Vulnerability Summary for the Week of November 25, 2019

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores.

Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

High: vulnerabilities with a CVSS base score of 7.0–10.0
Medium: vulnerabilities with a CVSS base score of 4.0–6.9
Low: vulnerabilities with a CVSS base score of 0.0–3.9

Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis.

Vulnerability Severity:

High Vulnerabilities

Medium Vulnerabilities

Low Vulnerabilities

Not Yet Assigned

The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.

High Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
chicken -- chicken	Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' function.	2019-11-22	7.5	CVE-2014-6310 MISC MISC CONFIRM MISC
google -- chrome	Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	7.5	CVE-2019-5866 MISC MISC
red_hat -- redhat-upgrade-tool	redhat-upgrade-tool: Does not check GPG signatures when upgrading versions	2019-11-22	10	CVE-2014-3585 REDHAT REDHAT

Medium Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
gael -- q-pulse	Cross-site scripting (XSS) vulnerability in ui/common/managedlistdialog.aspx in Gael Q-Pulse 0.6 and earlier.	2019-11-22	4.3	CVE-2014-1238 MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Insecure Permissions.	2019-11-26	4	CVE-2019-18447 MISC MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 2 of 4).	2019-11-26	4	CVE-2019-18458 MISC MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4 when moving an issue to a public project from a private one. It has Insecure Permissions.	2019-11-26	5	CVE-2019-18452 MISC MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition 11.6 through 12.4 in the add comments via email feature. It has Insecure Permissions.	2019-11-26	4	CVE-2019-18453 MISC MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the Project labels feature. It has Insecure Permissions.	2019-11-26	4	CVE-2019-18450 MISC MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition before 12.4. It has Incorrect Access Control.	2019-11-26	4	CVE-2019-18448 MISC MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration. It has Incorrect Access Control.	2019-11-26	5	CVE-2019-18460 MISC MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition 11.8 through 12.4 when handling Security tokens.. It has Insecure Permissions.	2019-11-26	6.5	CVE-2019-18457 MISC MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition 10.7.4 through 12.4 in the InternalRedirect filtering feature. It has an Open Redirect.	2019-11-26	5.8	CVE-2019-18451 MISC MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition 10.5 through 12.4 in link validation for RDoc wiki pages feature. It has XSS.	2019-11-26	4.3	CVE-2019-18454 MISC MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4. It has Insecure Permissions (issue 1 of 2).	2019-11-26	5.5	CVE-2019-18446 CONFIRM MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition 11 through 12.4 when building Nested GraphQL queries. It has a large or infinite loop.	2019-11-26	5	CVE-2019-18455 MISC MISC
google -- chrome	Insufficient validation of untrusted input in downloads in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass download restrictions via a crafted HTML page.	2019-11-25	4.3	CVE-2019-13710 MISC MISC
google -- chrome	Insufficient policy enforcement in the Omnibox in Google Chrome on Android prior to 78.0.3904.70 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.	2019-11-25	4.3	CVE-2019-13703 MISC MISC
google -- chrome	Insufficient policy enforcement in reader mode in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML page.	2019-11-25	6.8	CVE-2019-13692 MISC MISC
google -- chrome	Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	2019-11-25	5	CVE-2019-13711 MISC MISC
google -- chrome	Use after free in audio in Google Chrome on Android prior to 77.0.3865.120 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	6.8	CVE-2019-13695 MISC MISC
google -- chrome	Insufficient policy enforcement in navigation in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass content security policy via a crafted HTML page.	2019-11-25	4.3	CVE-2019-13704 MISC MISC
google -- chrome	Inappropriate implementation in navigation in Google Chrome on iOS prior to 78.0.3904.70 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.	2019-11-25	4.3	CVE-2019-13708 MISC MISC
google -- chrome	Insufficient validation of untrusted input in Color Enhancer extension in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to inject CSS into an HTML page via a crafted URL.	2019-11-25	4.3	CVE-2019-13714 MISC MISC
google -- chrome	Insufficient validation of untrusted input in intents in Google Chrome on Android prior to 78.0.3904.70 allowed a local attacker to leak files via a crafted application.	2019-11-25	4.3	CVE-2019-13707 MISC MISC
google -- chrome	Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.	2019-11-25	4.3	CVE-2019-13715 MISC MISC
google -- chrome	Insufficient policy enforcement in extensions in Google Chrome prior to 78.0.3904.70 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension.	2019-11-25	4.3	CVE-2019-13705 MISC MISC
google -- chrome	Out of bounds read in Skia in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.	2019-11-25	5.8	CVE-2019-5849 MISC MISC
google -- chrome	Incorrect security UI in full screen mode in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to hide security UI via a crafted HTML page.	2019-11-25	4.3	CVE-2019-13717 MISC MISC
google -- chrome	Insufficient policy enforcement in service workers in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.	2019-11-25	4.3	CVE-2019-13716 MISC MISC
google -- chrome	Use after free in Blink in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	6.8	CVE-2019-13687 MISC MISC
google -- chrome	Incorrect security UI in full screen mode in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to hide security UI via a crafted HTML page.	2019-11-25	4.3	CVE-2019-13719 MISC MISC
google -- chrome	Insufficient data validation in Omnibox in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.	2019-11-25	4.3	CVE-2019-13718 MISC MISC
google -- chrome	Use after free in Blink in Google Chrome prior to 76.0.3809.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	4.3	CVE-2019-5869 MISC MISC
google -- chrome	Inappropriate implementation in JavaScript in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	4.3	CVE-2019-5847 MISC MISC
google -- chrome	Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.	2019-11-25	4.3	CVE-2019-5852 MISC MISC
google -- chrome	Insufficient policy enforcement in JavaScript in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	2019-11-25	4.3	CVE-2019-13713 MISC MISC
google -- chrome	Use after free in PDFium in Google Chrome prior to 76.0.3809.100 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.	2019-11-25	4.3	CVE-2019-5868 MISC MISC
google -- chrome	Use after free in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.	2019-11-25	4.3	CVE-2019-5860 MISC MISC
google -- chrome	Use after free in Mojo in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	4.3	CVE-2019-5872 MISC MISC
google -- chrome	Use after free in Blink in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	6.8	CVE-2019-13688 MISC MISC
google -- chrome	Use after free in Blink in Google Chrome prior to 75.0.3770.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	4.3	CVE-2019-5842 MISC MISC
google -- chrome	Insufficient policy enforcement in downloads in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to bypass download restrictions via a crafted HTML page.	2019-11-25	4.3	CVE-2019-13709 MISC MISC
google -- chrome	Use after free in offline mode in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	6.8	CVE-2019-13686 MISC MISC
google -- chrome	Insufficient policy enforcement in performance APIs in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	2019-11-25	4.3	CVE-2019-13697 MISC MISC
google -- chrome	Use after free in media in Google Chrome on Android prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	6.8	CVE-2019-5876 MISC MISC
google -- chrome	Use after free in WebAudio in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	6.8	CVE-2019-5851 MISC MISC
google -- chrome	Use after free in PDFium in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	6.8	CVE-2019-13721 MISC MISC
google -- chrome	Use after free in media in Google Chrome prior to 78.0.3904.70 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	6.8	CVE-2019-13699 MISC MISC
google -- chrome	Out of bounds memory access in the gamepad API in Google Chrome prior to 78.0.3904.70 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	6.8	CVE-2019-13700 MISC MISC
google -- chrome	Inappropriate implementation in installer in Google Chrome on Windows prior to 78.0.3904.70 allowed a local attacker to perform privilege escalation via a crafted executable.	2019-11-25	6.8	CVE-2019-13702 MISC MISC
google -- chrome	Out of bounds memory access in PDFium in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.	2019-11-25	6.8	CVE-2019-13706 MISC MISC
google -- chrome	Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	6.8	CVE-2019-13720 MISC MISC
google -- chrome	Incorrect font handling in autofill in Google Chrome prior to 75.0.3770.142 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.	2019-11-25	4.3	CVE-2019-5848 MISC MISC
google -- chrome	Out of bounds memory access in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	6.8	CVE-2019-13724 MISC MISC
google -- chrome	Use after free in offline mode in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.	2019-11-25	6.8	CVE-2019-5850 MISC MISC
google -- chrome	Use after free in IndexedDB in Google Chrome prior to 77.0.3865.120 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.	2019-11-25	6.8	CVE-2019-13693 MISC MISC
google -- chrome	Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	6.8	CVE-2019-5853 MISC MISC
google -- chrome	Insufficient validation of untrusted input in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.	2019-11-25	4.3	CVE-2019-13691 MISC MISC
google -- chrome	Incorrect implementation in navigation in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.	2019-11-25	4.3	CVE-2019-13701 MISC MISC
google -- chrome	Integer overflow in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.	2019-11-25	6.8	CVE-2019-5854 MISC MISC
google -- chrome	Use after free in media in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.	2019-11-25	6.8	CVE-2019-5870 MISC MISC
google -- chrome	Out of bounds memory access in JavaScript in Google Chrome prior to 73.0.3683.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	6.8	CVE-2019-13698 MISC MISC
google -- chrome	Use after free in V8 in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	6.8	CVE-2019-5878 MISC MISC
google -- chrome	Use after free in JavaScript in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	6.8	CVE-2019-13696 MISC MISC
google -- chrome	Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	2019-11-25	4.3	CVE-2019-13683 MISC MISC
google -- chrome	Use after free in WebRTC in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	6.8	CVE-2019-13694 MISC MISC
google -- chrome	Use after free in sharing view in Google Chrome prior to 77.0.3865.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	6.8	CVE-2019-13685 MISC MISC
ibm -- smartcloud_analytics	IBM SmartCloud Analytics 1.3.1 through 1.3.5 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM X-Force ID: 159187.	2019-11-22	4.9	CVE-2019-4216 XF CONFIRM
ibm -- smartcloud_analytics	IBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 159185.	2019-11-22	4.3	CVE-2019-4214 XF CONFIRM
ibm -- smartcloud_analytics	IBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 159186.	2019-11-22	4.3	CVE-2019-4215 XF CONFIRM
openstack -- designate	Designate does not enforce the DNS protocol limit concerning record set sizes	2019-11-22	4	CVE-2015-5694 MISC MISC MISC MISC
ovirt -- ovirt	oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center	2019-11-22	4	CVE-2015-1780 MISC MISC
pagekit -- pagekit	A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request.	2019-11-22	6.8	CVE-2019-19013 MISC
plow -- plow	plow has local buffer overflow vulnerability	2019-11-22	4.6	CVE-2012-3407 MISC MISC MISC
postfixadmin -- postfixadmin	PostfixAdmin 2.3.4 has multiple XSS vulnerabilities	2019-11-22	4.3	CVE-2012-0812 MISC MISC MISC MISC MISC MISC MISC
zte -- zxcdn_iamweb	The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a code injection vulnerability. An attacker could exploit the vulnerability to inject malicious code into the management page, resulting in users? information leakage.	2019-11-22	6.5	CVE-2019-3427 CONFIRM

Low Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
google -- chrome	Inappropriate implementation in JavaScript in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	2019-11-25	2.6	CVE-2019-13684 MISC MISC
ibm -- smartcloud_analytics	IBM SmartCloud Analytics 1.3.1 through 1.3.5 allows unauthorized disclosure of information like accessing solrconfig.xml and could allow an attacker to perform disruptive administrator tasks. IBM X-Force ID: 159517.	2019-11-22	3.6	CVE-2019-4243 XF CONFIRM
videolan -- libbluray	libbluray MountManager class has a time-of-check time-of-use (TOCTOU) race when expanding JAR files	2019-11-22	3.3	CVE-2015-7810 MISC MISC MISC MISC MISC

Severity Not Yet Assigned

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
abb -- power_generation_information_manager_and_plant_connect	In all versions of ABB Power Generation Information Manager (PGIM) and Plant Connect, the affected product is vulnerable to authentication bypass, which may allow an attacker to remotely bypass authentication and extract credentials from the affected device.	2019-11-26	not yet calculated	CVE-2019-18250 MISC
abb -- relion_670_series_intelligent_electronic_devices	An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series (versions 1p1r26, 1.2.3.17, 2.0.0.10, RES670 2.0.0.4, 2.1.0.1, and prior) outside the intended directory.	2019-11-27	not yet calculated	CVE-2019-18253 MISC
abb -- relion_670_series_intelligent_electronic_devices	An attacker may use a specially crafted message to force Relion 650 series (versions 1.3.0.5 and prior) or Relion 670 series (versions 1.2.3.18, 2.0.0.11, 2.1.0.1 and prior) to reboot, which could cause a denial of service.	2019-11-27	not yet calculated	CVE-2019-18247 MISC
accountservice -- accountservice	An issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in user.c which could let a local users obtain encrypted passwords.	2019-11-27	not yet calculated	CVE-2012-6655 MISC MISC MISC MISC MISC MISC
ace -- ace	generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges.	2019-11-22	not yet calculated	CVE-2014-6311 MISC MISC MISC MISC
afterlogic -- webmail_pro_and_aurora	Afterlogic WebMail Pro 8.3.11, and WebMail in Afterlogic Aurora 8.3.11, allows Remote Stored XSS via an attachment name.	2019-11-26	not yet calculated	CVE-2019-19129 MISC MISC
apache -- ofbiz	The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.	2019-11-26	not yet calculated	CVE-2011-3600 CONFIRM MISC MISC MISC MISC
apache -- openoffice	OpenOffice.org v3.3 allows execution of arbitrary code with the privileges of the user running the OpenOffice.org suite tools.	2019-11-27	not yet calculated	CVE-2011-2177 MISC MISC MISC MLIST
apple -- iphone_3gs	Apple iPhone 3GS bootrom malloc implementation returns a non-NULL pointer when unable to allocate memory, aka 'alloc8'. An attacker with physical access to the device can install arbitrary firmware.	2019-11-22	not yet calculated	CVE-2019-9536 MISC MISC
apt -- apt	It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.	2019-11-26	not yet calculated	CVE-2011-3374 MISC MISC MISC MISC MISC
artifex -- ghostscript	A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.	2019-11-27	not yet calculated	CVE-2019-14812 CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM
artifex -- ghostscript	It was found that the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.	2019-11-27	not yet calculated	CVE-2019-10216 CONFIRM
best_practical_solutions -- jifty::dbi	SQL injection vulnerability in Jifty::DBI before 0.68.	2019-11-26	not yet calculated	CVE-2011-1933 MLIST MISC MISC CONFIRM MLIST MISC
centreon -- centreon	Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields.	2019-11-26	not yet calculated	CVE-2019-16195 CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM
centreon -- centreon_web	A problem was found in Centreon Web through 19.04.3. An authenticated command injection is present in the page include/configuration/configObject/traps-mibs/formMibs.php. This page is called from the Centreon administration interface. This is the mibs management feature that contains a file filing form. At the time of submission of a file, the mnftr parameter is sent to the page and is not filtered properly. This allows one to inject Linux commands directly.	2019-11-27	not yet calculated	CVE-2019-15298 MISC MISC MISC
centreon -- centreon_web	A problem was found in Centreon Web through 19.04.3. An authenticated SQL injection is present in the page include/Administration/parameters/ldap/xml/ldap_host.php. The arId parameter is not properly filtered before being passed to the SQL query.	2019-11-27	not yet calculated	CVE-2019-15300 MISC MISC MISC MISC MISC MISC
cesanta -- mongoose	An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bounds write, by sending a crafted MQTT protocol packet.	2019-11-26	not yet calculated	CVE-2019-19307 MISC
cisco -- small_business_rv_series_routers	A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an unauthenticated, remote attacker to view information displayed in the web-based management interface. The vulnerability is due to improper authorization of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to view information displayed in the web-based management interface without authentication.	2019-11-26	not yet calculated	CVE-2019-15990 CISCO
cisco -- dna_spaces_connector	A vulnerability in the web UI of Cisco DNA Spaces: Connector could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by entering malicious SQL statements in an affected field in the web UI. A successful exploit could allow the attacker to remove the SQL database, which would require the reinstallation of the Connector VM.	2019-11-26	not yet calculated	CVE-2019-15995 CISCO
cisco -- dna_spaces_connector	A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to perform a command injection attack and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command. An attacker could exploit this vulnerability by including malicious input during the execution of the affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as root.	2019-11-26	not yet calculated	CVE-2019-15997 CISCO
cisco -- dna_spaces_connector	A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient restrictions during the execution of an affected CLI command. An attacker could exploit this vulnerability by leveraging the insufficient restrictions to modify sensitive files. A successful exploit could allow the attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root.	2019-11-26	not yet calculated	CVE-2019-15996 CISCO
cisco -- email_security_appliance	A vulnerability in the MP3 detection engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured content filters on the device. The vulnerability is due to improper validation of certain MP3 file types. An attacker could exploit this vulnerability by sending a crafted MP3 file through the targeted device. A successful exploit could allow the attacker to bypass configured content filters that would normally drop the email.	2019-11-26	not yet calculated	CVE-2019-15971 CISCO
cisco -- email_security_appliance	A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. The vulnerability is due to insufficient input validation of URLs. An attacker could exploit this vulnerability by crafting the URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for the affected device, which could allow malicious URLs to pass through the device.	2019-11-26	not yet calculated	CVE-2019-15988 CISCO
cisco -- industrial_network_director	A vulnerability in the web-based management interface of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected application. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected application. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.	2019-11-26	not yet calculated	CVE-2019-15973 CISCO
cisco -- ios_xr_software	A vulnerability in the access-control logic of the NETCONF over Secure Shell (SSH) of Cisco IOS XR Software may allow connections despite an access control list (ACL) that is configured to deny access to the NETCONF over SSH of an affected device. The vulnerability is due to a missing check in the NETCONF over SSH access control list (ACL). An attacker could exploit this vulnerability by connecting to an affected device using NETCONF over SSH. A successful exploit could allow the attacker to connect to the device on the NETCONF port. Valid credentials are required to access the device. This vulnerability does not affect connections to the default SSH process on the device.	2019-11-26	not yet calculated	CVE-2019-15998 CISCO
cisco -- multiple_products	A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE), Cisco TelePresence Codec (TC), and Cisco RoomOS Software could allow an authenticated, remote attacker to escalate privileges to an unrestricted user of the restricted shell. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including specific arguments when opening an SSH connection to an affected device. A successful exploit could allow the attacker to gain unrestricted user access to the restricted shell of an affected device.	2019-11-26	not yet calculated	CVE-2019-15288 CISCO
cisco -- multiple_products	A vulnerability in web interface of the Cisco Webex Event Center, Cisco Webex Meeting Center, Cisco Webex Support Center, and Cisco Webex Training Center could allow an unauthenticated, remote attacker to guess account usernames. The vulnerability is due to missing CAPTCHA protection in certain URLs. An attacker could exploit this vulnerability by sending a crafted request to the web interface. A successful exploit could allow the attacker to know if a given username is valid and find the real name of the user.	2019-11-26	not yet calculated	CVE-2019-15987 CISCO
cisco -- prime_infrastructure_and_evolved_programmable_network_manager	A vulnerability in the REST API of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM) could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the underlying operating system. The vulnerability is due to insufficient input validation during the initial High Availability (HA) configuration and registration process of an affected device. An attacker could exploit this vulnerability by uploading a malicious file during the HA registration period. A successful exploit could allow the attacker to execute arbitrary code with root-level privileges on the underlying operating system. Note: This vulnerability can only be exploited during the HA registration period. See the Details section for more information.	2019-11-26	not yet calculated	CVE-2019-15958 CISCO
cisco -- sd-wan_solution	A vulnerability in the vManage web-based UI (web UI) of the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected instance of vManage. An attacker could exploit this vulnerability by persuading a user to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.	2019-11-26	not yet calculated	CVE-2019-16002 CISCO
cisco -- small_business_rv_series_routers	A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.	2019-11-26	not yet calculated	CVE-2019-15271 CISCO
cisco -- stealthwatch_enterprise	A vulnerability in the web-based management interface of Cisco Stealthwatch Enterprise could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.	2019-11-26	not yet calculated	CVE-2019-15994 CISCO
cisco -- telepresence_collaboration_endpoint_and_roomos_software	A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an authenticated, local attacker to enable audio recording without notifying users. The vulnerability is due to the presence of unnecessary debug commands. An attacker could exploit this vulnerability by gaining unrestricted access to the restricted shell and using the specific debug commands. A successful exploit could allow the attacker to enable the microphone of an affected device to record audio without notifying users.	2019-11-26	not yet calculated	CVE-2019-15967 CISCO
cisco -- unified_communications_domain_manager	A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager (Unified CDM) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.	2019-11-26	not yet calculated	CVE-2019-15968 CISCO
cisco -- unified_communications_manager	A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to modify values on or return values from the underlying database.	2019-11-26	not yet calculated	CVE-2019-15972 CISCO
cisco -- unity_express	A vulnerability in the CLI of Cisco Unity Express could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. To exploit this vulnerability, an attacker would need valid administrator credentials. The vulnerability is due to improper input validation for certain CLI commands that are executed on a vulnerable system. An attacker could exploit this vulnerability by logging in to the system and sending crafted CLI commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root.	2019-11-26	not yet calculated	CVE-2019-15986 CISCO
cisco -- web_security_appliance	A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform an unauthorized system reset on an affected device. The vulnerability is due to improper authorization controls for a specific URL in the web management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could have a twofold impact: the attacker could either change the administrator password, gaining privileged access, or reset the network configuration details, causing a denial of service (DoS) condition. In both scenarios, manual intervention is required to restore normal operations.	2019-11-26	not yet calculated	CVE-2019-15956 CISCO
cisco -- webex_meetings	A vulnerability in the Webex Network Recording Admin page of Cisco Webex Meetings could allow an authenticated, remote attacker to elevate privileges in the context of the affected page. To exploit this vulnerability, the attacker must be logged in as a low-level administrator. The vulnerability is due to insufficient access control validation. An attacker could exploit this vulnerability by submitting a crafted URL request to gain privileged access in the context of the affected page. A successful exploit could allow the attacker to elevate privileges in the Webex Recording Admin page, which could allow them to view or delete recordings that they would not normally be able to access.	2019-11-26	not yet calculated	CVE-2019-15960 CISCO
cisco -- webex_network_recording_player_and_webex_player_for_microsoft_windows	Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.	2019-11-26	not yet calculated	CVE-2019-15284 CISCO
cisco -- webex_recording_player_and_webex_player_for_microsoft_windows	Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.	2019-11-26	not yet calculated	CVE-2019-15286 CISCO
cisco -- webex_teams	A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Webex Teams for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of the resources loaded by the application at run time. An attacker could exploit this vulnerability by crafting a malicious DLL file and placing it in a specific location on the targeted system. The malicious DLL file would execute when the vulnerable application is launched. A successful exploit could allow the attacker to execute arbitrary code on the target machine with the privileges of another user account.	2019-11-26	not yet calculated	CVE-2019-16001 CISCO
cisco -- wireless_lan_controller_software	A vulnerability in the web interface of Cisco Wireless LAN Controller Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability exists due to a failure of the HTTP parsing engine to handle specially crafted URLs. An attacker could exploit this vulnerability by authenticating with low privileges to an affected controller and submitting the crafted URL to the web interface of the affected device. Conversely, an unauthenticated attacker could exploit this vulnerability by persuading a user of the web interface to click the crafted URL. A successful exploit could allow the attacker to cause an unexpected restart of the device, resulting in a DoS condition.	2019-11-26	not yet calculated	CVE-2019-15276 CISCO
claws_mail -- claws_mail	Claws Mail vCalendar plugin: credentials exposed on interface	2019-11-25	not yet calculated	CVE-2012-5527 MISC MISC MISC MISC MISC
cloud-init -- cloud-init	An privilege elevation vulnerability exists in Cloud-init before 0.7.0 when requests to an untrusted system are submitted for EC2 instance data.	2019-11-25	not yet calculated	CVE-2012-6639 MISC MISC MISC MISC MISC MISC
cloud_foundry -- uaa	Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.	2019-11-26	not yet calculated	CVE-2019-11290 CONFIRM
cloudera -- cloudera_data_science_workbench	An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. Authenticated users can bypass project permission checks and gain read-write access to any project folder.	2019-11-26	not yet calculated	CVE-2018-20090 CONFIRM
cloudera -- cloudera_hue	In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used.	2019-11-26	not yet calculated	CVE-2015-7831 MISC
cloudera -- cloudera_manager	Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other users and elevate the privileges of those users.	2019-11-26	not yet calculated	CVE-2017-7399 CONFIRM
cloudera -- cloudera_manager	Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecified vectors.	2019-11-26	not yet calculated	CVE-2015-4457 MISC
cloudera -- cloudera_manager	There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles.	2019-11-26	not yet calculated	CVE-2015-6495 MISC
cloudera -- cloudera_manager	Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files.	2019-11-26	not yet calculated	CVE-2016-3192 MISC
cloudera -- cloudera_manager	An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1. Malicious impala queries can result in Cross Site Scripting (XSS) when viewed within this product.	2019-11-26	not yet calculated	CVE-2019-14449 CONFIRM
cloudera -- cloudera_manager	Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature.	2019-11-26	not yet calculated	CVE-2016-9271 CONFIRM
cloudera -- coudera_hue	An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0. When using one of following authentication backends: LdapBackend, PamBackend, SpnegoDjangoBackend, RemoteUserDjangoBackend, SAML2Backend, OpenIDBackend, or OAuthBackend, external users are created with superuser privileges.	2019-11-26	not yet calculated	CVE-2019-7319 CONFIRM CONFIRM
cloudera -- cloudera_distribution_hadoop	Cloudera CDH has Insecure Permissions because ALL cannot be revoked.This affects 5.x through 5.15.1 and 6.x through 6.0.1.	2019-11-26	not yet calculated	CVE-2018-17860 CONFIRM CONFIRM
cloudera -- cloudera_distribution_hadoop	Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass Sentry document-level security via the RealTimeGetHandler.	2019-11-26	not yet calculated	CVE-2016-6353 MISC
cloudera -- cloudera_distribution_hadoop	Cloudera CDH before 5.6.1 allows authorization bypass via direct internal API calls.	2019-11-26	not yet calculated	CVE-2016-3131 MISC
cloudera -- cloudera_distribution_hadoop	Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles.	2019-11-26	not yet calculated	CVE-2016-5724 MISC
cloudera -- cloudera_distribution_hadoop	In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges.	2019-11-26	not yet calculated	CVE-2016-4572 MISC
cmsms -- cmsms	The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles.	2019-11-26	not yet calculated	CVE-2011-4310 CONFIRM
creston -- dmc-stro_devices	Crestron DMC-STRO 1.0 devices allow remote command execution as root via shell metacharacters to the ping function.	2019-11-27	not yet calculated	CVE-2019-18184 MISC MISC MISC
cri-o -- cri-o	A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can result in container management (conmon) processes being killed if a workload process triggers an out-of-memory (OOM) condition for the cgroup. An attacker could abuse this flaw to get host network access on an cri-o host.	2019-11-25	not yet calculated	CVE-2019-14891 CONFIRM
csrf_magic -- csrf_magic	The csrf_callback function in the CSRF Magic library through 2016-03-27 is vulnerable to CSRF protection bypass as it allows one to tamper with the csrf token values. A remote attacker can exploit this by crafting a malicious page and dispersing it to a victim via social engineering, enticing them to click the link. Once the user/victim clicks the "try again" button, the attacker can take over the account and perform unintended actions on the victim's behalf.	2019-11-26	not yet calculated	CVE-2019-17590 MISC
d-link -- dsl-6740u_gateway	Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DSL-6740U gateway (Rev. H1) allow remote attackers to hijack the authentication of administrators for requests that change administrator credentials or enable remote management services to (1) Custom Services in Port Forwarding, (2) Port Triggering Entries, (3) URL Filters in Parental Control, (4) Print Server settings, (5) QoS Queue Setup, or (6) QoS Classification Entries.	2019-11-22	not yet calculated	CVE-2013-6811 MISC MISC
d4_software -- querytree	Controllers/InvitationsController.cs in QueryTree before 3.0.99-beta mishandles invitations.	2019-11-25	not yet calculated	CVE-2019-19249 MISC MISC
dell_emc -- storage_monitoring_reporting	Dell EMC Storage Monitoring and Reporting version 4.3.1 contains a Java RMI Deserialization of Untrusted Data vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by sending a crafted RMI request to execute arbitrary code on the target host.	2019-11-26	not yet calculated	CVE-2019-18580 MISC
dhclient -- dhclient	An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable.	2019-11-27	not yet calculated	CVE-2012-2248 MISC MISC MISC MISC MISC MISC MISC MISC MISC MISC MISC MISC MISC
dhcpv6 -- dscpv6	The DHCPv6 client (dhcp6c) as used in the dhcpv6 project through 2011-07-25 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message.	2019-11-27	not yet calculated	CVE-2011-2717 MISC MISC MISC MLIST
dirmngr -- dirmngr	dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to cause a denial of service (DOS) via a specially-crafted certificate.	2019-11-27	not yet calculated	CVE-2011-2207 MISC MISC MISC MISC MLIST
dolibarr_foundation -- dolibarr_crm_and_erp	Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture.	2019-11-26	not yet calculated	CVE-2019-19206 MISC MISC
drupal -- drupal	A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal.	2019-11-22	not yet calculated	CVE-2012-2079 MISC MISC
drupal -- drupal	Drupal Views Builk Operations (VBO) module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabled and the "Modify node taxonomy terms" action is used. A remote attacker could provide a specially-crafted URL that could lead to cross-site scripting (XSS) attack.	2019-11-25	not yet calculated	CVE-2011-3373 MISC MISC MISC MISC
eclipse -- jetty	In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.	2019-11-25	not yet calculated	CVE-2019-17632 CONFIRM
embedthis -- goahead	Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect uses a static host buffer that has a limited length and can overflow. This can cause a copy of the Host header to fail, leaving that buffer uninitialized, which may leak uninitialized data in a response.	2019-11-22	not yet calculated	CVE-2019-19240 MISC MISC MISC
eracent -- multiple_linux_agents	An issue was discovered in Eracent EDA, EPA, EPM, EUA, FLW, and SUM Agent through 10.2.26. The agent executable, when installed for non-root operations (scanning), can be forced to copy files from the filesystem to other locations via Symbolic Link Following.	2019-11-22	not yet calculated	CVE-2019-17445 CONFIRM
eracent -- epa_agent	An issue was discovered in Eracent EPA Agent through 10.2.26. The agent executable, when installed for non-root operations (scanning), can be used to start external programs with elevated permissions because of an Untrusted Search Path.	2019-11-22	not yet calculated	CVE-2019-17446 CONFIRM
evolution-data-server3 -- evolution-data-server3	evolution-data-server3 3.0.3 through 3.2.1 used insecure (non-SSL) connection when attempting to store sent email messages into the Sent folder, when the Sent folder was located on the remote server. An attacker could use this flaw to obtain login credentials of the victim.	2019-11-25	not yet calculated	CVE-2011-3355 MISC MISC MISC MISC MISC
exis -- contexis	Cross-site scripting (XSS) vulnerability in the photo gallery model in Exis Contexis before 2.0 allows remote attackers to inject arbitrary web script or HTML via the image parameter in a detail action.	2019-11-22	not yet calculated	CVE-2013-6239 MISC MISC MISC
f5 -- big-ip	On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, and 13.1.0-13.1.1.4, the TMM process may produce a core file when an upstream server or cache sends the BIG-IP an invalid age header value.	2019-11-27	not yet calculated	CVE-2019-6666 CONFIRM
f5 -- big-ip	On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, under certain conditions tmm may leak memory when processing packet fragments, leading to resource starvation.	2019-11-27	not yet calculated	CVE-2019-6671 CONFIRM
f5 -- big-ip	On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.5.1-11.6.5, under certain conditions, TMM may consume excessive resources when processing traffic for a Virtual Server with the FIX (Financial Information eXchange) profile applied.	2019-11-27	not yet calculated	CVE-2019-6667 CONFIRM
f5 -- big-ip	On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, undisclosed traffic flow may cause TMM to restart under some circumstances.	2019-11-27	not yet calculated	CVE-2019-6669 CONFIRM
f5 -- big-ip	On versions 15.0.0-15.0.1 and 14.0.0-14.1.2, when the BIG-IP is configured in HTTP/2 Full Proxy mode, specifically crafted requests may cause a disruption of service provided by the Traffic Management Microkernel (TMM).	2019-11-27	not yet calculated	CVE-2019-6673 CONFIRM
f5 -- big-ip	On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5, vCMP hypervisors are incorrectly exposing the plaintext unit key for their vCMP guests on the filesystem.	2019-11-27	not yet calculated	CVE-2019-6670 CONFIRM
f5 -- big-ip_afm	On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, and 13.1.0-13.1.3.1, when bad-actor detection is configured on a wildcard virtual server on platforms with hardware-based sPVA, the performance of the BIG-IP AFM system is degraded.	2019-11-27	not yet calculated	CVE-2019-6672 CONFIRM
f5 -- big-ip_apm	The BIG-IP APM Edge Client for macOS bundled with BIG-IP APM 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.5, and 11.5.1-11.6.5 may allow unprivileged users to access files owned by root.	2019-11-27	not yet calculated	CVE-2019-6668 CONFIRM
f5 -- hotfix-bigip	BIG-IP configurations using Active Directory, LDAP, or Client Certificate LDAP for management authentication with multiple servers are exposed to a vulnerability which allows an authentication bypass. This can result in a complete compromise of the system. This issue only impacts specific engineering hotfixes using the aforementioned authentication configuration. NOTE: This vulnerability does not affect any of the BIG-IP major, minor or maintenance releases you obtained from downloads.f5.com. The affected Engineering Hotfix builds are as follows: Hotfix-BIGIP-14.1.0.3.0.79.6-ENG.iso, Hotfix-BIGIP-14.1.0.3.0.97.6-ENG.iso, Hotfix-BIGIP-14.1.0.3.0.99.6-ENG.iso, Hotfix-BIGIP-14.1.0.5.0.15.5-ENG.iso, Hotfix-BIGIP-14.1.0.5.0.36.5-ENG.iso, Hotfix-BIGIP-14.1.0.5.0.40.5-ENG.iso, Hotfix-BIGIP-14.1.0.6.0.11.9-ENG.iso, Hotfix-BIGIP-14.1.0.6.0.14.9-ENG.iso, Hotfix-BIGIP-14.1.0.6.0.68.9-ENG.iso, Hotfix-BIGIP-14.1.0.6.0.70.9-ENG.iso, Hotfix-BIGIP-14.1.2.0.11.37-ENG.iso, Hotfix-BIGIP-14.1.2.0.18.37-ENG.iso, Hotfix-BIGIP-14.1.2.0.32.37-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.46.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.14.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.16.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.34.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.97.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.99.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.105.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.111.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.115.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.122.4-ENG.iso, Hotfix-BIGIP-15.0.1.0.33.11-ENG.iso, Hotfix-BIGIP-15.0.1.0.48.11-ENG.iso	2019-11-26	not yet calculated	CVE-2019-6675 CONFIRM CONFIRM
f5 -- multiple_products	On BIG-IP ASM 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, BIG-IQ 6.0.0 and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, an attacker with access to the device communication between the BIG-IP ASM Central Policy Builder and the BIG-IQ/Enterprise Manager/F5 iWorkflow will be able to set up the proxy the same way and intercept the traffic.	2019-11-27	not yet calculated	CVE-2019-6665 CONFIRM
f5 -- ssl_orchestrator	On F5 SSL Orchestrator 15.0.0-15.0.1 and 14.0.0-14.1.2, TMM may crash when processing SSLO data in a service-chaining configuration.	2019-11-27	not yet calculated	CVE-2019-6674 CONFIRM
fastweb -- askey_rtv1907vw_devices	An issue was discovered on Fastweb Askey RTV1907VW 0.00.81_FW_200_Askey 2018-10-02 18:08:18 devices. By using the usb_remove service through an HTTP request, it is possible to inject and execute a command between two & characters in the mount parameter.	2019-11-26	not yet calculated	CVE-2019-12489 MISC EXPLOIT-DB
flashcanvas -- flashcanvas	Open redirect in proxy.php in FlashCanvas before 1.6 allows remote attackers to redirect users to arbitrary web sites and conduct cross-site scripting (XSS) attacks via the HTTP Referer header.	2019-11-22	not yet calculated	CVE-2013-6880 MISC MISC MISC MISC
fortinet -- fortios	An Improper Input Validation vulnerability in the SSL VPN portal of FortiOS versions 6.2.1 and below, and 6.0.6 and below may allow an unauthenticated remote attacker to crash the SSL VPN service by sending a crafted POST request.	2019-11-27	not yet calculated	CVE-2019-15705 CONFIRM
frams'_fast_file_exchange -- frams'_fast_file_exchange	The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before fex-2014053 allows remote attackers to conduct cross-site scripting (XSS) attacks	2019-11-27	not yet calculated	CVE-2014-3875 MISC MISC MISC MISC MISC
freebsd -- freebsd	Information Disclosure vulnerability in the 802.11 stack, as used in FreeBSD before 8.2 and NetBSD when using certain non-x86 architectures. A signedness error in the IEEE80211_IOC_CHANINFO ioctl allows a local unprivileged user to cause the kernel to copy large amounts of kernel memory back to the user, disclosing potentially sensitive information.	2019-11-27	not yet calculated	CVE-2011-2480 MISC MISC MISC MISC MLIST
freeipa -- freeipa	ipa 3.0 does not properly check server identity before sending credential containing cookies	2019-11-25	not yet calculated	CVE-2012-5631 MISC MISC MISC MISC
freeipa -- freeipa	A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed.	2019-11-27	not yet calculated	CVE-2019-10195 CONFIRM MISC MISC MISC
freeipa -- freeipa	A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server.	2019-11-27	not yet calculated	CVE-2019-14867 CONFIRM MISC MISC MISC
fusionpbx -- fusionpbx	A cross-site scripting (XSS) vulnerability in app/fax/fax_files.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.	2019-11-27	not yet calculated	CVE-2019-19367 MISC MISC
fusionpbx -- fusionpbx	A cross-site scripting (XSS) vulnerability in app/xml_cdr/xml_cdr_search.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.	2019-11-27	not yet calculated	CVE-2019-19366 MISC MISC
gitlab -- gitlab	GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Comments.	2019-11-22	not yet calculated	CVE-2019-15593 MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition through 12.4. It has Insecure Permissions (issue 4 of 4).	2019-11-26	not yet calculated	CVE-2019-18463 MISC MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition 11.3 to 12.3 in the protected environments feature. It has Insecure Permissions (issue 3 of 4).	2019-11-26	not yet calculated	CVE-2019-18459 MISC MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.3 when a sub group epic is added to a public group. It has Incorrect Access Control.	2019-11-26	not yet calculated	CVE-2019-18461 MISC MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4. It has Insecure Permissions.	2019-11-26	not yet calculated	CVE-2019-18462 MISC MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition before 12.4 in the autocomplete feature. It has Insecure Permissions (issue 2 of 2).	2019-11-26	not yet calculated	CVE-2019-18449 MISC MISC
gitlab -- gitlab_community_and_enterprise_edition	An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integration.. It has Insecure Permissions (issue 1 of 4).	2019-11-26	not yet calculated	CVE-2019-18456 MISC MISC
gksu-polkit -- gksu-polkit	gksu-polkit: permissive PolicyKit policy configuration file allows privilege escalation	2019-11-25	not yet calculated	CVE-2012-5617 MISC MISC MISC MISC MISC MISC MISC
gnome -- gnome-font-viewer	In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing a TTF font file that lacks a name section (due to a g_strconcat call that returns NULL).	2019-11-27	not yet calculated	CVE-2019-19308 MISC CONFIRM
gnome -- gnome-system-log	gnome-system-log polkit policy allows arbitrary files on the system to be read	2019-11-25	not yet calculated	CVE-2012-5535 MISC MISC MISC MISC MISC
gnu -- patch	A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196.	2019-11-25	not yet calculated	CVE-2015-1396 MISC MISC MISC MISC
google -- chrome	Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13667 MISC MISC
google -- chrome	IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.	2019-11-25	not yet calculated	CVE-2019-13659 MISC MISC
google -- chrome	Insufficient policy enforcement in navigations in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13662 MISC MISC
google -- chrome	Incorrect data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13678 MISC MISC
google -- chrome	Use after free in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13723 MISC MISC
google -- chrome	UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13660 MISC MISC
google -- chrome	Insufficient policy enforcement in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13676 MISC MISC
google -- chrome	Insufficient policy enforcement in PDFium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to show print dialogs via a crafted PDF file.	2019-11-25	not yet calculated	CVE-2019-13679 MISC MISC
google -- chrome	Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13664 MISC MISC
google -- chrome	Incorrect data validation in navigation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13669 MISC MISC
google -- chrome	UI spoofing in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof security UI via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13671 MISC MISC
google -- chrome	Insufficient filtering in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass multiple file download protection via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13665 MISC MISC
google -- chrome	Insufficient policy enforcement in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13668 MISC MISC
google -- chrome	IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.	2019-11-25	not yet calculated	CVE-2019-13663 MISC MISC
google -- chrome	Insufficient data validation in developer tools in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13673 MISC MISC
google -- chrome	Inappropriate implementation in TLS in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof client IP address to websites via crafted TLS connections.	2019-11-25	not yet calculated	CVE-2019-13680 MISC MISC
google -- chrome	IDN spoofing in Omnibox in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.	2019-11-25	not yet calculated	CVE-2019-13674 MISC MISC
google -- chrome	UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13661 MISC MISC
google -- chrome	Insufficient policy enforcement in site isolation in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass site isolation via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13677 MISC MISC
google -- chrome	Insufficient policy enforcement in external protocol handling in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass same origin policy via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13682 MISC MISC
google -- chrome	Information leak in storage in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13666 MISC MISC
google -- chrome	Insufficient data validation in extensions in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to disable extensions via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13675 MISC MISC
google -- chrome	Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to bypass download restrictions via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13681 MISC MISC
google -- chrome	Insufficient data validation in JavaScript in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-13670 MISC MISC
google -- chrome	Insufficient policy enforcement in extensions in Google Chrome prior to 77.0.3865.75 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension.	2019-11-25	not yet calculated	CVE-2019-5879 MISC MISC
google -- chrome	Insufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-5880 MISC MISC
google -- chrome	Incorrect security UI in MacOS services integration in Google Chrome on OS X prior to 76.0.3809.87 allowed a local attacker to execute arbitrary code via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-5858 MISC MISC
google -- chrome	Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-5825 MISC MISC
google -- chrome	Insufficient data validation in AppCache in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-5862 MISC MISC
google -- chrome	Insufficient data validation in CORS in Google Chrome prior to 76.0.3809.87 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.	2019-11-25	not yet calculated	CVE-2019-5864 MISC MISC
google -- chrome	Integer overflow in PDFium in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.	2019-11-25	not yet calculated	CVE-2019-5855 MISC MISC
google -- chrome	Insufficient data validation in Blink in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to bypass anti-clickjacking policy via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-5861 MISC MISC
google -- chrome	Use after free in IndexedDB in Google Chrome prior to 73.0.3683.86 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-5826 MISC MISC
google -- chrome	Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-5857 MISC MISC
google -- chrome	Insufficient policy enforcement in navigations in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-5865 MISC MISC
google -- chrome	Insufficient data validation in downloads in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-5875 MISC MISC
google -- chrome	Insufficient policy enforcement in storage in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-5856 MISC MISC
google -- chrome	Out of bounds read in SwiftShader in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-5881 MISC MISC
google -- chrome	Out of bounds memory access in JavaScript in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-5877 MISC MISC
google -- chrome	Heap buffer overflow in Skia in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-5871 MISC MISC
google -- chrome	Insufficient policy validation in navigation in Google Chrome on iOS prior to 77.0.3865.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-5873 MISC MISC
google -- chrome	Insufficient filtering in URI schemes in Google Chrome on Windows prior to 77.0.3865.75 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-5874 MISC MISC
google -- chrome	Kaspersky Protection extension for web browser Google Chrome prior to 30.112.62.0 was vulnerable to unauthorized access to its features remotely that could lead to removing other installed extensions.	2019-11-25	not yet calculated	CVE-2019-15684 CONFIRM
google -- chrome	Out of bounds read in JavaScript in Google Chrome prior to 76.0.3809.100 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-5867 MISC MISC
google -- chrome	Insufficient filtering in URI schemes in Google Chrome on Windows prior to 76.0.3809.87 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.	2019-11-25	not yet calculated	CVE-2019-5859 MISC MISC
haproxy -- haproxy	The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.	2019-11-27	not yet calculated	CVE-2019-19330 MISC MISC MISC MISC
hardlink -- hardlink	Hardlink before 0.1.2 operates on full file system objects path names which can allow a local attacker to use this flaw to conduct symlink attacks.	2019-11-26	not yet calculated	CVE-2011-3632 MISC MISC MISC MISC MISC MISC
hardlink -- hardlink	Hardlink before 0.1.2 suffer from multiple stack-based buffer overflow flaws because of the way directory trees with deeply nested directories are processed. A remote attacker could provide a specially-crafted directory tree, and trick the local user into consolidating it, leading to hardlink executable crash, or, potentially arbitrary code execution with the privileges of the user running the hardlink executable.	2019-11-26	not yet calculated	CVE-2011-3630 MISC MISC MISC MISC MISC
hardlink -- hardlink	Hardlink before 0.1.2 has multiple integer overflows leading to heap-based buffer overflows because of the way string lengths concatenation is done in the calculation of the required memory space to be used. A remote attacker could provide a specially-crafted directory tree and trick the local user into consolidating it, leading to hardlink executable crash or potentially arbitrary code execution with user privileges.	2019-11-26	not yet calculated	CVE-2011-3631 MISC MISC MISC MISC
hp -- thinpro	An attacker may be able to bypass the OS application filter meant to restrict applications that can be executed by changing browser preferences to launch a separate process that in turn can execute arbitrary commands.	2019-11-22	not yet calculated	CVE-2019-16286 CONFIRM
hp -- thinpro	The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with local user privileges.	2019-11-22	not yet calculated	CVE-2019-18910 CONFIRM
hp -- thinpro	An attacker may be able to leverage the application filter bypass vulnerability to gain privileged access to create a file on the local file system whose presence puts the device in Administrative Mode, which will allow the attacker to executed commands with elevated privileges.	2019-11-22	not yet calculated	CVE-2019-16287 CONFIRM
hp -- thinpro	If a local user has been configured and logged in, an unauthenticated attacker with physical access may be able to extract sensitive information onto a local drive.	2019-11-22	not yet calculated	CVE-2019-16285 CONFIRM
hp -- thinpro	The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with root privileges.	2019-11-22	not yet calculated	CVE-2019-18909 CONFIRM
ibm -- spectrum_protect_backup-archive_client	IBM Spectrum Protect Backup-Archive Client 7.1 and 8.1 may be vulnerable to a denial of service attack due to a timing issue between client and server TCP/IP communications. IBM X-Force ID: 162477.	2019-11-25	not yet calculated	CVE-2019-4406 XF CONFIRM
ibm -- spectrum_protect_backup-archive_client_and_spectrum_protect_for_virtual_enviroments	IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments 7.1 and 8.1 creates directories/files in the CIT sub directory that are read/writable by everyone. IBM X-Force ID: 155551.	2019-11-25	not yet calculated	CVE-2018-2025 XF CONFIRM
ibm -- sterling_b2b_integrator_standard_edition	IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 162715.	2019-11-26	not yet calculated	CVE-2019-4387 XF CONFIRM
ibm -- tivoli_netcool_impact	IBM Tivoli Netcool Impact 7.1.0 through 7.1.0.16 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 166720.	2019-11-22	not yet calculated	CVE-2019-4570 XF CONFIRM
ibm -- tivoli_netcool_impact	IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.16 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 166719.	2019-11-22	not yet calculated	CVE-2019-4569 XF CONFIRM
ibus -- ibus	A flaw was discovered in ibus that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical interface, change the input method engine, or modify other input related configurations of the victim user.	2019-11-25	not yet calculated	CVE-2019-14822 CONFIRM
infinispan -- infinispan	A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.	2019-11-25	not yet calculated	CVE-2019-10174 CONFIRM
internet_systems_consortium -- bind	With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem).	2019-11-26	not yet calculated	CVE-2019-6477 CONFIRM
iobroker.web -- iobroker.web	Characters in the GET url path are not properly escaped and can be reflected in the server response.	2019-11-25	not yet calculated	CVE-2019-10771 MISC
joomla! -- joomla!	Cross-site scripting (XSS) vulnerability in the Mijosoft MijoSearch component 2.0.4 and earlier for Joomla! allows remote attackers to inject arbitrary web script or HTML via the query parameter to component/mijosearch/search.	2019-11-22	not yet calculated	CVE-2013-6878 MISC
joomla! -- joomla!	The Mijosoft MijoSearch component 2.0.1 and earlier for Joomla! allows remote attackers to obtain sensitive information via a request to component/mijosearch/search, which reveals the installation path in an error message.	2019-11-22	not yet calculated	CVE-2013-6879 MISC
kaspersky -- multiple_products	Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component did not adequately inform the user about the threat of redirecting to an untrusted site. Bypass.	2019-11-26	not yet calculated	CVE-2019-15688 CONFIRM
kaspersky -- multiple_products	Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component allowed an attacker remotely disable such product's security features as private browsing and anti-banner. Bypass.	2019-11-26	not yet calculated	CVE-2019-15685 CONFIRM
kaspersky -- multiple_products	Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component was vulnerable to remote disclosure of various information about the user's system (like Windows version and version of the product, host unique ID). Information Disclosure.	2019-11-26	not yet calculated	CVE-2019-15687 CONFIRM
kaspersky -- multiple_products	Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component allowed an attacker remotely disable various anti-virus protection features. DoS, Bypass.	2019-11-26	not yet calculated	CVE-2019-15686 CONFIRM
katello -- katello	A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users.	2019-11-25	not yet calculated	CVE-2019-14825 CONFIRM
libnbd -- libnbd	Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks. A bounds check which was supposed to test for chunk offsets smaller than the beginning of the request did not work because of signed/unsigned confusion. If one of these chunks contains a negative offset then data under control of the server is written to memory before the read buffer supplied by the client. If the read buffer is located on the stack then this allows the stack return address from nbd_pread() to be trivially modified, allowing arbitrary code execution under the control of the server. If the buffer is located on the heap then other memory objects before the buffer can be overwritten, which again would usually lead to arbitrary code execution.	2019-11-26	not yet calculated	CVE-2019-14842 CONFIRM MISC
libuser -- libuser	libuser has information disclosure when moving user's home directory	2019-11-25	not yet calculated	CVE-2012-5644 MISC REDHAT MISC MISC
libuser -- libuser	libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees.	2019-11-25	not yet calculated	CVE-2012-5630 FEDORA REDHAT MISC MISC MISC
lilo -- lilo	lilo-uuid-diskid causes lilo.conf to be world-readable in lilo 23.1.	2019-11-26	not yet calculated	CVE-2011-1934 MISC CONFIRM MLIST MISC
linux -- linux_kernel	kernel is vulnerable to a None	2019-11-25	not yet calculated	CVE-2019-14815 CONFIRM
linux -- linux_kernel	The Linux kernel through 5.3.13 on powerpc allows Information Exposure because the Spectre-RSB mitigation is not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c.	2019-11-27	not yet calculated	CVE-2019-18660 MISC MISC
linux -- linux_kernel	In the AppleTalk subsystem in the Linux kernel before 5.1, there is a potential NULL pointer dereference because register_snap_client may return NULL. This will lead to denial of service in net/appletalk/aarp.c and net/appletalk/ddp.c, as demonstrated by unregister_snap_client, aka CID-9804501fa122.	2019-11-22	not yet calculated	CVE-2019-19227 MISC MISC
linux -- linux_kernel	A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and kernel 5.x.x. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the system to crash.	2019-11-25	not yet calculated	CVE-2019-10207 CONFIRM
linux -- linux_kernel	In the Linux kernel 5.0.21, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access because of an ext4_xattr_set_entry use-after-free in fs/ext4/xattr.c when a large old_size value is used in a memset call.	2019-11-27	not yet calculated	CVE-2019-19319 MISC
linux -- linux_kernel	The Linux kernel through 5.3.13 has a start_offset+size Integer Overflow in cpia2_remap_buffer in drivers/media/usb/cpia2/cpia2_core.c because cpia2 has its own mmap implementation. This allows local users (with /dev/video0 access) to obtain read and write permissions on kernel physical pages, which can possibly result in a privilege escalation.	2019-11-25	not yet calculated	CVE-2019-18675 MISC MISC
linux -- linux_kernel	vcs_write in drivers/tty/vt/vc_screen.c in the Linux kernel through 5.3.13 does not prevent write access to vcsu devices, aka CID-0c9acb1af77a.	2019-11-25	not yet calculated	CVE-2019-19252 MISC MISC
linux -- linux_kernel	A vulnerability was found in marvell wifi chip driver in Linux kernel. There is a heap-based buffer overflow in lbs_ibss_join_existing function in drivers/net/wireless/marvell/libertas/cfg.c allows remote attackers to cause a denial of service(system crash) or possibly execute arbitrary code. When STA connects to AP, lbs_ibss_join_existing function will be called for STA.	2019-11-27	not yet calculated	CVE-2019-14896 CONFIRM
linux -- linux_kernel	In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in kernel/locking/rwsem.c) rwsem_owner_flags returns an already freed pointer,	2019-11-28	not yet calculated	CVE-2019-19318 MISC
linux -- linux_kernel	Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.	2019-11-27	not yet calculated	CVE-2019-10220 CONFIRM
mcafee -- client_proxy	Authentication Bypass vulnerability in the Microsoft Windows client in McAfee Client Proxy (MCP) prior to 3.0.0 allows local user to bypass scanning of web traffic and gain access to blocked sites for a short period of time via generating an authorization key on the client which should only be generated by the network administrator.	2019-11-22	not yet calculated	CVE-2019-3654 MISC
mersive -- solstice	Insufficient validation of user-supplied input for the Solstice Pod networking configuration enables authenticated attackers to execute arbitrary commands as root.	2019-11-27	not yet calculated	CVE-2017-12945 MISC MISC
microsoft -- visual_studio_code	If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. This is fixed in version 1.0.1 of the extension. Users should upgrade to this version using Visual Studio Code Marketplace's upgrade mechanism. After upgrading, the codeQL.cli.executablePath setting can only be set in the per-user settings, and not in the per-workspace settings. More information about VS Code settings can be found here.	2019-11-25	not yet calculated	CVE-2019-16765 MISC MISC CONFIRM
naver -- vaccine	nsGreen.dll in Naver Vaccine 2.1.4 allows remote attackers to overwrite arbitary files via directory traversal sequences in a filename within nsz archive.	2019-11-22	not yet calculated	CVE-2019-13157 CONFIRM
nokia -- impact	Nokia IMPACT < 18A: allows full path disclosure	2019-11-25	not yet calculated	CVE-2019-17404 MISC MISC
nokia -- impact	Nokia IMPACT < 18A: An unrestricted File Upload vulnerability was found that may lead to Remote Code Execution.	2019-11-25	not yet calculated	CVE-2019-17403 MISC MISC
nokia -- impact	Nokia IMPACT < 18A has path traversal that may lead to RCE if chained with CVE-2019-1743	2019-11-25	not yet calculated	CVE-2019-17406 MISC MISC
nokia -- impact	Nokia IMPACT < 18A: has Reflected self XSS	2019-11-25	not yet calculated	CVE-2019-17405 MISC MISC
nsslglobal_technologies -- satlink_vsat_modem_unit_devices	The web interface for NSSLGlobal SatLink VSAT Modem Unit (VMU) devices before 18.1.0 doesn't properly sanitize input for error messages, leading to the ability to inject client-side code.	2019-11-22	not yet calculated	CVE-2019-15652 MISC MISC
omron -- cx-supervisor	In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. This version of Teamviewer is vulnerable to an obsolete function vulnerability requiring user interaction to exploit.	2019-11-26	not yet calculated	CVE-2019-18251 MISC
oniguruma -- oniguruma	Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c.	2019-11-25	not yet calculated	CVE-2019-19246 MISC MISC
opendnssec -- opendnssec	opendnssec misuses libcurl API	2019-11-25	not yet calculated	CVE-2012-5582 MISC MISC MISC MISC
openstack -- nova	OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a password). Exposing the EC2_ACCESS_KEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2_SECRET_KEY. An attacker could also presumably brute force values for EC2_ACCESS_KEY.	2019-11-26	not yet calculated	CVE-2011-4076 MISC MISC MISC MISC MISC
opentrade -- opentrade	OpenTrade before 2019-11-23 allows SQL injection, related to server/modules/api/v1.js and server/utils.js.	2019-11-25	not yet calculated	CVE-2019-19250 MISC
openvas -- openvas	openvas-scanner before 2011-09-11 creates a temporary file insecurely when generating OVAL system characteristics document with the ovaldi integrated tool enabled. A local attacker could use this flaw to conduct symlink attacks to overwrite arbitrary files on the system.	2019-11-25	not yet calculated	CVE-2011-3351 MISC MISC MISC MISC
otrs -- help_desk_and_itsm_and_faq	An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2.0.8. Access rights by the object linking mechanism is not verified	2019-11-27	not yet calculated	CVE-2013-2625 MISC MISC MISC MISC MISC
owncloud -- owncloud	Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) unspecified parameters to apps/calendar/ajax/event/new.php or (2) url parameter to apps/bookmarks/ajax/addBookmark.php.	2019-11-22	not yet calculated	CVE-2013-0203 MISC MISC
packagekit -- packagekit	PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of arbitrary code.	2019-11-27	not yet calculated	CVE-2011-2515 MISC MISC MISC BID
pannellum -- pannellum	In Pannellum from 2.5.0 through 2.5.4 URLs were not sanitized for data URIs (or vbscript:), allowing for potential XSS attacks. Such an attack would require a user to click on a hot spot to execute and would require an attacker-provided configuration. The most plausible potential attack would be if pannellum.htm was hosted on a domain that shared cookies with the targeted site's user authentication; an <iframe> could then be embedded on the attacker's site using pannellum.htm from the targeted site, which would allow the attacker to potentially access information from the targeted site as the authenticated user (or worse if the targeted site did not have adequate CSRF protections) if the user clicked on a hot spot in the attacker's embedded panorama viewer. This was patched in version 2.5.5.	2019-11-22	not yet calculated	CVE-2019-16763 MISC CONFIRM
pega -- pega_platform	PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/random_token/!STANDARD?pyActivity=Data-Admin-DB-Name.DBSchema_ListDatabases request while using a low-privilege account. (This can perform actions and retrieve data that only an administrator should have access to.)	2019-11-26	not yet calculated	CVE-2019-16387 MISC
pega -- pega_platform	PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyStream=MyAlerts request to get Audit Log information while using a low-privilege account.	2019-11-26	not yet calculated	CVE-2019-16388 MISC
pega -- pega_platform	PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyActivity=GetWebInfo&target=popup&pzHarnessID=random_harness_id request to get database schema information while using a low-privilege account.	2019-11-26	not yet calculated	CVE-2019-16386 MISC
philips -- intellibridge_ec40_and_ec80_devices	In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server running on the affected products is configured to allow weak ciphers. This could enable an unauthorized attacker with access to the network to capture and replay the session and gain unauthorized access to the EC40/80 hub.	2019-11-26	not yet calculated	CVE-2019-18241 MISC
phpldapadmin -- phpldapadmin	A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the "Accept-Language" HTTP header. A remote attacker could use this flaw to cause a denial of service via specially-crafted request.	2019-11-26	not yet calculated	CVE-2011-4082 MISC MISC MISC
phpldapadmin -- phpldapadmin	An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.	2019-11-22	not yet calculated	CVE-2019-18622 CONFIRM
pivotal -- rabbitmq_and_rabbitmq_for_pcf	Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.	2019-11-22	not yet calculated	CVE-2019-11291 CONFIRM
pivotal -- rabbitmq_and_rabbitmq_for_pivotal_platform	Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.	2019-11-23	not yet calculated	CVE-2019-11287 CONFIRM
polipo -- polipo	Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request.	2019-11-26	not yet calculated	CVE-2011-3596 MISC MISC MISC MISC
posh -- posh_portal	Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) error parameter to /includes/plugins/mobile/scripts/login.php or (2) id parameter to portal/openrssarticle.php	2019-11-22	not yet calculated	CVE-2014-2214 MISC MISC
posh -- posh_portal	Open redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to portal/scr_sendmd5.php.	2019-11-22	not yet calculated	CVE-2014-2213 MISC MISC MISC
pow_assent -- pow_assent	The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks. In `PowAssent.Phoenix.AuthorizationController` a value is fetched from the user provided params, and `String.to_atom/1` is used to convert the binary value to an atom so it can be used to fetch the provider configuration value. This is unsafe as it is user provided data, and can be used to fill up the whole atom table of ~1M which will cause the app to crash.	2019-11-25	not yet calculated	CVE-2019-16764 MISC MISC CONFIRM MISC
powerdns -- powerdns	PowerDNS Authoritative daemon , pdns versions 4.0.x before 4.0.9, 4.1.x before 4.1.11, exiting when encountering a serial between 2^31 and 2^32-1 while trying to notify a slave leads to DoS.	2019-11-22	not yet calculated	CVE-2019-10203 CONFIRM CONFIRM
proftpd -- proftpd	An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry (checking twice for subject, rather than once for subject and once for issuer) prevents some valid CRLs from being taken into account, and can allow clients whose certificates have been revoked to proceed with a connection to the server.	2019-11-26	not yet calculated	CVE-2019-19270 MISC
proftpd -- proftpd	An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL entries (installed by a system administrator), can cause some CRL entries to be ignored, and can allow clients whose certificates have been revoked to proceed with a connection to the server.	2019-11-26	not yet calculated	CVE-2019-19271 MISC
proftpd -- proftpd	An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. Direct dereference of a NULL pointer (a variable initialized to NULL) leads to a crash when validating the certificate of a client connecting to the server in a TLS client/server mutual-authentication setup.	2019-11-26	not yet calculated	CVE-2019-19272 MISC
progress -- sitefinity	Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled.	2019-11-26	not yet calculated	CVE-2019-17392 MISC
python-ecdsa -- python-ecdsa	An error-handling flaw was found in python-ecdsa. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.	2019-11-26	not yet calculated	CVE-2019-14853 CONFIRM MISC
python -- python	typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)	2019-11-26	not yet calculated	CVE-2019-19275 MISC MISC MISC MISC MISC
python -- python	The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests.	2019-11-27	not yet calculated	CVE-2016-1000110 MISC MISC MISC MISC
python -- python	Python keyring has insecure permissions on new databases allowing world-readable files to be created	2019-11-25	not yet calculated	CVE-2012-5578 MISC REDHAT MISC MISC MISC DEBIAN
python -- python	typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)	2019-11-26	not yet calculated	CVE-2019-19274 MISC MISC MISC MISC MISC
pyxml -- pyxml	PyXML: Hash table collisions CPU usage Denial of Service	2019-11-22	not yet calculated	CVE-2012-0877 MISC MISC MISC MISC MISC
quagga -- quagga	quagga (ospf6d) 0.99.21 has a DoS flaw in the way the ospf6d daemon performs routes removal	2019-11-25	not yet calculated	CVE-2012-5521 MISC MISC MISC MISC MISC MISC MISC
red_hat -- ansible-playbook_-k_and_ansible_cli_tools	ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.	2019-11-22	not yet calculated	CVE-2019-10206 CONFIRM
red_hat -- openshift_container_platform	OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.	2019-11-25	not yet calculated	CVE-2019-10213 CONFIRM
red_hat -- 389_directory_server	A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.	2019-11-25	not yet calculated	CVE-2019-10224 CONFIRM MISC
red_hat -- ansible	A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks.	2019-11-25	not yet calculated	CVE-2019-10217 CONFIRM CONFIRM CONFIRM
red_hat -- ansible	ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None	2019-11-26	not yet calculated	CVE-2019-14856 CONFIRM
red_hat -- ansible_tower	An attacker with low privilege could retrieve usernames and passwords credentials from the new RHSM saved in plain text into the database at '/api/v2/config' when applying the Ansible Tower license.	2019-11-26	not yet calculated	CVE-2019-14890 CONFIRM
red_hat -- cloudforms	cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field.	2019-11-22	not yet calculated	CVE-2018-10854 CONFIRM
red_hat -- enterprise_linux_and_openshift_container_platform	The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.	2019-11-25	not yet calculated	CVE-2019-10214 CONFIRM
red_hat -- jboss_application_server_7	A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example via the "Access-Control-Allow-Origin" HTTP access control flag). This can lead to unauthorized information leak if a user with admin privileges visits a specially-crafted web page provided by a remote attacker.	2019-11-26	not yet calculated	CVE-2011-3609 MISC MISC MISC MISC
red_hat -- jboss_application_server_7	A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution.	2019-11-26	not yet calculated	CVE-2011-3606 MISC MISC MISC
ros -- ros_comm_and_ ros-melodic-ros-comm	An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. A buffer overflow allows attackers to cause a denial of service and possibly execute arbitrary code via an IP address with a long hostname.	2019-11-22	not yet calculated	CVE-2019-13566 MISC MISC MISC
ruby -- ruby	Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.	2019-11-26	not yet calculated	CVE-2011-3624 MISC MISC MISC
ruby -- ruby	WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.	2019-11-26	not yet calculated	CVE-2019-16201 MISC MISC
ruby -- ruby	The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use this flaw to bypass or corrupt integrity of services, depending on strong private RSA keys generation mechanism.	2019-11-26	not yet calculated	CVE-2011-4121 MISC MISC MISC MISC
ruby -- ruby	Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.	2019-11-26	not yet calculated	CVE-2019-15845 MISC MLIST UBUNTU
ruby -- ruby	Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.	2019-11-26	not yet calculated	CVE-2019-16254 MISC MISC CONFIRM CONFIRM CONFIRM CONFIRM
ruby -- ruby	Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.	2019-11-26	not yet calculated	CVE-2019-16255 MISC MISC CONFIRM CONFIRM CONFIRM CONFIRM
sangoma -- asterisk_and_certified_asterisk	An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.	2019-11-22	not yet calculated	CVE-2019-18610 MISC MISC
sangoma -- asterisk_and_certified_asterisk	An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940.	2019-11-22	not yet calculated	CVE-2019-18976 CONFIRM MISC MISC MISC MISC
sangoma -- asterisk_and_certified_asterisk	An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x, 16.x, and 17.x, and Certified Asterisk 13.21, because of an incomplete fix for CVE-2019-18351. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport.	2019-11-22	not yet calculated	CVE-2019-18790 MISC MISC
serendipity -- serendipity	Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation.	2019-11-26	not yet calculated	CVE-2011-4090 MISC MISC MISC
siemens -- polarion	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siemens AG Polarion could allow an attacker to exploit a reflected XSS vulnerability. This issue affects: Siemens AG Polarion All versions < 19.2.	2019-11-27	not yet calculated	CVE-2019-13935 MISC
siemens -- polarion	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siemens AG Polarion could allow an attacker to exploit a persistent XSS vulnerability. This issue affects: Siemens AG Polarion All versions < 19.2.	2019-11-27	not yet calculated	CVE-2019-13936 MISC
siemens -- polarion	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webclient of Siemens AG Polarion could allow an attacker to exploit a reflected XSS vulnerability. This issue affects: Siemens AG Polarion All versions < 19.2.	2019-11-27	not yet calculated	CVE-2019-13934 MISC
spagobi -- spagobi	Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, aka "XSS File Upload."	2019-11-22	not yet calculated	CVE-2013-6234 MISC MISC MISC
sqlite -- sqlite	SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c.	2019-11-27	not yet calculated	CVE-2019-19242 MISC
sqlite -- sqlite	sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.	2019-11-25	not yet calculated	CVE-2019-19244 MISC
squid-cache -- squid	An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to.	2019-11-26	not yet calculated	CVE-2019-18677 CONFIRM CONFIRM CONFIRM CONFIRM MISC
squid-cache -- squid	An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in the heap.	2019-11-26	not yet calculated	CVE-2019-12526 CONFIRM CONFIRM
squid-cache -- squid	An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker can connect to HTTP servers that only listen on localhost.	2019-11-26	not yet calculated	CVE-2019-12523 CONFIRM CONFIRM CONFIRM
squid-cache -- squid	An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in Denial of Service to all clients using the proxy. Severity is high due to this vulnerability occurring before normal security checks; any remote client that can reach the proxy port can trivially perform the attack via a crafted URI scheme.	2019-11-26	not yet calculated	CVE-2019-18676 CONFIRM CONFIRM CONFIRM MISC
squid-cache -- squid	An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon.	2019-11-26	not yet calculated	CVE-2019-18678 CONFIRM CONFIRM CONFIRM MISC
squid-cache -- squid	An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks.	2019-11-26	not yet calculated	CVE-2019-18679 CONFIRM CONFIRM CONFIRM MISC
symantec -- critical_system_protection	Symantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypass vulnerability, which is a type of issue that can potentially allow a threat actor to circumvent existing authentication controls.	2019-11-25	not yet calculated	CVE-2019-18374 CONFIRM
tahoe-lafs -- tahoe-lafs	Tahoe-LAFS v1.3.0 through v1.8.2 could allow unauthorized users to delete immutable files in some cases.	2019-11-26	not yet calculated	CVE-2011-3617 MISC MISC MISC
tcl_alcatel -- cingular_flip_2_b9huah1_devices	On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an undocumented web API that allows unprivileged JavaScript, including JavaScript running within the KaiOS browser, to view and edit the device's firmware over-the-air update settings. (This web API is normally used by the system application to trigger firmware updates via OmaService.js.)	2019-11-26	not yet calculated	CVE-2019-16243 MISC MISC
tcl_alcatel -- cingular_flip_2_b9huah1_devices	On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an engineering application named omamock that is vulnerable to OS command injection. An attacker with physical access to the device can abuse this vulnerability to execute arbitrary OS commands as the root user via the application's UI.	2019-11-26	not yet calculated	CVE-2019-16242 MISC MISC
tcl_alcatel -- cingular_flip_2_b9huah1_devices	On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, PIN authentication can be bypassed by creating a special file within the /data/local/tmp/ directory. The System application that implements the lock screen checks for the existence of a specific file and disables PIN authentication if it exists. This file would typically be created via Android Debug Bridge (adb) over USB.	2019-11-26	not yet calculated	CVE-2019-16241 MISC MISC
thttpd -- thttpd	thttpd has a local DoS vulnerability via specially-crafted .htpasswd files	2019-11-25	not yet calculated	CVE-2012-5640 MISC REDHAT MISC MISC
trend_micro -- password_manager_for_andriod	Trend Micro Password Manager versions 3.x, 5.0, and 5.1 for Android is affected by a FLAG_MISUSE vulnerability that could be exploited to allow the application to share information to third-party applications on the device.	2019-11-25	not yet calculated	CVE-2019-15629 N/A
typo3 -- typo3	It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability. This issue can only be exploited if two or more parameters are bound to the query and at least two come from user input.	2019-11-26	not yet calculated	CVE-2011-3583 MISC MISC MISC MISC
typo3 -- typo3	The TYPO3 Core wec_discussion extension before 2.1.1 is vulnerable to SQL Injection due to improper sanitation of user-supplied input.	2019-11-26	not yet calculated	CVE-2011-3584 MISC MISC MISC
ubiquiti -- unifi_video_controller_software	A privilege escalation exists in UniFi Video Controller =<3.10.6 that would allow an attacker on the local machine to run arbitrary commands.	2019-11-26	not yet calculated	CVE-2019-15595 MISC
vdsm -- vdsm	vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from anyone who has a matching key (and certificate)	2019-11-25	not yet calculated	CVE-2012-5518 MISC MISC MISC
vsftpd -- vsftpd	vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.	2019-11-27	not yet calculated	CVE-2011-2523 MISC MISC MISC MISC MLIST
w3edge -- w3_total_cache	W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the hashes.	2019-11-22	not yet calculated	CVE-2012-6078 MISC MISC MISC CONFIRM
w3edge -- w3_total_cache	W3 Total Cache before 0.9.2.5 exposes sensitive cached database information which allows remote attackers to download this information via their hash keys.	2019-11-22	not yet calculated	CVE-2012-6079 MISC MISC MISC CONFIRM
w3edge -- w3_total_cache	W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files.	2019-11-22	not yet calculated	CVE-2012-6077 MISC MISC MISC MISC CONFIRM
wikimedia -- wikibase_wikidata_query_service	In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript execution can occur, aka XSS. This was addressed by introducing MathJax as a new mathematics rendering engine.	2019-11-27	not yet calculated	CVE-2019-19329 MISC MISC MISC MISC
wikimedia -- wikibase_wikidata_query_service	ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities.	2019-11-27	not yet calculated	CVE-2019-19328 MISC MISC MISC
wikimedia -- wikibase_wikidata_query_service	ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number of milliseconds.	2019-11-27	not yet calculated	CVE-2019-19327 MISC MISC MISC
wordpress -- wordpress	The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, and wmYpos, and template.	2019-11-26	not yet calculated	CVE-2015-9537 MISC MISC MISC
wordpress -- wordpress	The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fs_contact_form1[welcome] XSS.	2019-11-26	not yet calculated	CVE-2015-9539 MISC MISC MISC
wordpress -- wordpress	The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName.	2019-11-26	not yet calculated	CVE-2019-19306 MISC MISC MISC
wordpress -- wordpress	The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.	2019-11-26	not yet calculated	CVE-2015-9538 MISC MISC MISC MISC MISC MISC
xquest -- xquest	A password generation weakness exists in xquest through 2016-06-13.	2019-11-27	not yet calculated	CVE-2016-4980 MISC MISC MISC
xscreensaver -- xscreensaver	xscreensaver before 5.14 crashes during activation and leaves the screen unlocked when in Blank Only Mode and when DPMS is disabled, which allows local attackers to access resources without authentication.	2019-11-27	not yet calculated	CVE-2011-2187 MISC MISC MISC MISC MISC MLIST
yaws -- yaws	Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user could use this flaw to obtain content of arbitrary local files via specially-crafted URL request.	2019-11-26	not yet calculated	CVE-2011-4350 MISC MISC MISC MISC MISC
yubico -- pam	Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentication process and obtain access to the account in question by providing a NULL value (pressing Ctrl-D keyboard sequence) as the password string.	2019-11-26	not yet calculated	CVE-2011-4120 MISC MISC MISC MISC
zend_framework -- zend_framework	SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.	2019-11-26	not yet calculated	CVE-2011-1939 MISC BID MISC CONFIRM MISC CONFIRM MISC
zmartzone -- mod_auth_openidc	mod_auth_openidc before version 2.4.0.1 is vulnerable to a None	2019-11-26	not yet calculated	CVE-2019-14857 CONFIRM
zope -- zope	Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors related to the way error messages perform sanitization. NOTE: this issue exists because of an incomplete fix for CVE-2010-1104	2019-11-25	not yet calculated	CVE-2011-4924 MISC MISC MISC MISC MISC MISC MISC
zte -- zxcdn_iamweb	The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a configuration error vulnerability. An attacker could directly access the management portal in HTTP, resulting in users? information leakage.	2019-11-22	not yet calculated	CVE-2019-3428 CONFIRM

Please share your thoughts

We recently updated our anonymous product survey; we’d welcome your feedback.