Exploited and new serious CVEs: December 2019

FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.

• Pre-auth
• Hard-coded credentials

freeswitch · freeswitchDec 1, 2019

Anviz CrossChex access control management software 4.3.8.0 and 4.3.12 is vulnerable to a buffer overflow vulnerability.

• Pre-auth
• Memory safety

anviz · crosschexDec 2, 2019

An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server app

• Pre-auth
• Memory safety

embedthis · goaheadDec 3, 2019

A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in ve

• Pre-auth
• Denial of service

embedthis · goaheadDec 3, 2019

The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entit

• Deserialization
• XXE

apache · olingoDec 4, 2019

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, om

• Pre-auth
• File upload

verot project · verotDec 4, 2019

Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password for the today account

• Pre-auth
• Auth bypass

fronius · datamanager box 2.0 firmwareDec 4, 2019

D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters w

• pre-auth RCE
• Auth bypass
• Broken access control (IDOR)

dlink · dap-1860 firmwareDec 5, 2019

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system.

• Pre-auth
• Broken access control (IDOR)

qnap · photo stationDec 5, 2019

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system.

• pre-auth RCE

qnap · qtsDec 5, 2019

This external control of file name or path vulnerability allows remote attackers to access or modify system files.

• Pre-auth
• Path traversal

qnap · photo stationDec 5, 2019

This external control of file name or path vulnerability allows remote attackers to access or modify system files.

• Pre-auth
• Path traversal

qnap · photo stationDec 5, 2019

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Adm

• RCE
• Command injection

strapi · strapiDec 5, 2019

A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and exec

• RCE
• File upload

apache · strutsDec 5, 2019

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue.

• Pre-auth
• Memory safety

openslp · openslpDec 6, 2019

The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi.

• Pre-auth
• SQL injection

titool · printmonitorDec 6, 2019

rsaz_512_sqr overflow bug on x86_64

• Pre-auth
• Memory safety

openssl · opensslDec 6, 2019

On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenti

• RCE
• Command injection

supermicro · x8sti-f biosDec 8, 2019

SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.

• Pre-auth
• Denial of service

sqlite · sqliteDec 9, 2019

Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/system

• pre-auth RCE
• Command injection

yachtcontrol · yachtcontrolDec 10, 2019

A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially

• Pre-auth
• XSS

microsoft · power bi report serverDec 10, 2019

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k

• Local privilege escalation

microsoft · windows 10 1507Dec 10, 2019

A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory,

• RCE
• Memory safety

microsoft · officeDec 10, 2019

A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k

• pre-auth RCE
• Memory safety

microsoft · windows 10Dec 10, 2019

An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows Medi

• Pre-auth
• Memory safety

microsoft · windows 7Dec 10, 2019

Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.

• Pre-auth
• XSS

tableau · tableau serverDec 11, 2019

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function.

• pre-auth RCE
• Deserialization

telerik · ui for asp.net ajaxDec 11, 2019

Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7.

• Pre-auth
• SQL injection

zabbix · zabbixDec 11, 2019

OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting

• Local privilege escalation

openbsd · openbsdDec 11, 2019

The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

• Pre-auth
• Denial of service

snakeyaml project · snakeyamlDec 11, 2019

An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110.

zohocorp · manageengine eventlog analyzerDec 13, 2019

A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1.

• pre-auth RCE
• XSS

maxum · rumpusDec 16, 2019

Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal.

• Pre-auth
• Path traversal

roxyfileman · roxy filemanDec 16, 2019

ELOG 3.1.4-57bea22 and below is affected by an information disclosure vulnerability.

• Pre-auth
• Info leak

elog project · elogDec 17, 2019

ELOG 3.1.4-57bea22 and below is affected by a denial of service vulnerability due to a NULL pointer dereference.

• Pre-auth
• Memory safety
• Denial of service

elog project · elogDec 17, 2019

Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources.

• Pre-auth
• SQL injection

sonicwall · sma 100 firmwareDec 17, 2019

On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.

• XSS

dlink · dir-615 firmwareDec 18, 2019

An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices.

• Pre-auth
• Memory safety

trendnet · tew-651br firmwareDec 18, 2019

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin

• pre-auth RCE

ibm · planning analyticsDec 18, 2019

In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server.

• Pre-auth
• CSRF
• Denial of service

tautulli · tautulliDec 18, 2019

A memory corruption issue was addressed with improved input validation.

• Local privilege escalation
• Memory safety

apple · iphone osDec 18, 2019

A memory corruption issue was addressed with improved input validation.

• RCE
• Local privilege escalation
• Memory safety

apple · iphone osDec 18, 2019

A type confusion issue was addressed with improved memory handling.

• pre-auth RCE

apple · icloudDec 18, 2019

This issue was addressed with improved checks.

• RCE
• Command injection

apple · mac os xDec 18, 2019

Multiple memory corruption issues were addressed with improved memory handling.

• pre-auth RCE
• Memory safety

apple · icloudDec 18, 2019

A use after free issue was addressed with improved memory management.

• Local privilege escalation
• Memory safety

apple · mac os xDec 18, 2019

A race condition was addressed with additional validation.

• Local privilege escalation
• Race condition

apple · iphone osDec 18, 2019

An input validation issue was addressed with improved memory handling.

• Local privilege escalation
• Memory safety

apple · icloudDec 18, 2019

An input validation issue was addressed with improved input validation.

• Memory safety

apple · icloudDec 18, 2019

A memory corruption issue was addressed with improved input validation.

• pre-auth RCE
• SQL injection

apple · icloudDec 18, 2019

A memory corruption issue was addressed by removing the vulnerable code.

• Local privilege escalation
• Memory safety

apple · icloudDec 18, 2019

A use after free issue was addressed with improved memory management.

• RCE
• Local privilege escalation
• Memory safety

apple · iphone osDec 18, 2019

A use after free issue was addressed with improved memory management.

• pre-auth RCE
• Memory safety

apple · iphone osDec 18, 2019

An out-of-bounds read was addressed with improved input validation.

• Pre-auth
• Memory safety

apple · iphone osDec 18, 2019

An out-of-bounds read was addressed with improved input validation.

• Pre-auth
• Memory safety

apple · iphone osDec 18, 2019

A use after free issue was addressed with improved memory management.

• pre-auth RCE
• Memory safety

apple · iphone osDec 18, 2019

A memory corruption issue was addressed with improved input validation.

• pre-auth RCE
• Memory safety

apple · iphone osDec 18, 2019

A use after free issue was addressed with improved memory management.

• pre-auth RCE
• Memory safety

apple · mac os xDec 18, 2019

Multiple memory corruption issues were addressed with improved memory handling.

• pre-auth RCE
• Memory safety

apple · icloudDec 18, 2019

Multiple memory corruption issues were addressed with improved memory handling.

• pre-auth RCE
• Memory safety

apple · icloudDec 18, 2019

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover.

• Pre-auth

djangoproject · djangoDec 18, 2019

In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the prese

• Pre-auth
• Path traversal

sonicwall · sma 100 firmwareDec 18, 2019

Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.301

• pre-auth RCE
• Memory safety

adobe · acrobat dcDec 19, 2019

phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL.

• Pre-auth
• XSS

ciprianmp · phpmychat-plusDec 20, 2019

An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices.

• Pre-auth
• Denial of service

mi · dgnwg03lm firmwareDec 20, 2019

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely exe

• pre-auth RCE
• Deserialization

apache · log4jDec 20, 2019

An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3.

• Pre-auth
• Denial of service

linux · linux kernelDec 23, 2019

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an

• Pre-auth

apache · tomcatDec 23, 2019

SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c.

• Pre-auth

sqlite · sqliteDec 24, 2019

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.

• RCE

mongo-express project · mongo-expressDec 24, 2019

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user informat

• Pre-auth
• Broken access control (IDOR)

icegram · email subscribers \& newslettersDec 25, 2019

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0.

• Pre-auth
• Path traversal

citrix · application delivery controller firmwareDec 27, 2019

Hikvision DS-2CD7153-E IP Camera has Privilege Escalation

hikvision · ds-2cd7153-e firmwareDec 27, 2019

Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials

• Pre-auth
• Auth bypass
• Hard-coded credentials

hikvision · ds-2cd7153-e firmwareDec 27, 2019

AVTECH AVN801 DVR has a security bypass via the administration login captcha

• Pre-auth
• Auth bypass

avtech · avn801 dvr firmwareDec 27, 2019

An issue was discovered on Alcatel-Lucent OmniVista 4760 devices.

• pre-auth RCE
• Auth bypass
• Path traversal

al-enterprise · omnivista 4760Dec 27, 2019

Buffer overflow in Senkas Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a POST request.

• pre-auth RCE

senkas kolibri project · senkas kolibriDec 27, 2019

TVT NVMS-1000 devices allow GET /..

• Pre-auth
• Path traversal

tvt · nvms-1000 firmwareDec 29, 2019

In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or freque

• XSS

nagios · nagios xiDec 30, 2019

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter.

• RCE

apache · solrDec 30, 2019

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to exec

• pre-auth RCE
• Command injection

dlink · dir-859 firmwareDec 30, 2019

A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, formerly PTI Marketing,

• pre-auth RCE
• Path traversal

ricoh · fusionpro vdpDec 31, 2019

In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to scheduler

• RCE
• Command injection

nagios · nagios xiDec 31, 2019