CVEs published in December 2019
1,536 vulnerabilities, 253 critical, 19 exploited.
- six apart ltd movable type series, sixapart movable type +1 moreOpen redirect vulnerability in Movable Type series Movable Type 7 r.4602 (7.1.3) and earlier ...6.1 Medium
- rakuten rakuma, rakuten, inc. rakuma app +1 moreRakuma App for Android version 7.15.0 and earlier, and for iOS version 7.16.4 and earlier allows...6.5 Medium
- cybozu office, cybozu, inc. cybozu office +1 moreCybozu Office 10.0.0 to 10.8.3 allows remote authenticated attackers to bypass access restriction...4.3 Medium
- cybozu office, cybozu, inc. cybozu office +1 moreDirectory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.3 allows remote authenticated...6.5 Medium
- ricoh limedio, ricoh company, ltd. library information management system limedio +1 moreOpen redirect vulnerability in Library Information Management System LIMEDIO all versions allows...6.1 Medium
- alfasado powercmsOpen redirect vulnerability in PowerCMS 5.12 and earlier (PowerCMS 5.x), 4.42 and earlier ...6.1 Medium
- information-technology promotion agency, japan (ipa) stamp workbench installer, ipa stamp workbench +1 moreUntrusted search path vulnerability in STAMP Workbench installer all versions allows an attacker...7.8 High
- netcommonsCross-site scripting vulnerability in NetCommons 3.2.2 and earlier (NetCommons3.x) allows remote...6.1 Medium
- remise payment module, remise corporation payment module (2.11, 2.12 and 2.13) +1 moreREMISE Payment Module (2.11, 2.12 and 2.13) version 3.0.12 and earlier allow remote attackers to ...5.3 Medium
- remise payment module, remise corporation payment module (2.11, 2.12 and 2.13) +1 moreCross-site scripting vulnerability in REMISE Payment Module (2.11, 2.12 and 2.13) version 3.0.12...6.1 Medium
- d-link japan k.k. dba-1510p, dlink dba-1510p firmware +1 moreDBA-1510P firmware 1.70b009 and earlier allows an attacker to execute arbitrary OS commands via...8.8 High
- d-link japan k.k. dba-1510p, dlink dba-1510p firmware +1 moreDBA-1510P firmware 1.70b009 and earlier allows authenticated attackers to execute arbitrary OS...6.6 Medium
- tms-outsource wpdatatables liteSQL injection vulnerability in the wpDataTables Lite Version 2.0.11 and earlier allows remote...7.2 High
- tms-outsource wpdatatables liteCross-site scripting vulnerability in wpDataTables Lite Version 2.0.11 and earlier allows remote...6.1 Medium
- yokogawa exaopc, exaplog, exaquantum +6 more +8 moreAn unquoted search path vulnerability in Multiple Yokogawa products for Windows (Exaopc (R1.01.00...7.8 High
- kaspersky tigervnc, opensuse leap +1 moreTigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered...7.2 High
- kaspersky tigervncTigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in...7.2 High
- kaspersky tigervnc, opensuse leap +1 moreTigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be...7.2 High
- kaspersky tigervnc, opensuse leap +1 moreTigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to...7.2 High
- cridio listingproThe ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the...6.1 Medium
- cridio listingproThe ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night...5.4 Medium
- cridio listingproThe ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on...5.4 Medium
- bullguard premium protectionThe malware scan function in BullGuard Premium Protection 20.0.371.8 has a TOCTOU issue that...5.9 Medium
- haloHalo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because...7.2 High
- xiuno xiunobbsXiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php.7.5 High
- wp maintenance project maintenanceA flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a...8.8 High
- icegram email subscribers \& newslettersThe WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw...4.3 Medium
- icegram email subscribers \& newslettersThe WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for...5.4 Medium
- icegram email subscribers \& newslettersThe WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for...6.5 Medium
- fastvelocity minifyIn the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running...4.3 Medium
- icegram email subscribers \& newslettersThe WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users...6.3 Medium
- icegram email subscribers \& newslettersThe WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed...5.8 Medium
- libesmtp project libesmtplibESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in...9.8 Critical
- crushftpCrushFTP through 8.3.0 is vulnerable to credentials theft via URL redirection.6.1 Medium
kernelMageia,kmod-virtualboxMageia,kmod-xtables-addonsMageia +1 more +3 moreUpdated kernel packages fix security vulnerabilitiesNo score- upc connect box eurodocsis firmwareThe Administration page on Connect Box EuroDOCSIS 3.0 Voice Gateway CH7465LG-NCIP-6.12.18.25-2p6...7.5 High
- debian linux, linux kernel, canonical ubuntu linux +13 more +15 moreIn the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas...4.7 Medium
- debian linux, linux kernel, netapp active iq unified manager +10 more +12 moreIn the Linux kernel before 5.1.6, there is a use-after-free in cpia2_exit() in drivers/media/usb...4.6 Medium
- wolfsslIn wolfSSL before 4.3.0, wc_ecc_mulmod_ex does not properly resist side-channel attacks.5.3 Medium
- wolfsslwolfSSL before 4.3.0 mishandles calls to wc_SignatureGenerateHash, leading to fault injection in...7.5 High
- wolfsslAn issue was discovered in wolfSSL before 4.3.0 in a non-default configuration where DSA is...5.3 Medium
- mz-automation libiec61850In libIEC61850 1.4.0, StringUtils_createStringFromBuffer in common/string_utilities.c has an...6.5 Medium
- mz-automation libiec61850In libIEC61850 1.4.0, getNumberOfElements in mms/iso_mms/server/mms_access_result.c has an out-of...6.5 Medium
- mongo-express project mongo-expressRemote Code Execution Vulnerability in NPM mongo-express9.9 Critical
- nvidia geforce experienceNVIDIA GeForce Experience, all versions prior to 3.20.2, contains a vulnerability when GameStream...7.8 High
- sqlite, debian linux, netapp cloud backup +11 more +13 morezipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update...7.5 High
- sqlite, apache bookkeeper, netapp cloud backup +5 more +7 moreSQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window...5.3 Medium
- sqlite, debian linux, netapp cloud backup +11 more +13 moreflattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving...7.5 High
- xmlsoft libxml2, canonical ubuntu linux, debian linux +12 more +14 morexmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related...7.5 High
- reliablecontrols mach-prowebcom firmware, mach-prowebsys firmware +1 moreReliable Controls MACH-ProWebCom/Sys, all versions prior to 2.15 (Firmware versions prior to 8.26...6.1 Medium
- Show moreLoading…