflow will happen in both cds_is_mmie_valid and qdf_nbuf_trim_tail in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8937, MSM8996AU, MSM8998, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS605, SDM630, SDM636, SDM660, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130

7.2
2019-12-16 CVE-2019-18579 Dell Unspecified vulnerability in Dell XPS 7390 Firmware 1.0.13/1.0.6/1.0.9

Settings for the Dell XPS 13 2-in-1 (7390) BIOS versions prior to 1.1.3 contain a configuration vulnerability.

7.2
2019-12-16 CVE-2019-18828 Barco Weak Password Requirements vulnerability in Barco products

Barco ClickShare Button R9861500D01 devices before 1.9.0 have Insufficiently Protected Credentials.

7.2
2019-12-18 CVE-2019-8540 Apple Improper Initialization vulnerability in Apple products

A memory initialization issue was addressed with improved memory handling.

7.1
2019-12-18 CVE-2019-10482 Qualcomm Unspecified vulnerability in Qualcomm products

Due to the use of non-time-constant comparison functions there is issue in timing side channels which can be used as a potential side channel for SUI corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9607, MDM9650, MSM8905, MSM8909, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCS404, QCS405, QCS605, QM215, SA6155P, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

7.1
2019-12-17 CVE-2019-19815 Linux NULL Pointer Dereference vulnerability in Linux Kernel 5.0.21

In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause a NULL pointer dereference in f2fs_recover_fsync_data in fs/f2fs/recovery.c.

7.1
2019-12-17 CVE-2019-19813 Linux
Canonical
Debian
Netapp
Use After Free vulnerability in multiple products

In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in __mutex_lock in kernel/locking/mutex.c.

7.1

354 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2019-12-18 CVE-2019-8606 Apple Race Condition vulnerability in Apple mac OS X

A validation issue existed in the handling of symlinks.

6.9
2019-12-18 CVE-2019-19882 Shadow Project Incorrect Permission Assignment for Critical Resource vulnerability in Shadow Project Shadow 4.8

shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured.

6.9
2019-12-18 CVE-2019-19235 Asus Improper Input Validation vulnerability in Asus ATK Package

AsLdrSrv.exe in ASUS ATK Package before V1.0.0061 (for Windows 10 notebook PCs) could lead to unsigned code execution with no additional execution.

6.9
2019-12-17 CVE-2019-18670 Acer Untrusted Search Path vulnerability in Acer Quick Access

In the Quick Access Service (QAAdminAgent.exe) in Acer Quick Access V2.01.3000 through 2.01.3027 and V3.00.3000 through V3.00.3008, a REGULAR user can load an arbitrary unsigned DLL into the signed service's process, which is running as NT AUTHORITY\SYSTEM.

6.9
2019-12-17 CVE-2019-19315 Nalpeiron Incorrect Permission Assignment for Critical Resource vulnerability in Nalpeiron Licensing Service 7.3.4.0

NLSSRV32.EXE in Nalpeiron Licensing Service 7.3.4.0, as used with Nitro PDF and other products, allows Elevation of Privilege via the \\.\mailslot\nlsX86ccMailslot mailslot.

6.9
2019-12-17 CVE-2019-18824 Barco Improper Input Validation vulnerability in Barco Clickshare Button R9861500D01 Firmware

Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check.

6.9
2019-12-20 CVE-2019-19918 Lout Project Out-of-bounds Write vulnerability in Lout Project Lout 3.40

Lout 3.40 has a heap-based buffer overflow in the srcnext() function in z02.c.

6.8
2019-12-20 CVE-2019-19917 Lout Project
Opensuse
Fedoraproject
Classic Buffer Overflow vulnerability in multiple products

Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c.

6.8
2019-12-20 CVE-2018-1934 IBM Cross-Site Request Forgery (CSRF) vulnerability in IBM Cognos Business Intelligence 10.2.2

IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

6.8
2019-12-20 CVE-2012-6094 Apple
Debian
Incorrect Authorization vulnerability in multiple products

cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the system

6.8
2019-12-19 CVE-2019-19909 SFU Code Injection vulnerability in SFU Open Journal System

An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2.

6.8
2019-12-19 CVE-2019-17633 Eclipse Cross-Site Request Forgery (CSRF) vulnerability in Eclipse CHE

For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of an arbitrary Che workspace.

6.8
2019-12-18 CVE-2019-11132 Intel Cross-site Scripting vulnerability in Intel Active Management Technology Firmware

Cross site scripting in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow a privileged user to potentially enable escalation of privilege via network access.

6.8
2019-12-18 CVE-2019-18573 Dell Session Fixation vulnerability in Dell RSA Identity Governance and Lifecycle

The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability.

6.8
2019-12-18 CVE-2019-1387 GIT Unspecified vulnerability in GIT

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6.

6.8
2019-12-18 CVE-2018-1311 Apache
Redhat
Debian
Oracle
Use After Free vulnerability in multiple products

The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs.

6.8
2019-12-18 CVE-2019-8823 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8822 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8821 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8820 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8819 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8812 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8811 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8808 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8806 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple Xcode

A memory corruption issue was addressed with improved validation.

6.8
2019-12-18 CVE-2019-8800 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple Xcode

A memory corruption issue was addressed with improved validation.

6.8
2019-12-18 CVE-2019-8792 Apple Injection vulnerability in Apple Shazam 12.11.0/9.25.0

An injection issue was addressed with improved validation.

6.8
2019-12-18 CVE-2019-8783 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8782 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8766 Apple Out-of-bounds Write vulnerability in Apple Icloud and Watchos

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8765 Apple Out-of-bounds Write vulnerability in Apple Watchos

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8763 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8745 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple products

A buffer overflow was addressed with improved bounds checking.

6.8
2019-12-18 CVE-2019-8743 Apple Out-of-bounds Write vulnerability in Apple Watchos

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8739 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple Xcode

A memory corruption issue was addressed with improved state management.

6.8
2019-12-18 CVE-2019-8738 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple Xcode

A memory corruption issue was addressed with improved state management.

6.8
2019-12-18 CVE-2019-8735 Apple Out-of-bounds Write vulnerability in Apple Icloud, Itunes and Tvos

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8733 Apple Out-of-bounds Write vulnerability in Apple Icloud, Itunes and Tvos

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8726 Apple Out-of-bounds Write vulnerability in Apple Icloud, Itunes and Tvos

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8710 Apple Out-of-bounds Write vulnerability in Apple Icloud

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8707 Apple Out-of-bounds Write vulnerability in Apple Icloud, Itunes and Tvos

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8687 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8686 Apple Use After Free vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8683 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8681 Apple Use After Free vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8680 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8679 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8678 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8677 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8673 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8671 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8666 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8657 Apple Out-of-bounds Read vulnerability in Apple products

An out-of-bounds read was addressed with improved input validation.

6.8
2019-12-18 CVE-2019-8644 Apple Use After Free vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8628 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8623 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8622 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8619 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8617 Apple Unspecified vulnerability in Apple Iphone OS

An access issue was addressed with additional sandbox restrictions.

6.8
2019-12-18 CVE-2019-8611 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8610 Apple Use After Free vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8609 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8608 Apple Use After Free vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8603 Apple Out-of-bounds Read vulnerability in Apple mac OS X

A validation issue was addressed with improved input sanitization.

6.8
2019-12-18 CVE-2019-8602 Apple Out-of-bounds Write vulnerability in Apple products

A memory corruption issue was addressed by removing the vulnerable code.

6.8
2019-12-18 CVE-2019-8601 Apple Integer Overflow or Wraparound vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8596 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8595 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8594 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8587 Apple Improper Validation of Array Index vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8586 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8585 Apple Out-of-bounds Read vulnerability in Apple products

An out-of-bounds read was addressed with improved input validation.

6.8
2019-12-18 CVE-2019-8584 Apple Use After Free vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8583 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8577 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple products

An input validation issue was addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8571 Apple Use After Free vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8563 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8562 Apple Out-of-bounds Write vulnerability in Apple products

A memory corruption issue was addressed with improved validation.

6.8
2019-12-18 CVE-2019-8561 Apple Improper Input Validation vulnerability in Apple mac OS X

A logic issue was addressed with improved validation.

6.8
2019-12-18 CVE-2019-8559 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8558 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8556 Apple Use After Free vulnerability in Apple products

A use after free issue was addressed with improved memory management.

6.8
2019-12-18 CVE-2019-8553 Apple Out-of-bounds Write vulnerability in Apple Iphone OS

A memory corruption issue was addressed with improved validation.

6.8
2019-12-18 CVE-2019-8552 Apple Improper Initialization vulnerability in Apple products

A memory initialization issue was addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8542 Apple Classic Buffer Overflow vulnerability in Apple products

A buffer overflow was addressed with improved bounds checking.

6.8
2019-12-18 CVE-2019-8524 Apple Use After Free vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-8514 Apple Unspecified vulnerability in Apple products

A logic issue was addressed with improved state management.

6.8
2019-12-18 CVE-2019-8511 Apple Classic Buffer Overflow vulnerability in Apple Iphone OS

A buffer overflow issue was addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-7286 Apple Out-of-bounds Write vulnerability in Apple Iphone OS

A memory corruption issue was addressed with improved input validation.

6.8
2019-12-18 CVE-2019-6237 Apple Out-of-bounds Write vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

6.8
2019-12-18 CVE-2019-19832 Xerox Cross-Site Request Forgery (CSRF) vulnerability in Xerox Altalink C8035 Firmware

Xerox AltaLink C8035 printers allow CSRF.

6.8
2019-12-17 CVE-2019-11657 Microfocus Cross-Site Request Forgery (CSRF) vulnerability in Microfocus Arcsight Logger 6.61

Cross-Site Request Forgery vulnerability in all Micro Focus ArcSight Logger affecting all product versions below version 7.0.

6.8
2019-12-17 CVE-2019-19847 Libspiro Project Out-of-bounds Write vulnerability in Libspiro Project Libspiro

Libspiro through 20190731 has a stack-based buffer overflow in the spiro_to_bpath0() function in spiro.c.

6.8
2019-12-17 CVE-2019-16575 Jenkins Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Alauda Kubernetes Support

A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins.

6.8
2019-12-17 CVE-2019-16573 Jenkins Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Alauda Devops Pipeline 2.3.2

A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

6.8
2019-12-17 CVE-2019-16570 Jenkins Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Rapiddeploy

A cross-site request forgery vulnerability in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers to connect to an attacker-specified web server.

6.8
2019-12-17 CVE-2019-16565 Jenkins Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Team Concert

A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

6.8
2019-12-17 CVE-2019-16560 Jenkins Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Websphere Deployer

A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.

6.8
2019-12-17 CVE-2019-16553 Jenkins Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer

A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression.

6.8
2019-12-17 CVE-2019-16551 Jenkins Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Gerrit Trigger

A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials.

6.8
2019-12-17 CVE-2019-16550 Jenkins Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Maven 0.14.0/0.16.1

A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents.

6.8
2019-12-17 CVE-2019-16549 Jenkins XXE vulnerability in Jenkins Maven 0.14.0/0.16.1

Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents.

6.8
2019-12-17 CVE-2019-18832 Barco Insufficiently Protected Credentials vulnerability in Barco Clickshare Button R9861500D01 Firmware

Barco ClickShare Button R9861500D01 devices before 1.9.0 have incorrect Credentials Management.

6.8
2019-12-16 CVE-2019-13533 Omron Authentication Bypass by Capture-replay vulnerability in Omron PLC CJ Firmware and PLC CS Firmware

In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between the PLC and the controller and replay requests that could result in the opening and closing of industrial valves.

6.8
2019-12-16 CVE-2019-10773 Yarnpkg Link Following vulnerability in Yarnpkg Yarn

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys.

6.8
2019-12-18 CVE-2019-8576 Apple Out-of-bounds Read vulnerability in Apple products

An out-of-bounds read was addressed with improved bounds checking.

6.6
2019-12-18 CVE-2019-8545 Apple Out-of-bounds Write vulnerability in Apple products

A memory corruption issue was addressed with improved state management.

6.6
2019-12-19 CVE-2019-19141 Plex Unrestricted Upload of File with Dangerous Type vulnerability in Plex Media Server 1.13.2.5154/1.18.2.2029

The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions.

6.5
2019-12-19 CVE-2019-19902 Backdropcms Information Exposure vulnerability in Backdropcms Backdrop CMS

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2.

6.5
2019-12-19 CVE-2019-7486 Sonicwall Code Injection vulnerability in Sonicwall SMA 100 Firmware 9.0.0.4

Code injection in SonicWall SMA100 allows an authenticated user to execute arbitrary code in viewcacert CGI script.

6.5
2019-12-19 CVE-2019-7485 Sonicwall Classic Buffer Overflow vulnerability in Sonicwall SMA 100 Firmware

Buffer overflow in SonicWall SMA100 allows an authenticated user to execute arbitrary code in DEARegister CGI script.

6.5
2019-12-18 CVE-2019-5486 Gitlab Improper Authentication vulnerability in Gitlab

A authentication bypass vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.10 in the Salesforce login integration that could be used by an attacker to create an account that bypassed domain restrictions and email verification requirements.

6.5
2019-12-18 CVE-2019-15589 Gitlab Unspecified vulnerability in Gitlab

An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before.

6.5
2019-12-18 CVE-2019-8634 Apple Improper Authentication vulnerability in Apple mac OS X

An authentication issue was addressed with improved state management.

6.5
2019-12-17 CVE-2019-0384 SAP Incorrect Authorization vulnerability in SAP products

Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for functionalities that require user identity.

6.5
2019-12-17 CVE-2019-0383 SAP Incorrect Authorization vulnerability in SAP products

Transaction Management in SAP Treasury and Risk Management (corrected in S4CORE versions 1.01, 1.02, 1.03, 1.04 and EA-FINSERV versions 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

6.5
2019-12-17 CVE-2019-19850 Typo3 SQL Injection vulnerability in Typo3

An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.

6.5
2019-12-17 CVE-2019-19849 Typo3 Deserialization of Untrusted Data vulnerability in Typo3

An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.

6.5
2019-12-17 CVE-2019-19848 Typo3 Path Traversal vulnerability in Typo3

An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.

6.5
2019-12-17 CVE-2019-19745 Contao Unrestricted Upload of File with Dangerous Type vulnerability in Contao

Contao 4.0 through 4.8.5 allows PHP local file inclusion.

6.5
2019-12-16 CVE-2019-18191 Trendmicro Incomplete Cleanup vulnerability in Trendmicro Deep Security AS A Service

A privilege escalation vulnerability in the Trend Micro Deep Security as a Service Quick Setup cloud formation template could allow an authenticated entity with certain unrestricted AWS execution privileges to escalate to full privileges within the target AWS account.

6.5
2019-12-19 CVE-2019-19340 Redhat Insecure Default Initialization of Resource vulnerability in Redhat Ansible Tower and Enterprise Linux

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmq_enable_manager=true' exposes the RabbitMQ management interface publicly, as expected.

6.4
2019-12-18 CVE-2019-5080 Wago Missing Authentication for Critical Function vulnerability in Wago PFC 100 Firmware and PFC 200 Firmware

An exploitable denial-of-service vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12).

6.4
2019-12-17 CVE-2019-16558 Jenkins Improper Certificate Validation vulnerability in Jenkins Spira Importer 3.2.2/3.2.3

Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM.

6.4
2019-12-19 CVE-2019-19915 Webfactoryltd Cross-Site Request Forgery (CSRF) vulnerability in Webfactoryltd 301 Redirects

The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redirect rules, and exploit XSS, with the /admin-ajax.php?action=eps_redirect_save and /admin-ajax.php?action=eps_redirect_delete actions.

6.0
2019-12-17 CVE-2019-17334 Tibco Incorrect Default Permissions vulnerability in Tibco products

The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment Kit, TIBCO Spotfire Desktop, and TIBCO Spotfire Desktop Language Packs contains a vulnerability that theoretically allows an attacker with permission to write DXP files to the Spotfire library to remotely execute code of their choice on the user account of other users who access the affected system.

6.0
2019-12-19 CVE-2019-15006 Atlassian Improper Control of Dynamically-Managed Code Resources vulnerability in Atlassian Confluence and Confluence Server

There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center.

5.8
2019-12-18 CVE-2019-18781 Zohocorp Open Redirect vulnerability in Zohocorp Manageengine Adselfservice Plus

An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a crafted link to be sent to a specified external site.

5.8
2019-12-18 CVE-2019-11088 Intel Improper Input Validation vulnerability in Intel Active Management Technology Firmware

Insufficient input validation in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.

5.8
2019-12-18 CVE-2019-0169 Intel Out-of-bounds Write vulnerability in Intel products

Heap overflow in subsystem in Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow an unauthenticated user to potentially enable escalation of privileges, information disclosure or denial of service via adjacent access.

5.8
2019-12-18 CVE-2019-8791 Apple Open Redirect vulnerability in Apple Shazam

An issue existed in the parsing of URL schemes.

5.8
2019-12-18 CVE-2019-8530 Apple Unspecified vulnerability in Apple Iphone OS

This issue was addressed with improved checks.

5.8
2019-12-18 CVE-2019-8521 Apple Unspecified vulnerability in Apple Iphone OS

This issue was addressed with improved checks.

5.8
2019-12-18 CVE-2019-5152 Shadowsocks Missing Authentication for Critical Function vulnerability in Shadowsocks Shadowsocks-Libev 3.3.2

An exploitable information disclosure vulnerability exists in the network packet handling functionality of Shadowsocks-libev 3.3.2.

5.8
2019-12-18 CVE-2019-19775 Zulip Open Redirect vulnerability in Zulip Server

The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users.

5.8
2019-12-19 CVE-2019-11780 Odoo Unspecified vulnerability in Odoo 13.0

Improper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 allows remote authenticated attackers to access sensitive information via crafted RPC requests, which could lead to privilege escalation.

5.5
2019-12-18 CVE-2019-5469 Gitlab Authorization Bypass Through User-Controlled Key vulnerability in Gitlab

An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an attacker to replace project binaries or other uploaded assets.

5.5
2019-12-17 CVE-2019-16561 Jenkins Improper Certificate Validation vulnerability in Jenkins Websphere Deployer

Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM.

5.5
2019-12-17 CVE-2019-16559 Jenkins Incorrect Default Permissions vulnerability in Jenkins Websphere Deployer

A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.

5.5
2019-12-17 CVE-2019-16552 Jenkins Incorrect Default Permissions vulnerability in Jenkins Gerrit Trigger

A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials, or determine the existence of a file with a given path on the Jenkins master.

5.5
2019-12-20 CVE-2019-16786 Agendaless HTTP Request Smuggling vulnerability in Agendaless Waitress

Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead.

5.0
2019-12-20 CVE-2019-16785 Agendaless HTTP Request Smuggling vulnerability in Agendaless Waitress

Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways.

5.0
2019-12-20 CVE-2019-15915 MI Improper Input Validation vulnerability in MI products

An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, RTCGQ01LM devices.

5.0
2019-12-20 CVE-2019-15914 MI Improper Input Validation vulnerability in MI products

An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices.

5.0
2019-12-20 CVE-2019-15912 Asus Improper Input Validation vulnerability in Asus products

An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO.

5.0
2019-12-20 CVE-2019-15910 Asus Improper Input Validation vulnerability in Asus products

An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO.

5.0
2019-12-20 CVE-2012-6111 Gnome
Debian
Improper Input Validation vulnerability in multiple products

gnome-keyring does not discard stored secrets when using gnome_keyring_lock_all_sync function

5.0
2019-12-19 CVE-2019-19342 Redhat Information Exposure Through an Error Message vulnerability in Redhat Ansible Tower

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character.

5.0
2019-12-19 CVE-2019-19234 Sudo Unspecified vulnerability in Sudo

** DISPUTED ** In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) is not considered, allowing an attacker (who has access to a Runas ALL sudoer account) to impersonate any blocked user.

5.0
2019-12-19 CVE-2019-19232 Sudo Unspecified vulnerability in Sudo

** DISPUTED ** In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user.

5.0
2019-12-19 CVE-2019-19906 Cyrusimap
Debian
Canonical
Fedoraproject
Redhat
Apple
Apache
Off-by-one Error vulnerability in multiple products

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet.

5.0
2019-12-19 CVE-2019-16465 Adobe Out-of-bounds Read vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an out-of-bounds read vulnerability.

5.0
2019-12-19 CVE-2019-16461 Adobe Out-of-bounds Read vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an out-of-bounds read vulnerability.

5.0
2019-12-19 CVE-2019-16458 Adobe Out-of-bounds Read vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an out-of-bounds read vulnerability.

5.0
2019-12-19 CVE-2019-16457 Adobe Out-of-bounds Read vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an out-of-bounds read vulnerability.

5.0
2019-12-19 CVE-2019-16456 Adobe Out-of-bounds Read vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an out-of-bounds read vulnerability.

5.0
2019-12-19 CVE-2019-16449 Adobe Out-of-bounds Read vulnerability in Adobe Acrobat DC

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have an out-of-bounds read vulnerability.

5.0
2019-12-19 CVE-2019-7483 Sonicwall Path Traversal vulnerability in Sonicwall SMA 100 Firmware

In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.

5.0
2019-12-18 CVE-2019-0166 Intel Improper Input Validation vulnerability in Intel Active Management Technology Firmware

Insufficient input validation in the subsystem for Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable information disclosure via network access.

5.0
2019-12-18 CVE-2019-5487 Gitlab Unspecified vulnerability in Gitlab

An improper access control vulnerability exists in Gitlab EE <v12.3.3, <v12.2.7, & <v12.1.13 that allowed the group search feature with Elasticsearch to return private code, merge requests and commits.

5.0
2019-12-18 CVE-2019-5073 Wago Information Exposure vulnerability in Wago PFC 100 Firmware and PFC 200 Firmware

An exploitable information exposure vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12).

5.0
2019-12-18 CVE-2019-19724 Sylabs Incorrect Default Permissions vulnerability in Sylabs Singularity

Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services.

5.0
2019-12-18 CVE-2019-18997 ABB Unspecified vulnerability in ABB Pb610 Panel Builder 600

The HMISimulator component of ABB PB610 Panel Builder 600 uses the readFile/writeFile interface to manipulate the work file.

5.0
2019-12-18 CVE-2019-18995 ABB Improper Input Validation vulnerability in ABB Pb610 Panel Builder 600

The HMISimulator component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier fails to validate the content-length field for HTTP requests, exposing HMISimulator to denial of service via crafted HTTP requests manipulating the content-length setting.

5.0
2019-12-18 CVE-2019-15600 Http Server Project Path Traversal vulnerability in Http Server Project Http Server 1.0.12

A Path traversal exists in http_server which allows an attacker to read arbitrary system files.

5.0
2019-12-18 CVE-2019-15596 Statics Server Project Path Traversal vulnerability in Statics-Server Project Statics-Server

A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within the working directory.

5.0
2019-12-18 CVE-2019-15576 Gitlab Missing Authorization vulnerability in Gitlab

An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint.

5.0
2019-12-18 CVE-2019-15575 Gitlab Command Injection vulnerability in Gitlab

A command injection exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope.

5.0
2019-12-18 CVE-2019-11995 HP Unspecified vulnerability in HP Universal Internet of Things 1.2.4.0/1.2.4.1/1.2.4.2

Security vulnerabilities in HPE UIoT version 1.2.4.2 could allow unauthorized remote access and access to sensitive data.

5.0
2019-12-18 CVE-2019-19890 Humaxdigital Cleartext Transmission of Sensitive Information vulnerability in Humaxdigital Hgb10R-02 Firmware 201608171855

An issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices.

5.0
2019-12-18 CVE-2019-19889 Humaxdigital Cleartext Transmission of Sensitive Information vulnerability in Humaxdigital Hgb10R-02 Firmware 201608171855

An issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices.

5.0
2019-12-18 CVE-2019-19844 Djangoproject
Canonical
Weak Password Recovery Mechanism for Forgotten Password vulnerability in multiple products

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover.

5.0
2019-12-18 CVE-2012-2656 Talend XXE vulnerability in Talend Restlet 1.1.10

An XML eXternal Entity (XXE) issue exists in Restlet 1.1.10 in an endpoint using XML transport, which lets a remote attacker obtain sensitive information.

5.0
2019-12-18 CVE-2019-8788 Apple Improper Input Validation vulnerability in Apple Ipados and Iphone OS

An issue existed in the parsing of URLs.

5.0
2019-12-18 CVE-2019-8787 Apple Out-of-bounds Read vulnerability in Apple products

An out-of-bounds read was addressed with improved input validation.

5.0
2019-12-18 CVE-2019-8772 Apple Unspecified vulnerability in Apple mac OS X

An issue existed in the handling of links in encrypted PDFs.

5.0
2019-12-18 CVE-2019-8768 Apple Incomplete Cleanup vulnerability in Apple mac OS X

"Clear History and Website Data" did not clear the history.

5.0
2019-12-18 CVE-2019-8725 Apple Information Exposure vulnerability in Apple Safari

The issue was addressed with improved handling of service worker lifetime.

5.0
2019-12-18 CVE-2019-8711 Apple Information Exposure vulnerability in Apple Iphone OS

A logic issue existed with the display of notification previews.

5.0
2019-12-18 CVE-2019-8699 Apple Unspecified vulnerability in Apple Iphone OS

A logic issue existed in the handling of answering phone calls.

5.0
2019-12-18 CVE-2019-8667 Apple Unspecified vulnerability in Apple mac OS X

An inconsistent user interface issue was addressed with improved state management.

5.0
2019-12-18 CVE-2019-8665 Apple Improper Input Validation vulnerability in Apple Iphone OS

A denial of service issue was addressed with improved validation.

5.0
2019-12-18 CVE-2019-8663 Apple Unspecified vulnerability in Apple Iphone OS

This issue was addressed with improved checks.

5.0
2019-12-18 CVE-2019-8659 Apple Unspecified vulnerability in Apple Watchos

This issue was addressed with improved checks.

5.0
2019-12-18 CVE-2019-8646 Apple Out-of-bounds Read vulnerability in Apple products

An out-of-bounds read was addressed with improved input validation.

5.0
2019-12-18 CVE-2019-8624 Apple Out-of-bounds Read vulnerability in Apple Watchos

An out-of-bounds read was addressed with improved input validation.

5.0
2019-12-18 CVE-2019-8620 Apple Information Exposure vulnerability in Apple Iphone OS

A user privacy issue was addressed by removing the broadcast MAC address.

5.0
2019-12-18 CVE-2019-8567 Apple Information Exposure vulnerability in Apple Iphone OS

A user privacy issue was addressed by removing the broadcast MAC address.

5.0
2019-12-18 CVE-2019-8516 Apple Improper Input Validation vulnerability in Apple products

A validation issue was addressed with improved logic.

5.0
2019-12-18 CVE-2019-4609 IBM Use of a Broken or Risky Cryptographic Algorithm vulnerability in IBM API Connect 2018.4.1.7

IBM API Connect 2018.4.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

5.0
2019-12-18 CVE-2019-19880 Sqlite
Netapp
Debian
Suse
Redhat
Opensuse
Oracle
Siemens
NULL Pointer Dereference vulnerability in multiple products

exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.

5.0
2019-12-18 CVE-2019-19845 Joomla Path Traversal vulnerability in Joomla Joomla!

In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure.

5.0
2019-12-17 CVE-2019-7481 Sonicwall SQL Injection vulnerability in Sonicwall SMA 100 Firmware 9.0.0.0/9.0.0.3

Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources.

5.0
2019-12-17 CVE-2019-3995 Elog Project NULL Pointer Dereference vulnerability in Elog Project Elog

ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference.

5.0
2019-12-17 CVE-2019-3994 Elog Project Use After Free vulnerability in Elog Project Elog

ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a use after free.

5.0
2019-12-17 CVE-2019-3993 Elog Project
Fedoraproject
Cleartext Transmission of Sensitive Information vulnerability in multiple products

ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability.

5.0
2019-12-17 CVE-2019-3992 Elog Project
Fedoraproject
Cleartext Transmission of Sensitive Information vulnerability in multiple products

ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability.

5.0
2019-12-17 CVE-2014-8179 Docker
Opensuse
Improper Input Validation vulnerability in multiple products

Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.

5.0
2019-12-17 CVE-2019-19714 Contao Improper Encoding or Escaping of Output vulnerability in Contao 4.8.4/4.8.5

Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output.

5.0
2019-12-17 CVE-2019-16568 Jenkins Cleartext Transmission of Sensitive Information vulnerability in Jenkins Sctmexecutor

Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configuration, as well as individual jobs' configurations.

5.0
2019-12-17 CVE-2019-19712 Contao Incorrect Default Permissions vulnerability in Contao

Contao 4.0 through 4.8.5 has Insecure Permissions.

5.0
2019-12-17 CVE-2019-19264 Simplifile Information Exposure vulnerability in Simplifile Recordfusion 20191125

In Simplifile RecordFusion through 2019-11-25, the logs and hist parameters allow remote attackers to access local files via a logger/logs?/../ or logger/hist?/../ URI.

5.0
2019-12-17 CVE-2019-18825 Barco Unspecified vulnerability in Barco products

Barco ClickShare Huddle CS-100 devices before 1.9.0 and CSE-200 devices before 1.9.0 have incorrect Credentials Management.

5.0
2019-12-16 CVE-2019-12414 Apache Information Exposure vulnerability in Apache Incubator Superset

In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab

5.0
2019-12-16 CVE-2019-12413 Apache Unspecified vulnerability in Apache Incubator Superset

In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specially crafted complex query.

5.0
2019-12-16 CVE-2019-18261 Omron Improper Restriction of Excessive Authentication Attempts vulnerability in Omron PLC CJ Firmware, PLC CS Firmware and PLC NJ Firmware

In Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series, all versions, the software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.

5.0
2019-12-16 CVE-2019-19731 Roxyfileman Path Traversal vulnerability in Roxyfileman Roxy Fileman 1.4.5

Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal.

5.0
2019-12-16 CVE-2019-19331 NIC
Debian
Improper Resource Shutdown or Release vulnerability in multiple products

knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization.

5.0
2019-12-18 CVE-2019-10513 Qualcomm NULL Pointer Dereference vulnerability in Qualcomm products

Possibility of Null pointer access if the SPDM commands are executed in the non-standard way in Trustzone in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, IPQ8074, MDM9150, MDM9205, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCA8081, QCS404, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130, SXR2130

4.9
2019-12-18 CVE-2019-0131 Intel Improper Input Validation vulnerability in Intel Active Management Technology Firmware

Insufficient input validation in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable denial of service or information disclosure via adjacent access.

4.8
2019-12-16 CVE-2018-11751 Puppet Improper Certificate Validation vulnerability in Puppet Server

Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL.

4.8
2019-12-20 CVE-2019-19231 Broadcom Unspecified vulnerability in Broadcom CA Client Automation

An insecure file access vulnerability exists in CA Client Automation 14.0, 14.1, 14.2, and 14.3 Agent for Windows that can allow a local attacker to gain escalated privileges.

4.6
2019-12-20 CVE-2012-3409 Ecryptfs
Debian
Improper Input Validation vulnerability in multiple products

ecryptfs-utils: suid helper does not restrict mounting filesystems with nosuid,nodev which creates a possible privilege escalation

4.6
2019-12-19 CVE-2019-18181 Arista Unspecified vulnerability in Arista Cloudvision Portal

In CloudVision Portal all releases in the 2018.1 and 2018.2 Code train allows users with read-only permissions to bypass permissions for restricted functionality via CVP API calls through the Configlet Builder modules.

4.6
2019-12-19 CVE-2019-7487 Sonicwall Unquoted Search Path or Element vulnerability in Sonicwall Sonicos and Sonicos Sslvpn Nacagent

Installation of the SonicOS SSLVPN NACagent 3.5 on the Windows operating system, an autorun value is created does not put the path in quotes, so if a malicious binary by an attacker within the parent path could allow code execution.

4.6
2019-12-18 CVE-2019-17390 Pronestor Unspecified vulnerability in Pronestor Planner

An issue was discovered in the Outlook add-in in Pronestor Planner before 8.1.77.

4.6
2019-12-18 CVE-2019-11147 Intel Unspecified vulnerability in Intel products

Insufficient access control in hardware abstraction driver for MEInfo software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0, 14.0.10; TXEInfo software for Intel(R) TXE before versions 3.1.70 and 4.0.20; INTEL-SA-00086 Detection Tool version 1.2.7.0 or before; INTEL-SA-00125 Detection Tool version 1.0.45.0 or before may allow an authenticated user to potentially enable escalation of privilege via local access.

4.6
2019-12-18 CVE-2019-11110 Intel Unspecified vulnerability in Intel products

Authentication bypass in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable escalation of privilege via local access.

4.6
2019-12-18 CVE-2019-11109 Intel
F5
Logic issue in the subsystem for Intel(R) SPS before versions SPS_E5_04.01.04.275.0, SPS_SoC-X_04.00.04.100.0 and SPS_SoC-A_04.00.04.191.0 may allow a privileged user to potentially enable denial of service via local access.
4.6
2019-12-18 CVE-2019-11108 Intel Improper Input Validation vulnerability in Intel Converged Security Management Engine Firmware

Insufficient input validation in subsystem for Intel(R) CSME before versions 12.0.45 and 13.0.10 may allow a privileged user to potentially enable escalation of privilege via local access.

4.6
2019-12-18 CVE-2019-11106 Intel Insufficient Session Expiration vulnerability in Intel products

Insufficient session validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable escalation of privilege via local access.

4.6
2019-12-18 CVE-2019-11105 Intel Improper Privilege Management vulnerability in Intel Converged Security Management Engine Firmware

Logic issue in subsystem for Intel(R) CSME before versions 12.0.45, 13.0.10 and 14.0.10 may allow a privileged user to potentially enable escalation of privilege and information disclosure via local access.

4.6
2019-12-18 CVE-2019-11104 Intel Improper Input Validation vulnerability in Intel products

Insufficient input validation in MEInfo software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow an authenticated user to potentially enable escalation of privilege via local access.

4.6
2019-12-18 CVE-2019-11103 Intel Improper Input Validation vulnerability in Intel Converged Security Management Engine Firmware

Insufficient input validation in firmware update software for Intel(R) CSME before versions 12.0.45,13.0.10 and 14.0.10 may allow an authenticated user to potentially enable escalation of privilege via local access.

4.6
2019-12-18 CVE-2019-11097 Intel Incorrect Default Permissions vulnerability in Intel Trusted Execution Engine Firmware

Improper directory permissions in the installer for Intel(R) Management Engine Consumer Driver for Windows before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45,13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow an authenticated user to potentially enable escalation of privilege via local access.

4.6
2019-12-18 CVE-2019-11087 Intel Improper Input Validation vulnerability in Intel products

Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable escalation of privilege, information disclosure or denial of service via local access.

4.6
2019-12-18 CVE-2019-11086 Intel Improper Input Validation vulnerability in Intel Active Management Technology Firmware 12.0/12.0.35

Insufficient input validation in subsystem for Intel(R) AMT before version 12.0.45 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

4.6
2019-12-18 CVE-2019-8803 Apple Insufficient Session Expiration vulnerability in Apple products

An authentication issue was addressed with improved state management.

4.6
2019-12-18 CVE-2019-8760 Apple Improper Authentication vulnerability in Apple Iphone OS

This issue was addressed by improving Face ID machine learning models.

4.6
2019-12-18 CVE-2019-8533 Apple Improper Authentication vulnerability in Apple mac OS X

A lock handling issue was addressed with improved lock handling.

4.6
2019-12-18 CVE-2019-6239 Apple Unspecified vulnerability in Apple mac OS X

This issue was addressed with improved handling of file metadata.

4.6
2019-12-18 CVE-2012-2312 Redhat Improper Privilege Management vulnerability in Redhat products

An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated privileges.

4.6
2019-12-18 CVE-2019-10584 Qualcomm Out-of-bounds Read vulnerability in Qualcomm products

Possibility of out of bound access in debug queue, if packet size field is corrupted in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCN7605, QCS405, QCS605, QM215, SA6155P, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

4.6
2019-12-18 CVE-2019-10564 Qualcomm Out-of-bounds Read vulnerability in Qualcomm products

Possible OOB issue in EEPROM due to lack of check while accessing memory map array at the time of reading operation in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, MSM8909W, MSM8917, MSM8953, Nicobar, QCS405, QCS605, QM215, SA6155P, SDA845, SDM429, SDM439, SDM450, SDM632, SDM670, SDM710, SDM845, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

4.6
2019-12-18 CVE-2019-10544 Qualcomm Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Qualcomm products

Improper length check on source buffer to handle userspace data received can lead to out-of-bound access in diag handlers in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996AU, MSM8998, QCN7605, QCS405, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

4.6
2019-12-18 CVE-2019-10518 Qualcomm Use After Free vulnerability in Qualcomm products

Use after free of a pointer in iWLAN scenario during netmgr state transition to CONNECT in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, IPQ4019, IPQ8064, IPQ8074, MDM9150, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996AU, MSM8998, QCA6574AU, QCS405, QCS605, SDA660, SDA845, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

4.6
2019-12-18 CVE-2019-10517 Qualcomm Double Free vulnerability in Qualcomm products

Memory is being freed up twice when two concurrent threads are executing in parallel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8996AU, QCS405, QCS605, SDA660, SDA845, SDM630, SDM636, SDM660, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

4.6
2019-12-17 CVE-2019-19241 Linux Unspecified vulnerability in Linux Kernel

In the Linux kernel before 5.4.2, the io_uring feature leads to requests that inadvertently have UID 0 and full capabilities, aka CID-181e448d8709.

4.6
2019-12-16 CVE-2019-14612 Intel Out-of-bounds Write vulnerability in Intel products

Out of bounds write in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access.

4.6
2019-12-16 CVE-2019-14611 Intel Integer Overflow or Wraparound vulnerability in Intel products

Integer overflow in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access.

4.6
2019-12-16 CVE-2019-14610 Intel Unspecified vulnerability in Intel products

Improper access control in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escalation of privilege via local access.

4.6
2019-12-16 CVE-2019-14609 Intel Improper Input Validation vulnerability in Intel products

Improper input validation in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access.

4.6
2019-12-16 CVE-2019-14608 Intel Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Intel products

Improper buffer restrictions in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escalation of privilege via local access.

4.6
2019-12-16 CVE-2019-14607 Intel Improper Check for Unusual or Exceptional Conditions vulnerability in Intel products

Improper conditions check in multiple Intel® Processors may allow an authenticated user to potentially enable partial escalation of privilege, denial of service and/or information disclosure via local access.

4.6
2019-12-16 CVE-2019-14605 Intel Incorrect Default Permissions vulnerability in Intel Setup and Configuration Software Platform Discovery Utility

Improper permissions in the installer for the Intel(R) SCS Platform Discovery Utility, all versions, may allow an authenticated user to potentially enable escalation of privilege via local attack.

4.6
2019-12-16 CVE-2019-14603 Intel Incorrect Default Permissions vulnerability in Intel Quartus Prime

Improper permissions in the installer for the License Server software for Intel® Quartus® Prime Pro Edition before version 19.3 may allow an authenticated user to potentially enable escalation of privilege via local access.

4.6
2019-12-16 CVE-2019-14599 Intel Untrusted Search Path vulnerability in Intel Control Center-I 2.1.0.0

Unquoted service path in Control Center-I version 2.1.0.0 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access.

4.6
2019-12-16 CVE-2019-14568 Intel Incorrect Default Permissions vulnerability in Intel Rapid Storage Technology

Improper permissions in the executable for Intel(R) RST before version 17.7.0.1006 may allow an authenticated user to potentially enable escalation of privilege via local access.

4.6
2019-12-16 CVE-2019-11157 Intel Improper Check for Unusual or Exceptional Conditions vulnerability in Intel products

Improper conditions check in voltage settings for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege and/or information disclosure via local access.

4.6
2019-12-16 CVE-2019-0159 Intel Unspecified vulnerability in Intel Administrative Tools FOR Intel Network Adapters

Insufficient memory protection in the Linux Administrative Tools for Intel(R) Network Adapters before version 24.3 may allow an authenticated user to potentially enable escalation of privilege via local access.

4.6
2019-12-16 CVE-2019-0134 Intel Incorrect Default Permissions vulnerability in Intel Dynamic Platform and Thermal Framework 8.3.10208.5643

Improper permissions in the Intel(R) Dynamic Platform and Thermal Framework v8.3.10208.5643 and before may allow an authenticated user to potentially execute code at an elevated level of privilege.

4.6
2019-12-18 CVE-2019-18996 ABB Untrusted Search Path vulnerability in ABB Pb610 Panel Builder 600

Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially allowing an attacker with access to the local file system the execution of code in the application’s context.

4.4
2019-12-18 CVE-2019-19689 Trendmicro Uncontrolled Search Path Element vulnerability in Trendmicro Housecall for Home Networks

Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited via a DLL Hijack related to a vulnerability on the packer that the program uses.

4.4
2019-12-18 CVE-2019-19688 Trendmicro Unspecified vulnerability in Trendmicro Housecall FOR Home Networks

A privilege escalation vulnerability in Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited allowing an attacker to place a malicious DLL file into the application directory and elevate privileges.

4.4
2019-12-18 CVE-2019-8801 Apple Untrusted Search Path vulnerability in Apple Itunes and mac OS X

A dynamic library loading issue existed in iTunes setup.

4.4
2019-12-17 CVE-2019-19675 Ivanti Incorrect Default Permissions vulnerability in Ivanti Workspace Control

In Ivanti Workspace Control before 10.3.180.0.

4.4
2019-12-17 CVE-2019-18829 Barco Untrusted Search Path vulnerability in Barco Clickshare Button R9861500D01 Firmware

Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check.

4.4
2019-12-20 CVE-2019-4744 IBM Cross-site Scripting vulnerability in IBM Financial Transaction Manager FOR Multiplatform 3.0.0.0

IBM Financial Transaction Manager 3.0 is vulnerable to cross-site scripting.

4.3
2019-12-20 CVE-2019-4743 IBM Cleartext Transmission of Sensitive Information vulnerability in IBM Financial Transaction Manager FOR Multiplatform 3.0.0.0

IBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens or session cookies.

4.3
2019-12-20 CVE-2019-4742 IBM Improper Restriction of Rendered UI Layers or Frames vulnerability in IBM Financial Transaction Manager FOR Multiplatform 3.0.0.0

IBM Financial Transaction Manager 3.0 could allow a remote attacker to hijack the clicking action of the victim.

4.3
2019-12-20 CVE-2019-4736 IBM Cross-Site Request Forgery (CSRF) vulnerability in IBM Financial Transaction Manager FOR Multiplatform 3.0.0.0

IBM Financial Transaction Manager 3.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

4.3
2019-12-20 CVE-2019-4231 IBM Cross-Site Request Forgery (CSRF) vulnerability in IBM Cognos Analytics

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

4.3
2019-12-20 CVE-2019-19916 Midori Browser Cross-site Scripting vulnerability in Midori-Browser Midori 0.5.11

In Midori Browser 0.5.11 (on Windows 10), Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the multipart/x-mixed-replace MIME type.

4.3
2019-12-20 CVE-2019-19692 Trendmicro Cross-site Scripting vulnerability in Trendmicro Apex ONE 2019

Trend Micro Apex One (2019) is affected by a cross-site scripting (XSS) vulnerability on the product console.

4.3
2019-12-20 CVE-2016-1000229 Smartbear
Redhat
Cross-site Scripting vulnerability in multiple products

swagger-ui has XSS in key names

4.3
2019-12-20 CVE-2015-8313 GNU
Debian
Information Exposure Through Discrepancy vulnerability in multiple products

GnuTLS incorrectly validates the first byte of padding in CBC modes

4.3
2019-12-20 CVE-2012-5639 Libreoffice
Debian
Apache
Exposure of Resource to Wrong Sphere vulnerability in multiple products

LibreOffice and OpenOffice automatically open embedded content

4.3
2019-12-20 CVE-2019-19908 Ciprianmp Cross-site Scripting vulnerability in Ciprianmp PHPmychat-Plus 1.98

phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL.

4.3
2019-12-19 CVE-2019-19910 Mediawiki Cross-site Scripting vulnerability in Mediawiki 1.34/1.35

The MinervaNeue Skin in MediaWiki from 2019-11-05 to 2019-12-13 (1.35 and/or 1.34) mishandles certain HTML attributes, as demonstrated by IMG onmouseover= (impact is XSS) and IMG src=http (impact is disclosing the client's IP address).

4.3
2019-12-19 CVE-2019-18955 Lansweeper Cross-site Scripting vulnerability in Lansweeper 7.2.105.2

The web console in Lansweeper 7.2.105.2 has XSS via the URL path.

4.3
2019-12-18 CVE-2019-11090 Intel Race Condition vulnerability in Intel products

Cryptographic timing conditions in the subsystem for Intel(R) PTT before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0 and 14.0.10; Intel(R) TXE 3.1.70 and 4.0.20; Intel(R) SPS before versions SPS_E5_04.01.04.305.0, SPS_SoC-X_04.00.04.108.0, SPS_SoC-A_04.00.04.191.0, SPS_E3_04.01.04.086.0, SPS_E3_04.08.04.047.0 may allow an unauthenticated user to potentially enable information disclosure via network access.

4.3
2019-12-18 CVE-2019-16782 Rack Project
Fedoraproject
Opensuse
Information Exposure Through Discrepancy vulnerability in multiple products

There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack).

4.3
2019-12-18 CVE-2019-19888 Ffjpeg Project Divide By Zero vulnerability in Ffjpeg Project Ffjpeg

jfif_decode in jfif.c in ffjpeg through 2019-08-21 has a divide-by-zero error.

4.3
2019-12-18 CVE-2019-19887 Ffjpeg Project NULL Pointer Dereference vulnerability in Ffjpeg Project Ffjpeg

bitstr_tell at bitstr.c in ffjpeg through 2019-08-21 has a NULL pointer dereference related to jfif_encode.

4.3
2019-12-18 CVE-2019-8817 Apple Improper Input Validation vulnerability in Apple mac OS X

A validation issue was addressed with improved input sanitization.

4.3
2019-12-18 CVE-2019-8813 Apple Cross-site Scripting vulnerability in Apple products

A logic issue was addressed with improved state management.

4.3
2019-12-18 CVE-2019-8794 Apple Improper Input Validation vulnerability in Apple products

A validation issue was addressed with improved input sanitization.

4.3
2019-12-18 CVE-2019-8789 Apple Link Following vulnerability in Apple Ipados and Iphone OS

A validation issue existed in the handling of symlinks.

4.3
2019-12-18 CVE-2019-8770 Apple Unspecified vulnerability in Apple mac OS X

The issue was addressed with improved permissions logic.

4.3
2019-12-18 CVE-2019-8769 Apple Unspecified vulnerability in Apple Ipados and Iphone OS

An issue existed in the drawing of web page elements.

4.3
2019-12-18 CVE-2019-8764 Apple Cross-site Scripting vulnerability in Apple Watchos

A logic issue was addressed with improved state management.

4.3
2019-12-18 CVE-2019-8731 Apple Incorrect Default Permissions vulnerability in Apple Iphone OS

A permissions issue existed in which execute permission was incorrectly granted.

4.3
2019-12-18 CVE-2019-8727 Apple Improper Input Validation vulnerability in Apple Iphone OS

A logic issue was addressed with improved state management.

4.3
2019-12-18 CVE-2019-8719 Apple Cross-site Scripting vulnerability in Apple Icloud, Itunes and Tvos

A logic issue was addressed with improved state management.

4.3
2019-12-18 CVE-2019-8705 Apple Out-of-bounds Write vulnerability in Apple mac OS X

A memory corruption issue was addressed with improved validation.

4.3
2019-12-18 CVE-2019-8698 Apple Improper Input Validation vulnerability in Apple Iphone OS

A validation issue existed in the entitlement verification.

4.3
2019-12-18 CVE-2019-8693 Apple Out-of-bounds Read vulnerability in Apple mac OS X

A validation issue was addressed with improved input sanitization.

4.3
2019-12-18 CVE-2019-8690 Apple Cross-site Scripting vulnerability in Apple products

A logic issue existed in the handling of document loads.

4.3
2019-12-18 CVE-2019-8674 Apple Cross-site Scripting vulnerability in Apple Safari

A logic issue was addressed with improved state management.

4.3
2019-12-18 CVE-2019-8670 Apple Improper Input Validation vulnerability in Apple Safari

An inconsistent user interface issue was addressed with improved state management.

4.3
2019-12-18 CVE-2019-8658 Apple Cross-site Scripting vulnerability in Apple products

A logic issue was addressed with improved state management.

4.3
2019-12-18 CVE-2019-8654 Apple Improper Input Validation vulnerability in Apple Safari

An inconsistent user interface issue was addressed with improved state management.

4.3
2019-12-18 CVE-2019-8649 Apple Cross-site Scripting vulnerability in Apple products

A logic issue existed in the handling of synchronous page loads.

4.3
2019-12-18 CVE-2019-8626 Apple Improper Input Validation vulnerability in Apple Iphone OS

An input validation issue was addressed with improved input validation.

4.3
2019-12-18 CVE-2019-8625 Apple Cross-site Scripting vulnerability in Apple Icloud, Itunes and Tvos

A logic issue was addressed with improved state management.

4.3
2019-12-18 CVE-2019-8615 Apple Out-of-bounds Read vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

4.3
2019-12-18 CVE-2019-8607 Apple Out-of-bounds Read vulnerability in Apple products

An out-of-bounds read was addressed with improved input validation.

4.3
2019-12-18 CVE-2019-8598 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple products

An input validation issue was addressed with improved input validation.

4.3
2019-12-18 CVE-2019-8597 Apple Type Confusion vulnerability in Apple products

Multiple memory corruption issues were addressed with improved memory handling.

4.3
2019-12-18 CVE-2019-8589 Apple Unspecified vulnerability in Apple mac OS X

This issue was addressed with improved checks.

4.3
2019-12-18 CVE-2019-8566 Apple Information Exposure vulnerability in Apple Iphone OS

An API issue existed in the handling of microphone data.

4.3
2019-12-18 CVE-2019-8560 Apple Out-of-bounds Read vulnerability in Apple products

An out-of-bounds read was addressed with improved bounds checking.

4.3
2019-12-18 CVE-2019-8554 Apple Unspecified vulnerability in Apple Iphone OS

A permissions issue existed in the handling of motion and orientation data.

4.3
2019-12-18 CVE-2019-8551 Apple Cross-site Scripting vulnerability in Apple products

A logic issue was addressed with improved validation.

4.3
2019-12-18 CVE-2019-8550 Apple Incomplete Cleanup vulnerability in Apple Iphone OS

An issue existed in the pausing of FaceTime video.

4.3
2019-12-18 CVE-2019-8517 Apple Out-of-bounds Read vulnerability in Apple products

An out-of-bounds read was addressed with improved bounds checking.

4.3
2019-12-18 CVE-2019-8515 Apple Information Exposure vulnerability in Apple products

A cross-origin issue existed with the fetch API.

4.3
2019-12-18 CVE-2019-8505 Apple Cross-site Scripting vulnerability in Apple Safari

A logic issue was addressed with improved validation.

4.3
2019-12-18 CVE-2019-8502 Apple Improper Input Validation vulnerability in Apple products

An API issue existed in the handling of dictation requests.

4.3
2019-12-18 CVE-2019-7292 Apple Improper Input Validation vulnerability in Apple products

A validation issue was addressed with improved logic.

4.3
2019-12-18 CVE-2019-7284 Apple Unspecified vulnerability in Apple Iphone OS

This issue was addressed with improved checks.

4.3
2019-12-18 CVE-2019-6222 Apple Unspecified vulnerability in Apple Iphone OS

A consistency issue was addressed with improved state handling.

4.3
2019-12-18 CVE-2019-6204 Apple Cross-site Scripting vulnerability in Apple Safari

A logic issue was addressed with improved validation.

4.3
2019-12-18 CVE-2019-19833 Tautulli Cross-Site Request Forgery (CSRF) vulnerability in Tautulli 2.1.9

In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server.

4.3
2019-12-18 CVE-2019-11992 HP Cross-site Scripting vulnerability in HP Oneview FOR VMWare Vcenter 9.5

A security vulnerability in HPE OneView for VMware vCenter 9.5 could be exploited remotely to allow Cross-Site Scripting.

4.3
2019-12-17 CVE-2019-17337 Tibco Cross-site Scripting vulnerability in Tibco products

The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker to perform a reflected cross-site scripting (XSS) attack.

4.3
2019-12-17 CVE-2013-0202 Owncloud Cross-site Scripting vulnerability in Owncloud

Cross-site scripting (XSS) vulnerability in ownCloud 4.5.5, 4.0.10, and earlier allows remote attackers to inject arbitrary web script or HTML via the action parameter to core/ajax/sharing.php.

4.3
2019-12-17 CVE-2012-2237 Mahara
Debian
Cross-site Scripting vulnerability in multiple products

Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript innerHTML as used when generating login forms, (2) links or (3) resources URLs, and (4) the Display name in a user profile.

4.3
2019-12-17 CVE-2019-16569 Jenkins Cross-Site Request Forgery (CSRF) vulnerability in Jenkins Mantis 0.26

A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to connect to an attacker-specified web server using attacker-specified credentials.

4.3
2019-12-17 CVE-2019-18833 Barco Missing Encryption of Sensitive Data vulnerability in Barco Clickshare Button R9861500D01 Firmware

Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information exposure (issue 2 of 2)..

4.3
2019-12-16 CVE-2019-19818 Gonitro Out-of-bounds Read vulnerability in Gonitro Nitro Free PDF Reader 12.0.0.112

The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0xa08a Out-of-Bounds Read via crafted Unicode content.

4.3
2019-12-16 CVE-2019-16779 Excon Project
Opensuse
Debian
Race Condition vulnerability in multiple products

In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket.

4.3
2019-12-16 CVE-2019-18827 Barco Improper Input Validation vulnerability in Barco products

On Barco ClickShare Button R9861500D01 devices (before firmware version 1.9.0) JTAG access is disabled after ROM code execution.

4.3
2019-12-16 CVE-2019-19368 Maxum Cross-site Scripting vulnerability in Maxum Rumpus 8.2.9.1

A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1.

4.3
2019-12-20 CVE-2019-15584 Gitlab Resource Exhaustion vulnerability in Gitlab

A denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker bypass input validation in markdown fields take down the affected page.

4.0
2019-12-20 CVE-2019-19691 Trendmicro Unspecified vulnerability in Trendmicro Apex ONE and Officescan

A vulnerability in Trend Micro Apex One and OfficeScan XG could allow an attacker to expose a masked credential key by manipulating page elements using development tools.

4.0
2019-12-20 CVE-2019-19789 Codesys NULL Pointer Dereference vulnerability in Codesys Plcwinnt, Runtime Toolkit and SP Realtime NT

3S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.54 allow a NULL pointer dereference.

4.0
2019-12-19 CVE-2019-11294 Cloudfoundry Incorrect Authorization vulnerability in Cloudfoundry Cf-Deployment

Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs, which should only be accessible to admins.

4.0
2019-12-19 CVE-2019-7484 Sonicwall SQL Injection vulnerability in Sonicwall SMA 100 Firmware

Authenticated SQL Injection in SonicWall SMA100 allow user to gain read-only access to unauthorized resources using viewcacert CGI script.

4.0
2019-12-18 CVE-2019-15591 Gitlab Unspecified vulnerability in Gitlab

An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled.

4.0
2019-12-18 CVE-2019-15580 Gitlab Information Exposure vulnerability in Gitlab

An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.

4.0
2019-12-18 CVE-2019-15577 Gitlab Improper Restriction of Excessive Authentication Attempts vulnerability in Gitlab

An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed project milestones to be disclosed via groups browsing.

4.0
2019-12-18 CVE-2019-8632 Apple Cleartext Transmission of Sensitive Information vulnerability in Apple Texture

Some analytics data was sent using HTTP rather than HTTPS.

4.0
2019-12-18 CVE-2019-15013 Atlassian Missing Authorization vulnerability in Atlassian Jira

The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to remove a configured issue status from a project via a missing authorisation check.

4.0
2019-12-17 CVE-2019-17336 Tibco Unspecified vulnerability in Tibco products

The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that theoretically allow an attacker access to information that can lead to obtaining credentials used to access Spotfire data sources.

4.0
2019-12-17 CVE-2019-17335 Tibco Information Exposure vulnerability in Tibco products

The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that theoretically allow an attacker access to data cached from a data source, or a portion of a data source, that the attacker should not have access to.

4.0
2019-12-17 CVE-2019-15235 Centos Webpanel Information Exposure Through Log Files vulnerability in Centos-Webpanel Centos web Panel 0.9.8.856/0.9.8.864

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx, and the victim's token value from /usr/local/cwpsrv/logs/access_log, then use them to gain access to the victim's password (for the OS and phpMyAdmin) via an attacker account.

4.0
2019-12-17 CVE-2019-14782 Centos Webpanel Information Exposure Through Log Files vulnerability in Centos-Webpanel Centos web Panel 0.9.8.856/0.9.8.864

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the /tmp directory, and the victim's token value from /usr/local/cwpsrv/logs/access_log, then use them to make a request to extract the victim's password (for the OS and phpMyAdmin) via an attacker account.

4.0
2019-12-17 CVE-2019-16576 Jenkins Missing Authorization vulnerability in Jenkins Alauda Kubernetes Support

A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins.

4.0
2019-12-17 CVE-2019-16574 Jenkins Missing Authorization vulnerability in Jenkins Alauda Devops Pipeline 2.3.2

A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

4.0
2019-12-17 CVE-2019-16571 Jenkins Missing Authorization vulnerability in Jenkins Rapiddeploy

A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server.

4.0
2019-12-17 CVE-2019-16567 Jenkins Missing Authorization vulnerability in Jenkins Team Concert

A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

4.0
2019-12-17 CVE-2019-16566 Jenkins Missing Authorization vulnerability in Jenkins Team Concert

A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

4.0
2019-12-17 CVE-2019-16557 Jenkins Insufficiently Protected Credentials vulnerability in Jenkins Redgate SQL Change Automation

Jenkins Redgate SQL Change Automation Plugin 2.0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

4.0
2019-12-17 CVE-2019-16556 Jenkins Insufficiently Protected Credentials vulnerability in Jenkins Rundeck

Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

4.0
2019-12-17 CVE-2019-16555 Jenkins Resource Exhaustion vulnerability in Jenkins Build Failure Analyzer

A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interrupt this process.

4.0
2019-12-17 CVE-2019-16554 Jenkins Incorrect Default Permissions vulnerability in Jenkins Build Failure Analyzer

A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression.

4.0
2019-12-17 CVE-2019-19830 Spip
Debian
Canonical
_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database.
4.0
2019-12-17 CVE-2019-15011 Atlassian Incorrect Default Permissions vulnerability in Atlassian Application Links

The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3.7, from version 5.4.0 before 5.4.13, and from version 6.0.0 before 6.0.5 disclosed application link information to non-admin users via a missing permissions check.

4.0
2019-12-17 CVE-2017-18107 Atlassian Cross-Site Request Forgery (CSRF) vulnerability in Atlassian Crowd

Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups via a Cross-site request forgery (CSRF) vulnerability.

4.0
2019-12-16 CVE-2019-5259 Huawei Improper Privilege Management vulnerability in Huawei products

There is an information leakage vulnerability on some Huawei products(AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;AR2200;AR2200-S;AR3200;AR3600).

4.0
2019-12-16 CVE-2019-13181 Solarwinds Improper Neutralization of Formula Elements in a CSV File vulnerability in Solarwinds Serv-U FTP Server 15.1.7

A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7.

4.0
2019-12-16 CVE-2019-19743 Dlink Improper Input Validation vulnerability in Dlink Dir-615 T1 Firmware 20.07

On D-Link DIR-615 devices, a normal user is able to create a root(admin) user from the D-Link portal.

4.0
2019-12-16 CVE-2019-4560 IBM Improper Input Validation vulnerability in IBM MQ Appliance

IBM MQ and IBM MQ Appliance 9.1 CD, 9.1 LTS, 9.0 LTS, and 8.0 is vulnerable to a denial of service attack caused by channels processing poorly formatted messages.

4.0

62 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2019-12-20 CVE-2019-19693 Trendmicro Information Exposure vulnerability in Trendmicro products

The Trend Micro Security 2020 consumer family of products contains a vulnerability that could allow a local attacker to disclose sensitive information or to create a denial-of-service condition on affected installations.

3.6
2019-12-20 CVE-2019-4555 IBM Cross-site Scripting vulnerability in IBM Cognos Analytics

IBM Cognos Analytics 11.0 and 11.0 is vulnerable to cross-site scripting.

3.5
2019-12-19 CVE-2019-18615 Arista Insufficiently Protected Credentials vulnerability in Arista Cloudvision Portal 2018.2.0/2018.2.3

In CloudVision Portal (CVP) for all releases in the 2018.2 Train, under certain conditions, the application logs user passwords in plain text for certain API calls, potentially leading to user password exposure.

3.5
2019-12-19 CVE-2019-19903 Backdropcms Cross-site Scripting vulnerability in Backdropcms Backdrop CMS

An issue was discovered in Backdrop CMS 1.14.x before 1.14.2.

3.5
2019-12-19 CVE-2019-19901 Backdropcms Cross-site Scripting vulnerability in Backdropcms Backdrop CMS

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2.

3.5
2019-12-19 CVE-2019-19900 Backdropcms Cross-site Scripting vulnerability in Backdropcms Backdrop CMS

An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2.

3.5
2019-12-18 CVE-2019-18994 ABB Improper Input Validation vulnerability in ABB Pb610 Panel Builder 600

Due to a lack of file length check, the HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier crashes when trying to load an empty *.JPR application file.

3.5
2019-12-18 CVE-2019-18571 Dell Cross-site Scripting vulnerability in Dell RSA Identity Governance and Lifecycle

The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a reflected cross-site scripting vulnerability in the My Access Live module [MAL].

3.5
2019-12-18 CVE-2019-7621 Elastic Cross-site Scripting vulnerability in Elastic Kibana

Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visualizations.

3.5
2019-12-18 CVE-2019-18267 GE Cross-site Scripting vulnerability in GE S2020 Firmware and S2020G Firmware

An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior.

3.5
2019-12-18 CVE-2019-19829 Solarwinds Cross-site Scripting vulnerability in Solarwinds Serv-U FTP Server 15.1.7

A cross-site scripting (XSS) vulnerability exists in SolarWinds Serv-U FTP Server 15.1.7 in the email parameter, a different vulnerability than CVE-2018-19934 and CVE-2019-13182.

3.5
2019-12-18 CVE-2019-4388 Hcltech Cross-site Scripting vulnerability in Hcltech Appscan Source

HCL AppScan Source 9.0.3.13 and earlier is susceptible to cross-site scripting (XSS) attacks by allowing users to embed arbitrary JavaScript code in the Web UI.

3.5
2019-12-18 CVE-2019-19742 Dlink Cross-site Scripting vulnerability in Dlink Dir-615 Firmware 20.07

On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.

3.5
2019-12-17 CVE-2019-19497 Altn Cross-site Scripting vulnerability in Altn Mdaemon Email Server 17.5.1

MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message.

3.5
2019-12-17 CVE-2019-16564 Jenkins Cross-site Scripting vulnerability in Jenkins Pipeline Aggregator View

Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to affects view content such as job display name or pipeline stage names.

3.5
2019-12-17 CVE-2019-16563 Jenkins Cross-site Scripting vulnerability in Jenkins Mission Control

Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to change these properties.

3.5
2019-12-17 CVE-2019-16562 Jenkins Cross-site Scripting vulnerability in Jenkins Buildgraph-View

Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored XSS vulnerability exploitable by users able to change build descriptions.

3.5
2019-12-16 CVE-2019-13182 Solarwinds Cross-site Scripting vulnerability in Solarwinds Serv-U FTP Server 15.1.7

A stored cross-site scripting (XSS) vulnerability exists in the web UI of SolarWinds Serv-U FTP Server 15.1.7.

3.5
2019-12-16 CVE-2019-18831 Barco Use of Hard-coded Credentials vulnerability in Barco products

Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information Exposure.

3.5
2019-12-16 CVE-2019-19783 Cyrus
Debian
Fedoraproject
Canonical
Improper Privilege Management vulnerability in multiple products

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8.

3.5
2019-12-20 CVE-2019-18263 Philips Inadequate Encryption Strength vulnerability in Philips products

An issue was found in Philips Veradius Unity, Pulsera, and Endura Dual WAN Router, Veradius Unity (718132) with wireless option (shipped between 2016-August 2018), Veradius Unity (718132) with ViewForum option (shipped between 2016-August 2018), Pulsera (718095) and Endura (718075) with wireless option (shipped between 26-June-2017 through 07-August 2018), Pulsera (718095) and Endura (718075) with ViewForum option (shipped between 26-June-2017 through 07-August 2018).

3.3
2019-12-18 CVE-2019-8804 Apple Improper Authentication vulnerability in Apple Ipados and Iphone OS

An inconsistency in Wi-Fi network configuration settings was addressed.

2.9
2019-12-22 CVE-2019-19922 Linux Resource Exhaustion vulnerability in Linux Kernel

kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1.

2.1
2019-12-19 CVE-2019-19341 Redhat Incorrect Permission Assignment for Critical Resource vulnerability in Redhat Ansible Tower 3.6.0/3.6.1

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-readable.

2.1
2019-12-18 CVE-2019-19788 Opera Unspecified vulnerability in Opera 52.1.2517.139570

Opera for Android before 54.0.2669.49432 is vulnerable to a sandboxed cross-origin iframe bypass attack.

2.1
2019-12-18 CVE-2019-11102 Intel Improper Input Validation vulnerability in Intel products

Insufficient input validation in Intel(R) DAL software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable information disclosure via local access.

2.1
2019-12-18 CVE-2019-11101 Intel Improper Input Validation vulnerability in Intel products

Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.10 and 14.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable information disclosure via local access.

2.1
2019-12-18 CVE-2019-11100 Intel Improper Input Validation vulnerability in Intel Active Management Technology Firmware

Insufficient input validation in the subsystem for Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable information disclosure via physical access.

2.1
2019-12-18 CVE-2019-0168 Intel Improper Input Validation vulnerability in Intel products

Insufficient input validation in the subsystem for Intel(R) CSME before versions 11.8.70, 12.0.45 and 13.0.10; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow a privileged user to potentially enable information disclosure via local access.

2.1
2019-12-18 CVE-2019-0165 Intel Improper Input Validation vulnerability in Intel Converged Security Management Engine Firmware

Insufficient Input validation in the subsystem for Intel(R) CSME before versions 12.0.45,13.0.10 and 14.0.10 may allow a privileged user to potentially enable denial of service via local access.

2.1
2019-12-18 CVE-2019-8798 Apple Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Apple products

A memory corruption issue was addressed with improved memory handling.

2.1
2019-12-18 CVE-2019-8793 Apple Improper Input Validation vulnerability in Apple Ipados and Iphone OS

A consistency issue existed in deciding when to show the screen recording indicator.

2.1
2019-12-18 CVE-2019-8775 Apple Information Exposure vulnerability in Apple Ipados and Iphone OS

The issue was addressed by restricting options offered on a locked device.

2.1
2019-12-18 CVE-2019-8742 Apple Information Exposure vulnerability in Apple Iphone OS

The issue was addressed by restricting options offered on a locked device.

2.1
2019-12-18 CVE-2019-8730 Apple Incomplete Cleanup vulnerability in Apple mac OS X

The contents of locked notes sometimes appeared in search results.

2.1
2019-12-18 CVE-2019-8704 Apple Improper Authentication vulnerability in Apple Iphone OS

An authentication issue was addressed with improved state management.

2.1
2019-12-18 CVE-2019-8692 Apple Out-of-bounds Read vulnerability in Apple mac OS X

A validation issue was addressed with improved input sanitization.

2.1
2019-12-18 CVE-2019-8691 Apple Out-of-bounds Read vulnerability in Apple mac OS X

A validation issue was addressed with improved input sanitization.

2.1
2019-12-18 CVE-2019-8682 Apple Missing Authentication for Critical Function vulnerability in Apple Iphone OS

The issue was addressed with improved UI handling.

2.1
2019-12-18 CVE-2019-8630 Apple Unspecified vulnerability in Apple Iphone OS

The issue was addressed with improved UI handling.

2.1
2019-12-18 CVE-2019-8599 Apple Information Exposure vulnerability in Apple Iphone OS

A logic issue was addressed with improved restrictions.

2.1
2019-12-18 CVE-2019-8568 Apple Link Following vulnerability in Apple products

A validation issue existed in the handling of symlinks.

2.1
2019-12-18 CVE-2019-8548 Apple Information Exposure vulnerability in Apple Watchos

An issue existed where partially entered passcodes may not clear when the device went to sleep.

2.1
2019-12-18 CVE-2019-8546 Apple Information Exposure vulnerability in Apple Iphone OS

An access issue was addressed with additional sandbox restrictions.

2.1
2019-12-18 CVE-2019-8541 Apple Unspecified vulnerability in Apple Iphone OS

A privacy issue existed in motion sensor calibration.

2.1
2019-12-18 CVE-2019-8537 Apple Unspecified vulnerability in Apple mac OS X

An access issue was addressed with improved memory management.

2.1
2019-12-18 CVE-2019-8522 Apple Insufficiently Protected Credentials vulnerability in Apple mac OS X

A logic issue was addressed with improved state management.

2.1
2019-12-18 CVE-2019-8520 Apple Out-of-bounds Read vulnerability in Apple mac OS X

An out-of-bounds read was addressed with improved bounds checking.

2.1
2019-12-18 CVE-2019-8519 Apple Out-of-bounds Read vulnerability in Apple mac OS X

An out-of-bounds read was addressed with improved bounds checking.

2.1
2019-12-18 CVE-2019-8510 Apple Out-of-bounds Read vulnerability in Apple products

An out-of-bounds read issue existed that led to the disclosure of kernel memory.

2.1
2019-12-18 CVE-2019-8507 Apple Improper Input Validation vulnerability in Apple mac OS X

Multiple memory corruption issues were addressed with improved input validation.

2.1
2019-12-18 CVE-2019-8504 Apple Improper Initialization vulnerability in Apple Iphone OS

A memory initialization issue was addressed with improved memory handling.

2.1
2019-12-18 CVE-2019-7293 Apple Out-of-bounds Write vulnerability in Apple products

A memory corruption issue was addressed with improved memory handling.

2.1
2019-12-18 CVE-2019-7289 Apple Path Traversal vulnerability in Apple Shortcuts

A parsing issue in the handling of directory paths was addressed with improved path validation.

2.1
2019-12-18 CVE-2019-6207 Apple Out-of-bounds Read vulnerability in Apple products

An out-of-bounds read issue existed that led to the disclosure of kernel memory.

2.1
2019-12-17 CVE-2019-16572 Jenkins Insufficiently Protected Credentials vulnerability in Jenkins Weibo 1.0.1

Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

2.1
2019-12-16 CVE-2019-14604 Intel NULL Pointer Dereference vulnerability in Intel Quartus Prime

Null pointer dereference in the FPGA kernel driver for Intel(R) Quartus(R) Prime Pro Edition before version 19.3 may allow an authenticated user to potentially enable denial of service via local access.

2.1
2019-12-16 CVE-2019-11165 Intel Improper Check for Unusual or Exceptional Conditions vulnerability in Intel Field Programmable Gate Array Software Development KIT FOR Opencl

Improper conditions check in the Linux kernel driver for the Intel(R) FPGA SDK for OpenCL(TM) Pro Edition before version 19.4 may allow an authenticated user to potentially enable denial of service via local access.

2.1
2019-12-16 CVE-2019-11096 Intel Unspecified vulnerability in Intel Ethernet I218 Adapter Driver

Insufficient memory protection for Intel(R) Ethernet I218 Adapter driver for Windows* 10 before version 24.1 may allow an authenticated user to potentially enable information disclosure via local access.

2.1
2019-12-16 CVE-2019-4444 IBM Information Exposure vulnerability in IBM API Connect

IBM API Connect 2018.1 through 2018.4.1.7 Developer Portal's user registration page does not disable password autocomplete.

2.1
2019-12-18 CVE-2019-8757 Apple Race Condition vulnerability in Apple mac OS X

A race condition existed when reading and writing user preferences.

1.9
2019-12-17 CVE-2014-8178 Docker
Opensuse
Improper Input Validation vulnerability in multiple products

Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.

1.9