Skip to content
OpenAdvisories

Archive

5 December 2019

Vulnerabilities first published on this day (UTC), newest first.

← November 2019 2019 / December /5 January 2020 →
  1. 15
  2. 241
  3. 364
  4. 438
  5. 547
  6. 649
  7. 7 
  8. 89
  9. 927
  10. 10100
  11. 1177
  12. 12123
  13. 1359
  14. 14 
  15. 1510
  16. 1648
  17. 1771
  18. 18369
  19. 1956
  20. 2036
  21. 21 
  22. 222
  23. 2357
  24. 2421
  25. 253
  26. 2673
  27. 2766
  28. 281
  29. 2912
  30. 3079
  31. 3144
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.3
    CVE-2019-16770

    Potential DOS attack in Puma

    In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional co…

    puma puma puma puma Debian RubyGems
  • Medium 4.2
    CVE-2019-16769

    Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS)

    The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since N…

    yahoo serialize-javascript serialize-javascript npm
  • Medium 4.8
    CVE-2019-11255

    Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation

    Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized Persisten…

    Kubernetes kubernetes-csi external-resizer kubernetes-csi external-snapshotter kubernetes-csi external-provisioner Wolfi Go
  • Medium 6.8
    CVE-2019-3690

    chkstat follows untrusted symbolic links

    The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkst…

    SUSE permissions
  • Medium 5.3
    CVE-2019-18180

    Denial of service

    Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g. attaching files to mails) of ((OTRS)) Community Edition and OTRS allows an remote attacker to cause an endless loop. This issue affects: OTRS AG…

    otrs2 otrs2 Debian Ubuntu
  • Medium 5.4
    CVE-2019-19596

    GitBook allows Cross-site Scripting via a local .md file.

    GitBook through 2.6.9 allows XSS via a local .md file.

    gitbook npm