CVEs published in December 2019
1,536 vulnerabilities, 253 critical, 19 exploited.
- qualcomm, inc. snapdragon mobile, snapdragon voice & music, qualcomm qcs405 firmware, sd 205 firmware +11 more +13 moreAn unprivileged application can allocate GPU memory by calling memory allocation ioctl function...5.5 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8017 firmware +53 more +55 morePossibility of memory overflow while decoding GSNDCP compressed mode PDU in Snapdragon Auto,...9.8 Critical
- qualcomm, inc. snapdragon auto, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8017 firmware +39 more +41 moreRace condition between the camera functions due to lack of resource lock which will lead to...8.1 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon wearables, qualcomm apq8053 firmware, mdm9206 firmware +46 more +48 morePosition determination accuracy may be degraded due to wrongly decoded information in Snapdragon...9.8 Critical
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8017 firmware +53 more +55 moreInfinite loop while decoding compressed data can lead to overrun condition in Snapdragon Auto,...7.5 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm apq8098 firmware, msm8909w firmware +14 more +16 moreUse after free issue occurs when command destructors access dynamically allocated response buffer...5.5 Medium
- brizoit work time calendarThe Work Time Calendar app before 4.7.1 for Jira allows XSS.6.1 Medium
- fig2dev project fig2dev, fedoraproject fedora +1 moremake_arrow in arrow.c in Xfig fig2dev 3.2.7b allows a segmentation fault and out-of-bounds write...5.5 Medium
- octeth oemproOcteth Oempro 4.7 allows SQL injection. The parameter CampaignID in Campaign.Get is vulnerable.9.8 Critical
- minerstat msosminerstat msOS before 2019-10-23 does not have a unique SSH key for each instance of the product.9.8 Critical
- openbsdOpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in...7.8 High
- snakeyaml project snakeyaml, fedoraproject fedora, oracle peoplesoft enterprise pt peopletools +1 more +3 moreSnakeYAML Entity Expansion during load operation7.5 High
- leadtoolsAn exploitable heap out of bounds write vulnerability exists in the UI tag parsing functionality...8.8 High
- leadtoolsAn exploitable heap overflow vulnerability exists in the JPEG2000 parsing functionality of...8.8 High
- leadtoolsAn exploitable denial-of-service vulnerability exists in the Dicom-packet parsing functionality...7.5 High
- leadtoolsAn exploitable code execution vulnerability exists in the DICOM packet-parsing functionality of...9.8 Critical
- leadtoolsAn exploitable code execution vulnerability exists in the DICOM network response functionality of...8.1 High
- leadtoolsAn exploitable information disclosure vulnerability exists in the DICOM packet-parsing...9.1 Critical
- avaya ip office application serverAvaya IP Office XSS Vulnerability6.4 Medium
- puppet continuous deliveryWhen using the cd4pe::root_configuration task to configure a Continuous Delivery for PE...6.5 Medium
- perforce puppet enterprise, puppet enterprise +1 moreThe express install, which is the suggested way to install Puppet Enterprise, gives the user a...9.8 Critical
- amazon blink xt2 sync module firmwareBlink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary code...6.8 Medium
- amazon blink xt2 sync module firmwareBlink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary...8.8 High
- amazon blink xt2 sync module firmwareBlink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary...8.8 High
- amazon blink xt2 sync module firmwareBlink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary...8.8 High
- amazon blink xt2 sync module firmwareBlink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary...8.8 High
- amazon blink xt2 sync module firmwareBlink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary...9.8 Critical
- gemalto sentinel ldk license managerSafeNet Sentinel LDK License Manager, all versions prior to 7.101(only Microsoft Windows versions...7.8 High
- reliablecontrols rc-licensemanagerReliable Controls LicenseManager versions 3.4 and prior may allow an authenticated user to insert...7.8 High
- micro focus international acutowebUnauthorized file download vulnerability in all supported versions of Micro Focus AcuToWeb. The...7.5 High
- sap enable nowSAP Enable Now, before version 1911, leaks information about the existence of a particular user...7.5 High
- sap enable nowSAP Enable Now, before version 1911, leaks information about network configuration in the server...7.5 High
- sap enable nowSAP Enable Now, before version 1911, allows an attacker to input commands into the CSV files,...9.8 Critical
- sap adaptive server enterpriseSAP Adaptive Server Enterprise, before versions 15.7 and 16.0, under certain conditions exposes...4.4 Medium
- sap portfolio and project management, sap se portfolio and project management (cprxrpm), portfolio and project management (eppm) +1 more +3 moreSAP Portfolio and Project Management, before versions S4CORE 102, 103, EPPM 100 and CPRXRPM...6.5 Medium
- sap businessobjects business intelligence platform, sap se businessobjects business intelligence platform (monitoring application) +1 moreDue to insufficient CSRF protection, SAP BusinessObjects Business Intelligence Platform ...8.8 High
- sap businessobjects business intelligence platform, sap se businessobjects business intelligence platform (fiori bi launchpad) +1 moreSAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad), before version 4.2,...5.4 Medium
- bson-objectid project bson-objectidbson-objectid contains Improper input validation7.5 High
- squiz matrixAn issue was discovered in core/assets/form/form_question_types/form_question_type_file_upload...9.1 Critical
- squiz matrixAn issue was discovered in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2...7.5 High
drupal/permissions_by_termPackagistThe Permissions by Term module extends Drupal by functionality for restricting access to single nodes via taxonomy terms. The module doesn't sufficiently restrict access to node previews, when the Sea…No scoredrupal/modal_pagePackagistThis project enables administrators to create modal dialogs. The routes used by the module lacked proper permissions, allowing untrusted users to access, create and modify modal configurations.No score- cart66 lite pluginMultiple cross-site scripting (XSS) vulnerabilities in products.php in the Cart66 Lite plugin...6.1 Medium
- dbd::pgpp, dbd\ \ +1 moreSQL injection vulnerability in DBD::PgPP 0.05 and earlier9.8 Critical
drupal/taxonomy_access_fixPackagistThis module extends access handling of Drupal Core's Taxonomy module. The module doesn't sufficiently check, if a given entity should be access controlled, defaulting to allowing access even to unpubl…No score- ovislink airlive poe2600hd firmwareAirLive POE-2600HD allows remote attackers to cause a denial of service (device reset) via a long...7.5 High
drupal/smart_trimPackagistThe Smart Trim module allows site builders additional control with text summary fields. The module doesn't sufficiently filter text when certain options are selected. This vulnerability is mitigated b…No score- grandstream gxv3500 firmware, gxv3501 firmware, gxv3504 firmware +10 more +12 moreGrandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD,...10.0 Critical
- zohocorp manageengine applications managerZoho ManageEngine Applications Manager before 13620 allows a remote unauthenticated SQL injection...9.8 Critical
- puppet enterprisePuppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via...6.1 Medium
- Show moreLoading…