Skip to content
OpenAdvisories

Archive

25 November 2019

Vulnerabilities first published on this day (UTC), newest first.

← October 2019 2019 / November /25 December 2019 →
  1. 132
  2. 210
  3. 3 
  4. 443
  5. 5119
  6. 6112
  7. 765
  8. 827
  9. 929
  10. 10 
  11. 1110
  12. 12138
  13. 13111
  14. 14262
  15. 1536
  16. 163
  17. 174
  18. 1877
  19. 1931
  20. 2042
  21. 21106
  22. 2258
  23. 23 
  24. 24 
  25. 25154
  26. 26120
  27. 2749
  28. 2810
  29. 2933
  30. 305
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium 6.1
    CVE-2019-10771

    Cross-Site Scripting in iobroker.web

    Characters in the GET url path are not properly escaped and can be reflected in the server response.

    iobroker.web npm
  • Medium 6.1
    CVE-2019-17632

    Unescaped exception messages in error responses in Jetty

    In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

    The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-server Debian Ubuntu Maven
  • Medium 6.5
    CVE-2019-5825 Exploited Public exploit EPSS 56%

    Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially explo…

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu
    KEV Jun 8, 2022
  • Medium 6.5
    CVE-2019-16764

    PowAssent is susceptible to denial of service attacks

    The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks. In `PowAssent.Phoenix.AuthorizationController` a value is fetched from the user provided params, and `String.to_atom/1` is used to convert the binary value to an atom so i…

    pow-auth pow_assent pow_assent Hex
  • Medium 6.1
    CVE-2011-4924

    Zope XSS Vulnerability

    Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors r…

    zope zope2, zope3 zope zope2 PyPI
  • Medium 4.4
    CVE-2019-4406

    IBM Spectrum Protect Backup-Archive Client 7.1 and 8.1 may be vulnerable to a denial of service attack due to a timing …

    IBM Spectrum Protect Backup-Archive Client
  • Medium 5.1
    CVE-2018-2025

    IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments 7.1 and 8.1 creates direct…

    IBM Spectrum Protect for Virtual Environments Spectrum Protect Backup-Archive Client
  • Medium 5.7
    CVE-2019-10217

    Exposure of Sensitive Information to an Unauthorized Actor in ansible

    A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setti…

    Red Hat Ansible ansible ansible Debian Alpine PyPI
  • Medium 5.3
    CVE-2019-10213

    OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log leve…

    Red Hat openshift
  • Medium 4.7
    CVE-2019-10207 Public exploit

    A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and ke…

    Red Hat kernel linux-raspi2 linux-hwe Debian Ubuntu
  • Medium 6.2
    CVE-2012-5578

    Incorrect Default Permissions in keyring

    Python keyring has insecure permissions on new databases allowing world-readable files to be created

    Python Python keyring keyring python-keyring Debian PyPI
  • Medium 6.4
    CVE-2019-10214

    containers/image library Insufficiently Protects Credentials

    The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker…

    singularity-container github.com/containers/image golang-github-containers-image Ubuntu Go
  • Medium 5.0
    CVE-2019-14891

    A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can re…

  • Medium 4.3
    CVE-2019-10224

    A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and d…

    Red Hat 389-ds-base 389-ds-base 389-ds-base Debian Ubuntu
  • Medium 4.1
    CVE-2019-14825

    Katello cleartext password storage issue

    A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials …

    Red Hat katello katello RubyGems