CVEs published in December 2019
16 tracked CVEs from 4 vendors had their first vendor advisory published in December 2019: 7 critical, 2 high, 6 in CISA KEV. Newest first.
1 more from this month is covered only by Red Hat's per-package records, listed on the Red Hat vendor page.
- Added
CVE-2019-12418Unrated
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface
Apache · 1 advisory - Added
CVE-2019-17563Unrated
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack
Apache · 1 advisory - Added
CVE-2019-7481UnratedCISA KEV
SonicWall SMA100 SQL Injection Vulnerability
SonicWall · 1 advisory - Added
CVE-2019-1458UnratedCISA KEV
Microsoft Win32k Privilege Escalation Vulnerability
MS Server · 1 advisory - Added
CVE-2019-7195CriticalCISA KEV
QNAP Photo Station Path Traversal Vulnerability
QNAP · 1 advisory - Added
CVE-2019-7194CriticalCISA KEV
QNAP Photo Station Path Traversal Vulnerability
QNAP · 1 advisory - Added
CVE-2019-7193CriticalCISA KEV
QNAP QTS Improper Input Validation Vulnerability
QNAP · 1 advisory - Added
CVE-2019-7192CriticalCISA KEV
QNAP Photo Station Improper Access Control Vulnerability
QNAP · 1 advisory - Added
CVE-2019-7185Medium
This cross-site scripting (XSS) vulnerability in Music Station
QNAP · 1 advisory - Added
CVE-2019-7184Medium
This cross-site scripting (XSS) vulnerability in Video Station
QNAP · 1 advisory - Added
CVE-2019-7183Critical
QTS: This improper link resolution vulnerability allows remote attackers to access system files.
QNAP · 1 advisory - Added
CVE-2019-7201High
unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator.
QNAP · 1 advisory - Added
CVE-2019-7197Medium
QTS: stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS.
QNAP · 1 advisory - Added
CVE-2018-0730Critical
QTS: This command injection vulnerability in File Station allows attackers to execute commands on the affected device.
QNAP · 1 advisory - Added
CVE-2018-0729Critical
Music Station: This command injection vulnerability in Music Station allows attackers to execute commands on the affected device.
QNAP · 1 advisory - Added
CVE-2018-0728High
QTS: This improper access control vulnerability in Helpdesk allows attackers to access the system logs.
QNAP · 1 advisory