Security Vulnerabilities - CVEs Published In December 2019
Code Injection vulnerability in the web interface in McAfee Web Advisor (WA) prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to render a website which Web Advisor would normally have blocked via a carefully crafted web site.
CVSS Score
6.5
EPSS Score
0.005
Published
2019-12-03
Intelbras WRN 150 1.0.18 devices allow CSRF via GO=system_password.asp to the goform/SysToolChangePwd URI to change a password.
CVSS Score
6.5
EPSS Score
0.008
Published
2019-12-02
Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud prior to version 2020 patch E have bug that allows a local user to execute arbitrary code via execution compromised file placed by an attacker with administrator rights. No privilege escalation. Possible whitelisting bypass some of the security products
CVSS Score
6.7
EPSS Score
0.001
Published
2019-12-02
When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.
CVSS Score
7.5
EPSS Score
0.002
Published
2019-12-02
rhn-proxy: may transmit credentials over clear-text when accessing RHN Satellite
CVSS Score
6.5
EPSS Score
0.001
Published
2019-12-02
FreeBSD: Input Validation Flaw allows local users to gain elevated privileges
CVSS Score
7.8
EPSS Score
0.001
Published
2019-12-02
ReviewBoard: has an access-control problem in REST API
CVSS Score
7.5
EPSS Score
0.01
Published
2019-12-02
Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.
CVSS Score
8.6
EPSS Score
0.012
Published
2019-12-02
openslp: SLPIntersectStringList()' Function has a DoS vulnerability
CVSS Score
7.5
EPSS Score
0.462
Published
2019-12-02
mom creates world-writable pid files in /var/run
CVSS Score
7.8
EPSS Score
0.001
Published
2019-12-02