CVEs published in December 2019
1,536 vulnerabilities, 253 critical, 19 exploited.
- mfscripts yetishare_account_move_file_in_folder.ajax.php in MFScripts YetiShare 3.5.2 directly inserts values from...8.8 High
- mfscripts yetishare_get_all_file_server_paths.ajax.php (aka get_all_file_server_paths.ajax.php) in MFScripts...6.1 Medium
- mfscripts yetisharetranslation_manage_text.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2...7.2 High
- laborator neonAn XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data...6.1 Medium
- mfscripts yetishareMFScripts YetiShare 3.5.2 through 4.5.3 does not set the Secure flag on session cookies, allowing...7.5 High
- apache solr, oracle primavera unifier +1 moreImproper Input Validation in Apache Solr7.5 High
- saitoha libsixelAn issue was discovered in libsixel 1.8.4. There is a heap-based buffer overflow in the function...8.8 High
- php-shellcommand project php-shellcommandphp-shellcommand command injection vulnerability9.8 Critical
- d-link dir-859 router, dlink dir-818lx firmware, dir-822 firmware +12 more +14 moreThe UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows...9.8 Critical
- ibm mq, mq appliance +1 moreIBM MQ 9.1.0.0, 9.1.0.1, 9.1.0.2, 9.1.0.3, 9.1.1, 9.1.2, and 9.1.3 is vulnerable to a denial of...4.3 Medium
- ibm cognos analyticsIBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability...5.4 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 allows overly permissive cross-origin resource sharing which...6.5 Medium
- ibm watson studio localIBM Watson Studio Local 1.2.3 stores key files in the user's home directory which could be...6.2 Medium
- ibm watson studio local, watston studio local +1 moreIBM Watson Studio Local 1.2.3 could disclose sensitive information over the network that an...5.3 Medium
- nagios xiIn Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup...5.4 Medium
- clickhouseIn all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and...6.5 Medium
- clickhouseIn all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in...9.8 Critical
- http authentication library project authentication libraryThe HTTP Authentication library before 2019-12-27 for Nim has weak password hashing because the...7.5 High
- mozilla network security services, nss, netapp hci compute node +11 more +13 moreIn Network Security Services (NSS) before 3.46, several cryptographic primitives had missing...9.8 Critical
- linux kernel, netapp 8300 firmware, 8700 firmware +11 more +13 moremwifiex_tm_cmd in drivers/net/wireless/marvell/mwifiex/cfg80211.c in the Linux kernel before 5.1...5.5 Medium
- debian linux, linux kernel, canonical ubuntu linux +2 moreIn the Linux kernel before 5.1, there is a memory leak in __feat_register_sp() in net/dccp/feat.c...5.5 Medium
- gopro gpmf-parserGoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_Next in GPMF_parser.c.8.8 High
- gopro gpmf-parserGoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GPMF_seekToSamples in GPMF-parse.c...8.8 High
- gopro gpmf-parserGoPro GPMF-parser 1.2.3 has a heap-based buffer over-read in GetPayload in GPMF_mp4reader.c.7.8 High
- gopro gpmf-parserGoPro GPMF-parser 1.2.3 has an heap-based buffer over-read in GPMF_SeekToSamples in GPMF_parse.c...7.8 High
- axiosys bento4An issue was discovered in Bento4 1.5.1.0. There is a use-after-free in AP4_Sample::GetOffset in...7.8 High
- axiosys bento4An issue was discovered in Bento4 1.5.1.0. There is a NULL pointer dereference in AP4_Descriptor:...5.5 Medium
- axiosys bento4An issue was discovered in Bento4 1.5.1.0. There is a NULL pointer dereference in AP4_Descriptor:...5.5 Medium
- podofo project podofo, fedoraproject fedora +1 moreThe PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.6 allows remote...5.5 Medium
- saitoha libsixelAn issue was discovered in libsixel 1.8.4. There is a heap-based buffer overflow in the function...8.8 High
- tvt nvms-1000, nvms-1000 firmware +1 moreTVT NVMS-1000 devices allow GET /.. Directory Traversal7.5 High
- vim, canonical ubuntu linux +1 moreThe autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory.7.8 High
- netis-systems dl4343 firmwareOn Netis DL4323 devices, XSS exists via the urlFQDN parameter to form2url.cgi (aka the Keyword...6.1 Medium
- netis-systems dl4343 firmwareOn Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs.6.5 Medium
- netis-systems dl4343 firmwareOn Netis DL4323 devices, XSS exists via the form2Ddns.cgi hostname parameter (Dynamic DNS...6.1 Medium
- netis-systems dl4343 firmwareOn Netis DL4323 devices, XSS exists via the form2userconfig.cgi username parameter (User Account...6.1 Medium
- netis-systems dl4343 firmwareOn Netis DL4323 devices, any user role can view sensitive information, such as a user password or...8.8 High
- netis-systems dl4343 firmwareOn Netis DL4323 devices, pingrtt_v6.html has XSS (Ping6 Diagnostic).6.1 Medium
- netis-systems dl4343 firmwareOn Netis DL4323 devices, XSS exists via the form2Ddns.cgi username parameter (DynDns settings of...6.1 Medium
- symonics libmysofahdf/dataobject.c in libmysofa before 0.8 has an uninitialized use of memory, as demonstrated by...8.8 High
- boltcms bolt** DISPUTED ** Bolt 3.7.0, if Symfony Web Profiler is used, allows XSS because unsanitized search...6.1 Medium
- proxymancom.proxyman.NSProxy.HelperTool in Privileged Helper Tool in Proxyman for macOS 1.11.0 and...3.7 Low
- nothings stb image.hstb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an...6.5 Medium
- liquidpixels liquifire osLuquidPixels LiquiFire OS 4.8.0 allows SSRF via the call%3Durl substring followed by a URL in...6.5 Medium
- linux kernel, netapp 8300 firmware, 8700 firmware +10 more +12 moreIn the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in...5.5 Medium
- matio project matioA memory leak was discovered in Mat_VarCalloc in mat.c in matio 1.5.17 because SafeMulDims does...6.5 Medium
- upx, opensuse backports, leap +2 moreAn invalid memory address dereference was discovered in the canUnpack function in p_mach.cpp in...5.5 Medium
- upx, fedoraproject fedora +1 moreA floating-point exception was discovered in PackLinuxElf::elf_hash in p_lx_elf.cpp in UPX 3.95....5.5 Medium
- livefyre livecommentsCross-site scripting (XSS) vulnerability in Livefyre LiveComments 3.0 allows remote attackers to...6.1 Medium
- senkas kolibri project kolibriBuffer overflow in Senkas Kolibri 2.0 allows remote attackers to execute arbitrary code via a...9.8 Critical
- Show moreLoading…