# CVEs published 2020-01-14

107 CVEs were published on January 14, 2020: 1 critical, 3 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2020-5502](https://cve.now/CVE-2020-5502.md): phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships. (no CVSS, phpbb/phpbb)
- [CVE-2020-5501](https://cve.now/CVE-2020-5501.md): phpBB 3.2.8 allows a CSRF attack that can modify a group avatar. (no CVSS, phpbb/phpbb)
- [CVE-2020-0654](https://cve.now/CVE-2020-0654.md): A security feature bypass vulnerability exists in Microsoft OneDrive App for Android.This could allow an attacker to bypass the passcode… (no CVSS, Microsoft One Drive for Android)
- [CVE-2020-0656](https://cve.now/CVE-2020-0656.md): A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web… (no CVSS, Microsoft Dynamics 365 Field Service (on-premises) v7 series)
- [CVE-2020-0652](https://cve.now/CVE-2020-0652.md): A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory… (no CVSS, Microsoft Office)
- [CVE-2020-0653](https://cve.now/CVE-2020-0653.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka… (no CVSS, Microsoft Office 365 ProPlus)
- [CVE-2020-0647](https://cve.now/CVE-2020-0647.md): A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly, aka 'Microsoft… (no CVSS, Microsoft Office Online Server)
- [CVE-2020-0650](https://cve.now/CVE-2020-0650.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka… (no CVSS, Microsoft Office · Microsoft Excel)
- [CVE-2020-0651](https://cve.now/CVE-2020-0651.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka… (no CVSS, Microsoft Office · Microsoft Excel)
- [CVE-2020-0644](https://cve.now/CVE-2020-0644.md): An elevation of privilege vulnerability exists when Microsoft Windows implements predictable memory section names, aka 'Windows Elevation… (no CVSS, Microsoft Windows)
- [CVE-2020-0646](https://cve.now/CVE-2020-0646.md): A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote (CVSS 9.8, KEV, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2… +4)
- [CVE-2020-0642](https://cve.now/CVE-2020-0642.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka… (no CVSS, Microsoft Windows)
- [CVE-2020-0643](https://cve.now/CVE-2020-0643.md): An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface Plus (GDI+) handles objects in… (no CVSS, Microsoft Windows)
- [CVE-2020-0640](https://cve.now/CVE-2020-0640.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory… (no CVSS, Microsoft Internet Explorer)
- [CVE-2020-0641](https://cve.now/CVE-2020-0641.md): An elevation of privilege vulnerability exists in Windows Media Service that allows file creation in arbitrary locations.To exploit the… (no CVSS, Microsoft Windows)
- [CVE-2020-0637](https://cve.now/CVE-2020-0637.md): An information disclosure vulnerability exists when Remote Desktop Web Access improperly handles credential information, aka 'Remote… (no CVSS, Microsoft Windows Server)
- [CVE-2020-0638](https://cve.now/CVE-2020-0638.md): An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an at (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2020-0639](https://cve.now/CVE-2020-0639.md): An information disclosure vulnerability exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle… (no CVSS, Microsoft Windows)
- [CVE-2020-0635](https://cve.now/CVE-2020-0635.md): An elevation of privilege vulnerability exists in Microsoft Windows when Windows fails to properly handle certain symbolic links, aka… (no CVSS, Microsoft Windows)
- [CVE-2020-0636](https://cve.now/CVE-2020-0636.md): An elevation of privilege vulnerability exists in the way that the Windows Subsystem for Linux handles files, aka 'Windows Subsystem for… (no CVSS, Microsoft Windows)
- [CVE-2020-0633](https://cve.now/CVE-2020-0633.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search… (no CVSS, Microsoft Windows)
- [CVE-2020-0634](https://cve.now/CVE-2020-0634.md): An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory… (no CVSS, Microsoft Windows)
- [CVE-2020-0630](https://cve.now/CVE-2020-0630.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search… (no CVSS, Microsoft Windows)
- [CVE-2020-0631](https://cve.now/CVE-2020-0631.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search… (no CVSS, Microsoft Windows)
- [CVE-2020-0632](https://cve.now/CVE-2020-0632.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search… (no CVSS, Microsoft Windows)
- [CVE-2020-0628](https://cve.now/CVE-2020-0628.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search… (no CVSS, Microsoft Windows)
- [CVE-2020-0629](https://cve.now/CVE-2020-0629.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search… (no CVSS, Microsoft Windows)
- [CVE-2020-0626](https://cve.now/CVE-2020-0626.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search… (no CVSS, Microsoft Windows)
- [CVE-2020-0627](https://cve.now/CVE-2020-0627.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search… (no CVSS, Microsoft Windows)
- [CVE-2020-0624](https://cve.now/CVE-2020-0624.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka… (no CVSS, Microsoft Windows)
- [CVE-2020-0625](https://cve.now/CVE-2020-0625.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search… (no CVSS, Microsoft Windows)
- [CVE-2020-0622](https://cve.now/CVE-2020-0622.md): An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory, aka… (no CVSS, Microsoft Windows)
- [CVE-2020-0623](https://cve.now/CVE-2020-0623.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search… (no CVSS, Microsoft Windows)
- [CVE-2020-0617](https://cve.now/CVE-2020-0617.md): A denial of service vulnerability exists when Microsoft Hyper-V Virtual PCI on a host server fails to properly validate input from a… (no CVSS, Microsoft Windows)
- [CVE-2020-0620](https://cve.now/CVE-2020-0620.md): An elevation of privilege vulnerability exists when Microsoft Cryptographic Services improperly handles files, aka 'Microsoft… (no CVSS, Microsoft Windows)
- [CVE-2020-0621](https://cve.now/CVE-2020-0621.md): A security feature bypass vulnerability exists in Windows 10 when third party filters are called during a password update, aka 'Windows… (no CVSS, Microsoft Windows)
- [CVE-2020-0615](https://cve.now/CVE-2020-0615.md): An information disclosure vulnerability exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle… (no CVSS, Microsoft Windows)
- [CVE-2020-0616](https://cve.now/CVE-2020-0616.md): A denial of service vulnerability exists when Windows improperly handles hard links, aka 'Microsoft Windows Denial of Service… (no CVSS, Microsoft Windows)
- [CVE-2020-0613](https://cve.now/CVE-2020-0613.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search… (no CVSS, Microsoft Windows)
- [CVE-2020-0614](https://cve.now/CVE-2020-0614.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search… (no CVSS, Microsoft Windows)
- [CVE-2020-0611](https://cve.now/CVE-2020-0611.md): A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote… (no CVSS, Microsoft Windows)
- [CVE-2020-0612](https://cve.now/CVE-2020-0612.md): A denial of service vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an attacker connects to the target system… (no CVSS, Microsoft Windows Server)
- [CVE-2020-0608](https://cve.now/CVE-2020-0608.md): An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information… (no CVSS, Microsoft Windows)
- [CVE-2020-0609](https://cve.now/CVE-2020-0609.md): A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to… (no CVSS, Microsoft Windows Server)
- [CVE-2020-0610](https://cve.now/CVE-2020-0610.md): A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to… (no CVSS, Microsoft Windows Server)
- [CVE-2020-0606](https://cve.now/CVE-2020-0606.md): A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who… (no CVSS, Microsoft .NET Core · Microsoft .NET Framework 4.6/4.6.1… +7)
- [CVE-2020-0607](https://cve.now/CVE-2020-0607.md): An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft… (no CVSS, Microsoft Windows)
- [CVE-2020-0603](https://cve.now/CVE-2020-0603.md): A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who… (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.All +11)
- [CVE-2020-0605](https://cve.now/CVE-2020-0605.md): A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who… (no CVSS, Microsoft .NET Core · Microsoft .NET Framework 4.6/4.6.1… +1)
- [CVE-2020-0601](https://cve.now/CVE-2020-0601.md): A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attac (CVSS 8.1, KEV, Microsoft Windows · stdlib)
- [CVE-2020-0602](https://cve.now/CVE-2020-0602.md): A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service… (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.All +10)
- [CVE-2020-7057](https://cve.now/CVE-2020-7057.md): Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed… (no CVSS)
- [CVE-2011-2715](https://cve.now/CVE-2011-2715.md): An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column… (no CVSS, Drupal Data-module · drupal/core)
- [CVE-2011-2714](https://cve.now/CVE-2011-2714.md): A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table… (no CVSS, Drupal Data-module · drupal/core)
- [CVE-2011-2706](https://cve.now/CVE-2011-2706.md): A Cross-Site Scripting (XSS) vulnerability exists in the reorder administrator functions in sNews 1.71. (no CVSS, sNews)
- [CVE-2016-6592](https://cve.now/CVE-2016-6592.md): A vulnerability was found in Symantec Norton Download Manager versions prior to 5.6. (no CVSS, Symantec Norton Download Manager)
- [CVE-2020-7054](https://cve.now/CVE-2020-7054.md): MmsValue\_decodeMmsData in mms/iso\_mms/server/mms\_access\_result.c in libIEC61850 through 1.4.0 has a heap-based buffer overflow when… (no CVSS)
- [CVE-2011-2933](https://cve.now/CVE-2011-2933.md): An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict… (no CVSS, WebsiteBaker)
- [CVE-2011-2934](https://cve.now/CVE-2011-2934.md): A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to… (no CVSS, WebsiteBaker)
- [CVE-2018-1002104](https://cve.now/CVE-2018-1002104.md): Versions \< 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly. (CVSS 5.3, Kubernetes k8s.gcr.io/defaultbackend · k8s.io/ingress-nginx)
- [CVE-2019-16784](https://cve.now/CVE-2019-16784.md): Local Privilege Escalation present only on the Windows version of PyInstaller (CVSS 7.0, PyInstaller)
- [CVE-2011-3183](https://cve.now/CVE-2011-3183.md): A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier. (no CVSS, Concrete CMS)
- [CVE-2020-7053](https://cve.now/CVE-2020-7053.md): In the Linux kernel 4.14 longterm through 4.14.165 and 4.19 longterm through 4.19.96 (and 5.x before 5.2), there is a use-after-free… (no CVSS)
- [CVE-2011-3202](https://cve.now/CVE-2011-3202.md): A Cross-Site Scripting (XSS) vulnerability exists in the g parameter to index.php in Jcow CMS 4.2 and earlier. (no CVSS, Jcow CMS)
- [CVE-2011-3203](https://cve.now/CVE-2011-3203.md): A Code Execution vulnerability exists the attachment parameter to index.php in Jcow CMS 4.x to 4.2 and 5.2 to 5.2. (no CVSS, Jcow CMS)
- [CVE-2020-5180](https://cve.now/CVE-2020-5180.md): Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a… (no CVSS)
- [CVE-2019-13722](https://cve.now/CVE-2019-13722.md): Inappropriate implementation in WebRTC in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap… (no CVSS, Google Chrome)
- [CVE-2020-6173](https://cve.now/CVE-2020-6173.md): TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption. (no CVSS, tuf)
- [CVE-2019-3981](https://cve.now/CVE-2019-3981.md): MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. (no CVSS, MikroTik WinBox)
- [CVE-2020-5509](https://cve.now/CVE-2020-5509.md): PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image. (no CVSS)
- [CVE-2020-5505](https://cve.now/CVE-2020-5505.md): Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunction with… (no CVSS)
- [CVE-2019-13537](https://cve.now/CVE-2019-13537.md): The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buffer overflow… (no CVSS, AVEVA Vijeo Citect and Citect SCADA)
- [CVE-2019-19548](https://cve.now/CVE-2019-19548.md): Norton Power Eraser, prior to 5.3.0.67, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an… (no CVSS, Symantec Norton Power Eraser)
- [CVE-2015-3159](https://cve.now/CVE-2015-3159.md): The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process… (no CVSS, ABRT)
- [CVE-2020-6303](https://cve.now/CVE-2020-6303.md): SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting. (CVSS 5.4, SAP SE SAP Disclosure Management)
- [CVE-2020-6304](https://cve.now/CVE-2020-6304.md): Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22… (CVSS 5.9, SAP SE SAP NetWeaver Internet Communication Manager)
- [CVE-2020-6305](https://cve.now/CVE-2020-6305.md): PI Rest Adapter of SAP Process Integration (update provided in SAP\_XIAF 7.31, 7.40, 7.50) does not sufficiently encode user-controlled… (CVSS 6.1, SAP SE SAP Process Integration - Rest Adapter)
- [CVE-2020-6306](https://cve.now/CVE-2020-6306.md): Missing authorization check in a transaction within SAP Leasing (update provided in SAP\_APPL 6.18, EA-APPL 6.0, 6.02, 6.03, 6.04, 6.05… (CVSS 2.7, SAP SE SAP Leasing)
- [CVE-2020-6307](https://cve.now/CVE-2020-6307.md): Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform… (CVSS 4.3, SAP SE Automated Note Search Tool)
- [CVE-2015-3151](https://cve.now/CVE-2015-3151.md): Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change… (no CVSS, ABRT)
- [CVE-2020-5193](https://cve.now/CVE-2020-5193.md): PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple reflected XSS vulnerabilities via the searchdata or… (no CVSS)
- [CVE-2015-3150](https://cve.now/CVE-2015-3150.md): abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary files via the problem… (no CVSS, ABRT)
- [CVE-2015-3147](https://cve.now/CVE-2015-3147.md): daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local… (no CVSS, ABRT)
- [CVE-2015-1869](https://cve.now/CVE-2015-1869.md): The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a… (no CVSS, ABRT)
- [CVE-2015-2326](https://cve.now/CVE-2015-2326.md): The pcre\_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service… (no CVSS)
- [CVE-2015-2325](https://cve.now/CVE-2015-2325.md): The compile\_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service… (no CVSS)
- [CVE-2015-0558](https://cve.now/CVE-2015-0558.md): The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG\_TEF\_SP\_4.06L.6, and possibly other routers, uses… (no CVSS)
- [CVE-2019-12398](https://cve.now/CVE-2019-12398.md): In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow… (no CVSS, Apache Airflow · apache-airflow)
- [CVE-2019-10995](https://cve.now/CVE-2019-10995.md): ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning… (no CVSS, ABB CP651 HMI products)
- [CVE-2020-5853](https://cve.now/CVE-2020-5853.md): In BIG-IP APM portal access on versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, when backend… (no CVSS, F5 BIG-IP APM)
- [CVE-2014-7844](https://cve.now/CVE-2014-7844.md): BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address. (no CVSS, BSD mailx)
- [CVE-2014-2271](https://cve.now/CVE-2014-2271.md): cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls… (no CVSS)
- [CVE-2020-5852](https://cve.now/CVE-2020-5852.md): Undisclosed traffic patterns received may cause a disruption of service to the Traffic Management Microkernel (TMM). (no CVSS, F5 BIG-IP)
- [CVE-2014-5238](https://cve.now/CVE-2014-5238.md): XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote… (no CVSS)
- [CVE-2014-5138](https://cve.now/CVE-2014-5138.md): Innovative Interfaces Sierra Library Services Platform 1.2\_3 does not properly handle query strings with multiple instances of the same… (no CVSS)
- [CVE-2014-4609](https://cve.now/CVE-2014-4609.md): Integer overflow in the get\_len function in libavutil/lzo.c in Libav before 0.8.13, 9.x before 9.14, and 10.x before 10.2 allows remote… (no CVSS)
- [CVE-2014-4610](https://cve.now/CVE-2014-4610.md): Integer overflow in the get\_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x… (no CVSS)
- [CVE-2015-8366](https://cve.now/CVE-2015-8366.md): Array index error in smal\_decode\_segment function in LibRaw before 0.17.1 allows context-dependent attackers to cause memory errors and… (no CVSS)
- [CVE-2015-8367](https://cve.now/CVE-2015-8367.md): The phase\_one\_correct function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute arbitrary code… (no CVSS)
- [CVE-2020-5851](https://cve.now/CVE-2020-5851.md): On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot detect modifications to specific system… (no CVSS, BIG-IP)
- [CVE-2013-7185](https://cve.now/CVE-2013-7185.md): PotPlayer 1.5.40688: .avi File Memory Corruption (no CVSS)
- [CVE-2019-12399](https://cve.now/CVE-2019-12399.md): When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers… (no CVSS, Apache Kafka · org.apache.kafka:kafka)
- [CVE-2013-2773](https://cve.now/CVE-2013-2773.md): Nitro PDF 8.5.0.26: A specially crafted DLL file can facilitate Arbitrary Code Execution (no CVSS)
- [CVE-2019-0219](https://cve.now/CVE-2019-0219.md): A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a… (no CVSS, Apache Cordova · cordova-plugin-inappbrowser)
- [CVE-2014-9211](https://cve.now/CVE-2014-9211.md): ClickDesk version 4.3 and below has persistent cross site scripting (no CVSS)
- [CVE-2020-5194](https://cve.now/CVE-2020-5194.md): The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip functionality via an… (no CVSS)
- [CVE-2020-5196](https://cve.now/CVE-2020-5196.md): Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create files, display… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2020-01-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.