CVEs published in December 2019
1,536 vulnerabilities, 253 critical, 19 exploited.
- zohocorp manageengine applications managerZoho ManageEngine Applications Manager before 13640 allows a remote authenticated SQL injection...8.8 High
- wolfsslwolfSSL and wolfCrypt 4.1.0 and earlier (formerly known as CyaSSL) generate biased DSA nonces....5.3 Medium
- xen, fedoraproject fedora +1 moreAn issue was discovered in Xen through 4.12.x allowing x86 AMD HVM guest OS users to cause a...7.2 High
- xen, fedoraproject fedora +1 moreAn issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of...8.8 High
- xen, fedoraproject fedora +1 moreAn issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS...6.6 Medium
- xen, fedoraproject fedora +1 moreAn issue was discovered in Xen through 4.12.x allowing 32-bit Arm guest OS users to cause a...6.5 Medium
- xen, fedoraproject fedora +1 moreAn issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of...6.5 Medium
- xen, debian linux, fedoraproject fedora +1 more +3 moreAn issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a...7.5 High
- symantec messaging gatewaySymantec Messaging Gateway, prior to 10.7.3, may be susceptible to a server-side request forgery ...7.3 High
- symantec messaging gatewaySymantec Messaging Gateway, prior to 10.7.3, may be susceptible to a cross-site scripting (XSS)...4.8 Medium
- symantec messaging gatewaySymantec Messaging Gateway, prior to 10.7.3, may be susceptible to a privilege escalation...7.2 High
- openshiftOpenshift has shell command injection flaws due to unsanitized data being passed into shell...8.8 High
- svg-sanitizer project svg-sanitizerSanitizer bypass in svg-sanitizer6.1 Medium
- apple macos, freebsd, itop vpn +6 more +8 moreA vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a...7.4 High
- atlassian crucible, fisheye +1 moreThe /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8...4.3 Medium
- atlassian crucible, fisheye +1 moreThe /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3...6.1 Medium
- atlassian crucible, fisheye +1 moreThe review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote...4.8 Medium
- ibm spectrum scaleIBM Spectrum Scale 4.2 and 5.0 could allow a remote authenticated attacker to execute arbitrary...8.8 High
- ibm spectrum scaleIBM Spectrum Scale 4.2 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows...5.4 Medium
- foremanForeman has improper input validation which could lead to partial Denial of Service5.3 Medium
- katello-headpin, redhat subscription asset manager +1 morekatello-headpin is vulnerable to CSRF in REST API6.5 Medium
- node-connect, sencha connect, debian linux +2 moreNode Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware6.1 Medium
- sencha connect, debian linux, opensuse +1 more +3 moremethodOverride Middleware Reflected Cross-Site Scripting in connect6.1 Medium
- jbossweb bayeux bayeux, redhat jboss enterprise application platform, jboss portal +2 moreJBossWeb Bayeux has reflected XSS6.1 Medium
- omniauth-facebookomniauth-facebook Improper Authentication vulnerability7.5 High
- smokeping, debian linux, fedoraproject fedora +2 moresmokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)6.1 Medium
- amazon firecrackerFirecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result...9.8 Critical
- mcafee techcheck, mcafee, llc mcafee techcheck +1 moreDLL Search Order Hijacking6.6 Medium
- yabasicYabasic 2.86.1 has a heap-based buffer overflow in the yylex() function in flex.c via a crafted...8.8 High
- tableau serverTableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect...6.1 Medium
- mediawiki visual editorThe VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an...6.1 Medium
- mediawiki, debian linux +1 morePossible to circumvent title-blacklist6.1 Medium
- moxa eds-g508e firmware, eds-g512e firmware, eds-g516e firmware +2 moreOn Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices (with firmware through 6.0), denial of...7.5 High
- sysstat project sysstat, canonical ubuntu linux, debian linux +2 moresysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.9.8 Critical
- progress telerik ui for asp.net ajax, telerik ui for asp.net ajax +1 moreProgress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization...9.8 Critical
- cacti, debian linux, opensuse leap +2 moreCacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization...8.1 High
- git-scm git, debian linux, fedoraproject fedora +1 more +3 moreArbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before...7.8 High
- microsoft skype for business, skype for business server 2019 cu2 +1 moreA spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a...5.4 Medium
- microsoft windows xp service pack 3, windows xp +1 moreAn information disclosure vulnerability exists when the Windows Remote Desktop Protocol (RDP)...7.5 High
- microsoft windows, windows 10 version 1903 for 32-bit systems, windows 10 version 1903 for arm64-based systems +15 more +17 moreA security feature bypass vulnerability exists when Microsoft Defender improperly handles...3.3 Low
- microsoft authentication library, authentication library (msal) for android +1 moreAn information disclosure vulnerability in Android Apps using Microsoft Authentication Library ...6.5 Medium
- microsoft visual studio live share, visual studio 2019, visual studio 2019 version 16.4 (includes 16.0 - 16.3) +1 more +3 moreA spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live...6.1 Medium
- microsoft internet explorer 10, internet explorer 11, internet explorer 11 on windows 10 version 1903 for 32-bit systems +8 more +10 moreA remote code execution vulnerability exists in the way that the VBScript engine handles objects...7.5 High
- microsoft windows, windows 10 version 1903 for 32-bit systems, windows 10 version 1903 for arm64-based systems +15 more +17 moreA remote code execution vulnerability exists when Microsoft Windows OLE fails to properly...7.8 High
- microsoft windows, windows 10 version 1903 for 32-bit systems, windows 10 version 1903 for arm64-based systems +10 more +12 moreAn elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly...7.8 High
- microsoft windows, windows 7 +1 moreAn information disclosure vulnerability exists in Windows Media Player when it fails to properly...4.3 Medium
- microsoft windows, windows 7 +1 moreAn information disclosure vulnerability exists in Windows Media Player when it fails to properly...4.3 Medium
- microsoft windows, windows server, windows 7 +1 more +3 moreAn elevation of privilege vulnerability exists when Windows improperly handles COM object...7.8 High
- microsoft windows, windows server, windows 10 +1 more +3 moreAn elevation of privilege vulnerability exists when the Windows Printer Service improperly...7.8 High
- microsoft windows, windows 10 version 1903 for 32-bit systems, windows 10 version 1903 for arm64-based systems +10 more +12 moreAn elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC)...7.8 High
- Show moreLoading…