CVEs published in December 2019
1,536 vulnerabilities, 253 critical, 19 exploited.
- qnap qtsThis command injection vulnerability in File Station allows attackers to execute commands on the...9.8 Critical
- qnap music stationThis command injection vulnerability in Music Station allows attackers to execute commands on the...9.8 Critical
- facebook proxygenIn the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header...9.8 Critical
- qnap helpdeskThis improper access control vulnerability in Helpdesk allows attackers to access the system logs...7.5 High
- facebook hhvmVarious APC functions accept keys containing null bytes as input, leading to premature truncation...9.8 Critical
- facebook hhvmInsufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of...9.8 Critical
- facebook follyImproper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket....9.8 Critical
- facebook hhvmAn invalid free in mb_detect_order can cause the application to crash or potentially result in...9.8 Critical
- xfig project xfigread_textobject in read.c in Xfig fig2dev 3.2.7b has a stack-based buffer overflow because of an...5.5 Medium
- facebook mcrouterIn Mcrouter prior to v0.41.0, a large struct input provided to the Carbon protocol reader could...7.5 High
- facebook mcrouterIn Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user...7.5 High
- copadata zenonCOPA-DATA zenone32 zenon Editor through 8.10 has an Uncontrolled Search Path Element.7.8 High
- keycloakKeycloak Authentication Error9.3 Critical
- trustedsec trevorc2TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response...7.5 High
intel-microcodeUbuntuintel-microcode regressionNo scoreintel-microcodeUbuntuintel-microcode regressionNo score- mozilla firefoxIf an image had not loaded correctly (such as when it is not actually an image), it could be...7.4 High
- mozilla firefoxMozilla developers reported memory safety bugs present in Firefox 70. Some of these bugs showed...8.8 High
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreMozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some...8.8 High
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreUnder certain conditions, when retrieving a document from a DocShell in the antitracking code, a...7.5 High
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreUnder certain conditions, when checking the Resist Fingerprinting preference during device...7.5 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen using nested workers, a use-after-free could occur during worker destruction. This resulted...8.8 High
- mozilla firefox, firefox esr, thunderbird +2 more +4 moreThe plain text serializer used a fixed-size array for the number of <ol> elements it could...8.8 High
- mozilla firefoxImproper refcounting of soft token session objects could cause a use-after-free and crash (likely...8.8 High
- shadowsocks shadowsocks-libev, opensuse backports sle, leap +2 moreAn exploitable code execution vulnerability exists in the ss-manager binary of Shadowsocks-libev...7.8 High
- shadowsocks shadowsocks-libev, opensuse backports, leap +2 moreAn exploitable denial-of-service vulnerability exists in the UDPRelay functionality of...5.9 Medium
- embedthis goaheadAn exploitable code execution vulnerability exists in the processing of multi-part/form-data...9.8 Critical
- embedthis goaheadA denial-of-service vulnerability exists in the processing of multi-part/form-data requests in...5.3 Medium
- formalmsExploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1....7.4 High
- formalmsExploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1....7.4 High
- formalmsExploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1....7.4 High
- formalmsExploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1....7.4 High
- accusoft imagegearAn exploitable out-of-bounds write vulnerability exists in the igcore19d.dll BMP parser of the...9.8 Critical
- accusoft imagegearAn exploitable out-of-bounds write vulnerability exists in the igcore19d.dll GEM Raster parser of...9.8 Critical
- accusoft imagegearAn exploitable out-of-bounds write vulnerability exists in the igcore19d.dll PNG header-parser of...9.8 Critical
- accusoft imagegearAn exploitable out-of-bounds write vulnerability exists in the igcore19d.dll TIFdecodethunderscan...9.8 Critical
- dell command update, command update (dcu) +1 moreDell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A...5.6 Medium
- dell command update, command update (dcu) +1 moreDell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A...5.6 Medium
- dell rsa authentication manager, rsa authentication manager +1 moreRSA Authentication Manager software versions prior to 8.4 P8 contain a stored cross-site...4.8 Medium
- linux kernelIn the Linux kernel before 5.1.6, there is a use-after-free in serial_ir_init_module() in drivers...7.8 High
- axtls project axtlsThe asn1_signature function in asn1.c in Cameron Hamilton-Rich axTLS through 2.1.5 has a Buffer...7.5 High
- axtls project axtlsprocess_certificate in tls1.c in Cameron Hamilton-Rich axTLS through 2.1.5 has a Buffer Overflow...7.5 High
- freeradius, opensuse leap, redhat enterprise linux +2 moreIn FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the...6.5 Medium
- okay-cms okaycmsIn OkayCMS through 2.3.4, an unauthenticated attacker can achieve remote code execution by...9.8 Critical
- openwrtOpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules...5.4 Medium
- openwrtOpenWrt 18.06.4 allows XSS via the "New port forward" Name field to the cgi-bin/luci/admin...5.4 Medium
- maxpcsecure anti virus plusMax Secure Anti Virus Plus 19.0.4.020 has Insecure Permissions on the installation directory....7.8 High
- freeftpdfreeFTPd 1.0.8 has a Post-Authentication Buffer Overflow via a crafted SIZE command (this is...8.8 High
- saltosystem proaccess spaceSALTO ProAccess SPACE 5.4.3.0 allows XSS.5.4 Medium
- saltosystem proaccess spaceSALTO ProAccess SPACE 5.4.3.0 allows Directory Traversal in the Data Export feature.8.6 High
- Show moreLoading…