CVEs published in December 2019
1,536 vulnerabilities, 253 critical, 19 exploited.
- apache tomcat, canonical ubuntu linux, debian linux +8 more +10 moreIn Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack7.5 High
- red hat ceph storageA flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon...6.5 Medium
- php, canonical ubuntu linux, debian linux +3 more +5 moreUse-after-free in exif parsing under memory sanitizer4.8 Medium
- php, debian linux, fedoraproject fedora +1 more +3 moremail() may release string with refcount==1 twice6.5 Medium
- php, canonical ubuntu linux, debian linux +1 more +3 moreHeap-buffer-overflow READ in exif4.8 Medium
- php, canonical ubuntu linux, debian linux +3 more +5 moreBuffer underflow in bc_shift_addsub3.7 Low
- php, canonical ubuntu linux, debian linux +3 more +5 moreDirectoryIterator class silently truncates after a null byte3.7 Low
- php, fedoraproject fedora, tenable security center +2 morelink() silently truncates after a null byte on Windows3.7 Low
- mz-automation libiec61850In libIEC61850 1.4.0, MmsValue_newOctetString in mms/iso_mms/common/mms_value.c has an integer...6.5 Medium
- mz-automation libiec61850In libIEC61850 1.4.0, MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c has a heap...8.8 High
- malwarebytes adwcleanerAn Untrusted Search Path vulnerability in Malwarebytes AdwCleaner before 8.0.1 could cause...7.8 High
- sqlite, debian linux, netapp cloud backup +11 more +13 moremultiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as...7.5 High
- virglrenderer project virglrenderer, debian linux, opensuse leap +1 more +3 moreA heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer...5.5 Medium
- virglrenderer project virglrenderer, debian linux, opensuse leap +1 more +3 moreAn out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in...7.1 High
- virglrenderer project virglrenderer, debian linux, opensuse leap +1 more +3 moreA heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer...7.8 High
- virglrenderer project virglrenderer, debian linux, opensuse leap +2 moreA NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS...5.5 Medium
- debian linux, linux kernel, canonical ubuntu linux +11 more +13 morekernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with...5.5 Medium
- sa-exim project sa-exim, canonical ubuntu linux, debian linux +2 moresa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule....8.8 High
x2goclientDebianx2goclient - regression updateNo score- agendaless waitress, debian linux, oracle communications cloud native core network function cloud native environment +2 moreHTTP Request Smuggling: Content-Length Sent Twice in Waitress7.1 High
- agendaless waitress, debian linux, fedoraproject fedora +2 more +4 moreHTTP Request Smuggling: LF vs CRLF handling in Waitress7.1 High
- agendaless waitress, debian linux, fedoraproject fedora +2 more +4 moreHTTP Request Smuggling: Invalid Transfer-Encoding in Waitress7.1 High
- broadcom ca client automation, ca technologies, broadcom company client automation +1 moreAn insecure file access vulnerability exists in CA Client Automation 14.0, 14.1, 14.2, and 14.3...7.3 High
- gitlab, gitlab ce/ee +1 moreA denial of service exists in gitlab <v12.3.2, <v12.2.6, and <v12.1.10 that would let an attacker...6.5 Medium
- lout project lout, fedoraproject fedora, opensuse backports sle +1 more +3 moreLout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c.7.8 High
- lout project lout, fedoraproject fedora, opensuse backports sle +1 more +3 moreLout 3.40 has a heap-based buffer overflow in the srcnext() function in z02.c.7.8 High
- neuvectorNeuVector 3.1 when configured to allow authentication via Active Directory, does not enforce non...9.8 Critical
- ibm financial transaction manager, financial transaction manager for multiplatform +1 moreIBM Financial Transaction Manager 3.0 is vulnerable to cross-site scripting. This vulnerability...6.1 Medium
- ibm financial transaction manager, financial transaction manager for multiplatform +1 moreIBM Financial Transaction Manager 3.0 does not set the secure attribute on authorization tokens...4.3 Medium
- ibm financial transaction manager, financial transaction manager for multiplatform +1 moreIBM Financial Transaction Manager 3.0 could allow a remote attacker to hijack the clicking action...6.1 Medium
- ibm financial transaction manager, financial transaction manager for multiplatform +1 moreIBM Financial Transaction Manager 3.0 is vulnerable to cross-site request forgery which could...4.3 Medium
- ibm cognos analyticsIBM Cognos Analytics 11.0 and 11.0 is vulnerable to cross-site scripting. This vulnerability...5.4 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site request forgery which could allow...4.3 Medium
- ibm cognos business intelligenceIBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could...4.3 Medium
- mi dgnwg03lm firmware, mccgq01lm firmware, rtcgq01lm firmware +2 more +4 moreAn issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM 5.5.48...7.5 High
- mi dgnwg03lm firmware, mccgq01lm firmware, rtcgq01lm firmware +2 more +4 moreAn issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM 5.5.48...9.8 Critical
- asus as-101 firmware, dl-101 firmware, hg100 firmware +4 more +6 moreAn issue was discovered on ASUS HG100 1.05.12, WS-101 1.05.12, and TS-101 1.05.12 devices using...7.5 High
- asus as-101 firmware, dl-101 firmware, hg100 firmware +4 more +6 moreAn issue was discovered on ASUS HG100 1.05.12, WS-101 1.05.12, and TS-101 1.05.12 devices using...9.8 Critical
- asus as-101 firmware, dl-101 firmware, hg100 firmware +4 more +6 moreAn issue was discovered on ASUS HG100 1.05.12, WS-101 1.05.12, and TS-101 1.05.12 devices using...7.5 High
- mi dgnwg03lm firmware, mccgq01lm firmware, rtcgq01lm firmware +1 more +3 moreAn issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM 5.5.48...7.5 High
- apache log4j, bookkeeper, canonical ubuntu linux +14 more +16 moreDeserialization of Untrusted Data in Log4j9.8 Critical
- philips endura firmware, pulsera firmware, veradius unity firmware +2 moreAn issue was found in Philips Veradius Unity, Pulsera, and Endura Dual WAN Router, Veradius Unity...6.5 Medium
- palo alto networks pan-osPAN-OS on PA-7000 Series: Improper restriction of communication to Log Forwarding Card (LFC) allows root access10.0 Critical
- midori-browser midoriIn Midori Browser 0.5.11 (on Windows 10), Content Security Policy (CSP) is not applied correctly...6.1 Medium
- gnome keyring, gnome-keyring, debian linux +2 moregnome-keyring does not discard stored secrets when using gnome_keyring_lock_all_sync function7.5 High
- apple cups, debian linux +1 morecups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which...9.8 Critical
- apache openoffice, libreoffice, debian linux +1 more +3 moreLibreOffice and OpenOffice automatically open embedded content6.5 Medium
- ecryptfs ecryptfs-utils, debian linux +1 moreecryptfs-utils: suid helper does not restrict mounting filesystems with nosuid,nodev which...7.8 High
- smartbear swagger-ui, redhat jboss fuse, openshift +2 moreImproper Neutralization of Input During Web Page Generation in swagger-ui6.1 Medium
- ciprianmp phpmychat-plusphpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password...6.1 Medium
- Show moreLoading…