CVEs published in December 2019
1,536 vulnerabilities, 253 critical, 19 exploited.
- petwant pf-103 firmware, skymee petalk ai firmware +1 moreUse of default credentials for the TELNET server in Petwant PF-103 firmware 4.3.2.50 and Petalk...9.8 Critical
- petwant pf-103 firmware, skymee petalk ai firmware +1 moreUnencrypted HTTP communications for firmware upgrades in Petalk AI and PF-103 allow man-in-the...8.1 High
openafsMageiaUpdated openafs packages fix security vulnerabilitiesNo score- zohocorp manageengine eventlog analyzerAn issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By...8.8 High
- egain mailThe eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to ...7.5 High
- cyxtera appgate sdpIn Cyxtera AppGate SDP Client 4.1.x through 4.3.x before 4.3.2 on Windows, a local or remote user...8.8 High
- progress telerik ui for asp.net ajax, telerik radchart +1 morePath traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and...9.8 Critical
- vocabularyserver tematresTemaTres 3.0 has reflected XSS via the replace_string or search_string parameter to the vocab...6.1 Medium
- ibm case manager, business automation workflow +1 moreThe Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1...5.4 Medium
- atasm project atasm, fedoraproject fedora +1 moreATasm 1.06 has a stack-based buffer overflow in the to_comma() function in asm.c via a crafted ...7.8 High
- atasm project atasm, fedoraproject fedora +1 moreATasm 1.06 has a stack-based buffer overflow in the parse_expr() function in setparse.c via a...7.8 High
- atasm project atasm, fedoraproject fedora +1 moreATasm 1.06 has a stack-based buffer overflow in the get_signed_expression() function in setparse...7.8 High
- huawei s5700 firmware, s6700 firmware +1 moreHuawei S5700 and S6700 have a DoS security vulnerability. Attackers with certain permissions...6.5 Medium
- huawei cloudengine 12800, cloudengine 12800 firmware +1 moreCloudEngine 12800 has a DoS vulnerability. An attacker of a neighboring device sends a large...7.4 High
- huawei ar120-s firmware, ar1200-s firmware, ar1200 firmware +15 more +17 moreSome Huawei products have an insufficient verification of data authenticity vulnerability. A...5.9 Medium
- huawei enjoy 7s firmware, honor 20s firmware, honor 9 lite firmware +6 more +8 moreThere is a path traversal vulnerability in several Huawei smartphones. The system does not...5.5 Medium
- huawei mate 20 pro firmwareMate 20 Pro smartphones with versions earlier than 9.1.0.135(C00E133R3P1) have an improper...7.8 High
- huawei s12700 firmware, s1700 firmware, s2700 firmware +4 more +6 moreThere is a weak algorithm vulnerability in some Huawei products. The affected products use weak...7.5 High
- expresstech quiz and survey masterThe quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected...6.1 Medium
- debian duplicity, linux, opensuse +2 moreduplicity 0.6.24 has improper verification of SSL certificates7.5 High
- pen project pen, debian linux, opensuse +2 morePen 0.18.0 has Insecure Temporary File Creation vulnerabilities4.4 Medium
- suphpsuPHP before 0.7.2 source-highlighting feature allows security bypass which could lead to...7.8 High
- redhat satellite, rubygem-hammer cli foreman cli foreman, theforeman hammer cli +2 morerubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable5.5 Medium
- apache qpid-cppqpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all...7.5 High
- cfme, redhat cloudforms, cloudforms management engine +2 moreCFME: CSRF protection vulnerability via permissive check of the referrer header8.8 High
- mcollective, debian linux, puppet marionette collective +1 more +3 moremcollective has a default password set at install9.8 Critical
- idrix veracryptVeraCrypt 1.24 allows Local Privilege Escalation during execution of VeraCryptExpander.exe.7.8 High
- envoyproxy envoyAn issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host...7.5 High
- envoyproxy envoyAn issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such...9.8 Critical
- envoyproxy envoyAn issue was discovered in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that...9.8 Critical
- atlassian saml single sign onAn issue was discovered in the SAML Single Sign On (SSO) plugin for several Atlassian products...7.5 High
- dovecot, fedoraproject fedora +1 moreIn Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email...5.3 Medium
- labf aceaxe plusThe FTP client in AceaXe Plus 1.0 allows a buffer overflow via a long EHLO response from an FTP...9.8 Critical
- saitoha libsixelAn issue was discovered in libsixel 1.8.2. There is a heap-based buffer over-read in the function...8.8 High
- saitoha libsixel, nothings stb image.h +1 morestb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has a heap...8.8 High
- cli, npmjs npm, fedoraproject fedora +4 more +6 moreArbitrary File Overwrite in npm CLI7.7 High
- cli, npmjs npm, fedoraproject fedora +4 more +6 moreUnauthorized File Access in npm CLI before before version 6.13.37.7 High
- cli, npmjs npm, fedoraproject fedora +4 more +6 moreUnauthorized File Access in npm CLI before before version 6.13.37.7 High
- spip, canonical ubuntu linux, debian linux +2 more_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject...6.5 Medium
- intel core i3-1000g1 firmware, core i3-1000g4 firmware, core i3-1005g1 firmware +375 more +377 moreImproper conditions check in multiple Intel? Processors may allow an authenticated user to...5.3 Medium
- phpfastcacheObject injection in cookie driver4.4 Medium
- apache spamassassin, debian linux +1 moreIn Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources...7.5 High
- apache spamassassin, debian linux +1 moreIn Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands...6.7 Medium
- w1.fi hostapdAn exploitable denial-of-service vulnerability exists in the 802.11w security state handling for...7.4 High
- w1.fi hostapdAn exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could...7.4 High
- kakadusoftware kakadu softwareA freed memory access vulnerability exists in the SVG Marker Element feature of Apple Safari's...8.1 High
- advantech webaccessAdvantech WebAccess before 8.4.3 allows unauthenticated remote attackers to execute arbitrary...9.8 Critical
- lodahs project lodahslodahs is malware8.8 High
- linux kernelThe Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after...5.5 Medium
- linux kernel, fedoraproject fedora +1 moreIn the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire...6.7 Medium
- Show moreLoading…