Skip to content
OpenAdvisories

Archive

December 2019

Vulnerabilities first published in this month (UTC), newest first.

← November 2019 2019 / December January 2020 →
  1. 15
  2. 241
  3. 364
  4. 438
  5. 547
  6. 649
  7. 7 
  8. 89
  9. 927
  10. 10100
  11. 1177
  12. 12123
  13. 1359
  14. 14 
  15. 1510
  16. 1648
  17. 1771
  18. 18369
  19. 1956
  20. 2036
  21. 21 
  22. 222
  23. 2357
  24. 2421
  25. 253
  26. 2673
  27. 2766
  28. 281
  29. 2912
  30. 3079
  31. 3144
All Critical High Medium Low Exploited only Public exploit

126 results · Clear filters · Feed

  • Unscored —
    CVE-2015-5595 Public exploit

    Cross-site request forgery (CSRF) vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack…

  • Unscored —
    CVE-2015-5591 Public exploit

    SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands.

  • Unscored —
    CVE-2019-20197 Public exploit EPSS 23%

    In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id p…

  • Unscored —
    CVE-2019-10227 Public exploit

    openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.

  • Unscored —
    CVE-2019-7751 Public exploit EPSS 14%

    A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, fo…

  • Medium 6.1
    CVE-2019-9553 Public exploit

    Bolt Cross-site Scripting via the slug, teaser or title parameters

    Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933.

    bolt/bolt Packagist
  • Unscored —
    CVE-2019-9554 Public exploit

    In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code a…

  • Unscored —
    CVE-2019-9556 Public exploit

    FiberHome an5506-04-f RP2669 devices have XSS.

  • Unscored —
    CVE-2019-19032 Public exploit

    XMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is: Arbitrary File Read when an…

  • Unscored —
    CVE-2019-19031 Public exploit

    Easy XML Editor through v1.7.8 is affected by: XML External Entity Injection. The impact is: Arbitrary File Read and Do…

  • High 7.5
    CVE-2019-20149 Public exploit

    Validation Bypass in kind-of

    ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate…

    js-jquery kind-of node-kind-of node-kind-of Debian Ubuntu Azure Linux npm
  • Unscored —
    CVE-2019-19470 Public exploit

    Unsafe usage of .NET deserialization in Named Pipe message processing allows privilege escalation to NT AUTHORITY\SYSTE…

  • High 7.5
    CVE-2019-17558 Exploited Public exploit Scanner template EPSS 99%

    Improper Input Validation in Apache Solr

    Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configse…

    org.apache.solr:solr-core lucene-solr Debian Maven
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-17621 Exploited Public exploit EPSS 91%

    The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated re…

    KEV Jun 29, 2023
  • High 7.5
    CVE-2019-20085 Exploited Public exploit Scanner template EPSS 96%

    TVT NVMS-1000 devices allow GET /.. Directory Traversal

    KEV Nov 3, 2021
  • Unscored —
    CVE-2014-6420 Public exploit

    Cross-site scripting (XSS) vulnerability in Livefyre LiveComments 3.0 allows remote attackers to inject arbitrary web s…

  • Unscored —
    CVE-2014-5289 Public exploit EPSS 12%

    Buffer overflow in Senkas Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a POST reques…

  • Unscored —
    CVE-2014-3136 Public exploit

    Cross-site request forgery (CSRF) vulnerability in D-Link DWR-113 (Rev. Ax) with firmware before 2.03b02 allows remote …

  • Unscored —
    CVE-2013-4985 Public exploit

    Multiple Vivotek IP Cameras remote authentication bypass that could allow access to the video stream

  • Unscored —
    CVE-2013-4982 Public exploit Scanner template EPSS 13%

    AVTECH AVN801 DVR has a security bypass via the administration login captcha

  • Unscored —
    CVE-2013-4976 Public exploit EPSS 36%

    Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials

  • Unscored —
    CVE-2013-4975 Public exploit EPSS 12%

    Hikvision DS-2CD7153-E IP Camera has Privilege Escalation

  • Unscored —
    CVE-2013-4868 Public exploit

    Karotz API 12.07.19.00: Session Token Information Disclosure

  • Unscored —
    CVE-2013-4867 Public exploit

    Electronic Arts Karotz Smart Rabbit 12.07.19.00 allows Python module hijacking

  • Unscored —
    CVE-2013-4859 Public exploit

    INSTEON Hub 2242-222 lacks Web and API authentication

  • Unscored —
    CVE-2013-4743 Public exploit

    Static HTTP Server 1.0 has a Local Overflow

  • Unscored —
    CVE-2013-4692 Public exploit

    Xorbin Analog Flash Clock 1.0 extension for Joomia has XSS

  • Unscored —
    CVE-2013-4695 Public exploit

    Winamp 5.63: Invalid Pointer Dereference leading to Arbitrary Code Execution

  • Unscored —
    CVE-2013-4665 Public exploit

    SPBAS Business Automation Software 2012 has CSRF.

  • Unscored —
    CVE-2013-4664 Public exploit

    SPBAS Business Automation Software 2012 has XSS.

  • Critical 9.8
    CVE-2019-19781 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. T…

    KEV Nov 3, 2021
  • Medium 5.8
    CVE-2019-19985 Public exploit Scanner template EPSS 71%

    The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file downlo…

    Web / CMS
  • Critical 9.9
    CVE-2019-10758 Exploited Public exploit Scanner template EPSS 85%

    Remote Code Execution Vulnerability in NPM mongo-express

    mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

    mongo-express npm
    KEV Dec 10, 2021
  • Unscored —
    CVE-2017-16778 Public exploit

    An access control weakness in the DTMF tone receiver of Fermax Outdoor Panel allows physical attackers to inject a Dual…

  • Unscored —
    CVE-2018-10388 Public exploit

    Format string vulnerability in the logMess function in TFTP Server SP 1.66 and earlier allows remote attackers to perfo…

  • Unscored —
    CVE-2019-7489 Public exploit

    A vulnerability in SonicWall Email Security appliance allow an unauthenticated user to perform remote code execution. T…

    SonicWall Email Security Appliance Network devices
  • Critical 9.8
    CVE-2019-19919 Public exploit

    Prototype Pollution in handlebars

    Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payl…

    handlebars node-handlebars node-handlebars bootstrap-wysihtml5-rails Debian Ubuntu npm RubyGems
  • High 7.3
    CVE-2019-19231 Public exploit

    An insecure file access vulnerability exists in CA Client Automation 14.0, 14.1, 14.2, and 14.3 Agent for Windows that …

    CA Technologies, Broadcom Company CA Client Automation
  • Critical 9.8
    CVE-2019-17571 Public exploit EPSS 70%

    Deserialization of Untrusted Data in Log4j

    Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log dat…

    Apache Software Foundation Log4j druid apache-log4j1.2 Debian Ubuntu Wolfi Maven
  • Medium 6.1
    CVE-2016-1000229 Public exploit

    Improper Neutralization of Input During Web Page Generation in swagger-ui

    swagger-ui has XSS in key names

    swagger-ui npm