CVEs published in December 2019
1,536 vulnerabilities, 253 critical, 19 exploited.
- qnap photo stationThis improper access control vulnerability allows remote attackers to gain unauthorized access to...9.8 Critical
- sceditorSCEditor 2.1.3 allows XSS.6.1 Medium
- openstack nova, debian linux, openstack-nova +2 moreOpenStack nova base images permissions are world readable5.5 Medium
- kubernetes external-provisioner, external-resizer, external-snapshotter +4 more +6 moreKubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation4.8 Medium
- kubernetes, fedoraproject fedora +1 moreKubernetes API server follows unvalidated redirects from streaming Kubelet endpoints2.6 Low
- katelloKatello: Username in Notification page has cross site scripting5.4 Medium
- thinkparq beegfsbeegfs-ctl in ThinkParQ BeeGFS through 7.1.3 allows Authentication Bypass via communication with...9.6 Critical
- intelbras iwr 3000n firmwareIntelbras IWR 3000N 1.8.7 devices allow disclosure of the administrator login name and password...7.2 High
- adobe stock api integration, prestashop +1 morereset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for...9.8 Critical
- adobe stock api integration, prestashop +1 morereset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API...9.8 Critical
- haskell-tls-extra, haskell hs-tls +1 morehaskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in...7.4 High
- openshift haproxy cartridge haproxy cartridge, redhat openshift +1 moreOpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate...5.5 Medium
- otrsDenial of service5.3 Medium
- keycloakKeycloak Authentication Error9.3 Critical
- palo alto networks pan-osPAN-OS: Custom-role users may escalate privileges7.8 High
- sqlite, netapp cloud backup, ontap select deploy administration utility +5 more +7 morelookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a...9.8 Critical
- linux kernel, canonical ubuntu linux +1 morefpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when...6.1 Medium
- opendetex project opendetexOpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf.7.8 High
- opensuse factory, munge, suse linux enterprise server 15 +2 moreLocal privilege escalation from user munge to root7.7 High
- dnsmasq, fedoraproject fedora +1 moreA vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote...3.7 Low
- suse permissions, opensuse leap +1 morechkstat follows untrusted symbolic links6.8 Medium
- wp-pdf pdf embedderThe Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF...9.8 Critical
- dlink dap-1860 firmwareD-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root...8.8 High
- dlink dap-1860 firmwareD-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without...8.8 High
- gitbookGitBook allows Cross-site Scripting via a local .md file.5.4 Medium
- radare radare2In radare2 through 4.0, there is an integer overflow for the variable new_token_size in the...7.8 High
- wireshark, debian linux, opensuse leap +2 more +4 moreIn Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was...7.5 High
- validators project validatorsUncontrolled resource consumption in validators Python package7.5 High
- wso2 enterprise integratorIn WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor...6.1 Medium
- openbsdIn OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding...7.8 High
- openbsdxlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a...7.8 High
- openbsdlibc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by...9.8 Critical
- openbsdOpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled,...7.8 High
- minidlna project minidlna, debian linux +1 moreAn SQL Injection vulnerability exists in MiniDLNA prior to 1.1.09.8 Critical
- xen, fedoraproject fedora +1 moreAn issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via...6.8 Medium
- bmc remedy smart reportingBMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One...6.5 Medium
- dash core, officialdapscoin decentralized anonymous payment system, pivx private instant verified transactions +2 moreAn issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. It...4.3 Medium
- decentralized anonymous payment system project anonymous payment system, pivx private instant verified transactions +1 moreAn issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. The...7.5 High
- cssheroThe CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a...6.1 Medium
- fronius datamanager box 2.0 firmware, eco 25.0-3-s firmware, eco 27.0-3-s firmware +63 more +65 moreFronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication...9.8 Critical
- fronius datamanager box 2.0 firmware, eco 25.0-3-s firmware, eco 27.0-3-s firmware +63 more +65 moreadmincgi-bin/service.fcgi on Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allows...6.5 Medium
- sony catalyst browse, catalyst production suite +1 moreIn Sony Catalyst Production Suite through 2019.1 (1.1.0.21) and Catalyst Browse through 2019.1 (1...7.8 High
- joomlaworks k2, verot project verot +1 moreRemote code execution in verot/class.upload.php9.8 Critical
- davicalA stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize...5.4 Medium
- davicalA CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker...8.8 High
- apache olingoImproper input validation in Apache Olingo7.5 High
- apache olingoDeserialization of Untrusted Data in Apache Olingo9.8 Critical
- apache olingoImproper Restriction of XML External Entity Reference in Apache Olingo5.5 Medium
- qnap qtsA stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions...4.8 Medium
- qnap netbak replicatorAn unquoted service path vulnerability is reported to affect the service ?QVssService? in QNAP...7.8 High
- Show moreLoading…