# CVEs published 2020-01-29

54 CVEs were published on January 29, 2020: 1 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-3147](https://cve.now/CVE-2020-3147.md): Cisco Small Business Switches Denial of Service Vulnerability (CVSS 8.6, Cisco Small Business 300 Series Managed Switches)
- [CVE-2020-8438](https://cve.now/CVE-2020-8438.md): Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hidden… (no CVSS)
- [CVE-2013-3321](https://cve.now/CVE-2013-3321.md): NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially crafted requests to… (no CVSS)
- [CVE-2013-3320](https://cve.now/CVE-2013-3320.md): Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2013-3317](https://cve.now/CVE-2013-3317.md): Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass via the NtgrBak key. (no CVSS)
- [CVE-2013-3316](https://cve.now/CVE-2013-3316.md): Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass due to the server skipping checks for URLs containing a… (no CVSS)
- [CVE-2019-10783](https://cve.now/CVE-2019-10783.md): All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. (no CVSS, lsof)
- [CVE-2019-20444](https://cve.now/CVE-2019-20444.md): HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with (no CVSS, io.netty:netty-codec-http · org.jboss.netty:netty +1)
- [CVE-2019-20445](https://cve.now/CVE-2019-20445.md): HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Tr (no CVSS, io.netty:netty-handler · org.jboss.netty:netty +1)
- [CVE-2020-3758](https://cve.now/CVE-2020-3758.md): Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting… (no CVSS, Adobe Magento · magento/community-edition +1)
- [CVE-2020-3719](https://cve.now/CVE-2020-3719.md): Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability. (no CVSS, Adobe Magento · magento/community-edition +1)
- [CVE-2020-3718](https://cve.now/CVE-2020-3718.md): Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a security bypass vulnerability. (no CVSS, Adobe Magento · magento/community-edition +1)
- [CVE-2020-3717](https://cve.now/CVE-2020-3717.md): Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability. (no CVSS, Adobe Magento · magento/community-edition)
- [CVE-2020-3716](https://cve.now/CVE-2020-3716.md): Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted… (no CVSS, Adobe Magento · magento/community-edition)
- [CVE-2020-3715](https://cve.now/CVE-2020-3715.md): Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting… (no CVSS, Adobe Magento · magento/community-edition +1)
- [CVE-2020-3714](https://cve.now/CVE-2020-3714.md): Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. (no CVSS, Adobe Illustrator CC)
- [CVE-2020-3713](https://cve.now/CVE-2020-3713.md): Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. (no CVSS, Adobe Illustrator CC)
- [CVE-2020-3712](https://cve.now/CVE-2020-3712.md): Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. (no CVSS, Adobe Illustrator CC)
- [CVE-2020-3711](https://cve.now/CVE-2020-3711.md): Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. (no CVSS, Adobe Illustrator CC)
- [CVE-2020-3710](https://cve.now/CVE-2020-3710.md): Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. (no CVSS, Adobe Illustrator CC)
- [CVE-2013-2574](https://cve.now/CVE-2013-2574.md): An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /log/ directories… (no CVSS)
- [CVE-2020-8432](https://cve.now/CVE-2020-8432.md): In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do\_rename\_gpt\_parts() function. (no CVSS)
- [CVE-2013-2573](https://cve.now/CVE-2013-2573.md): A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless\_mft.cgi file in TP-Link IP Cameras TL-SC 3130… (no CVSS)
- [CVE-2013-2572](https://cve.now/CVE-2013-2572.md): A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 due to default… (no CVSS)
- [CVE-2013-2570](https://cve.now/CVE-2013-2570.md): A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub\_C8C8… (no CVSS)
- [CVE-2019-18634](https://cve.now/CVE-2019-18634.md): In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo… (no CVSS)
- [CVE-2013-3215](https://cve.now/CVE-2013-3215.md): vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the… (no CVSS)
- [CVE-2013-2569](https://cve.now/CVE-2013-2569.md): A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is disabled by default… (no CVSS)
- [CVE-2013-2568](https://cve.now/CVE-2013-2568.md): A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless\_mft.cgi, which… (no CVSS)
- [CVE-2013-2567](https://cve.now/CVE-2013-2567.md): An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded admin account… (no CVSS)
- [CVE-2020-8416](https://cve.now/CVE-2020-8416.md): IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to the PASV mode port. (no CVSS)
- [CVE-2020-8093](https://cve.now/CVE-2020-8093.md): Code Injection into Bitdefender AV for Mac (CVSS 5.3, Bitdefender Antivirus for Mac)
- [CVE-2020-8092](https://cve.now/CVE-2020-8092.md): Privilege escalation in Bitdefender AV for Mac (CVSS 1.6, Bitdefender Antivirus for Mac)
- [CVE-2020-7247](https://cve.now/CVE-2020-7247.md): smtp\_mailaddr in smtp\_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary co (CVSS 9.8, KEV)
- [CVE-2019-7655](https://cve.now/CVE-2019-7655.md): Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the (1) customList%5B0%5D.value field in… (no CVSS)
- [CVE-2019-7656](https://cve.now/CVE-2019-7656.md): A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges… (no CVSS)
- [CVE-2019-7654](https://cve.now/CVE-2019-7654.md): Wowza Streaming Engine 4.8.0 and earlier suffers from multiple CSRF vulnerabilities. (no CVSS)
- [CVE-2020-2107](https://cve.now/CVE-2020-2107.md): Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where… (no CVSS, Jenkins project Jenkins Fortify Plugin · org.jenkins-ci.plu…)
- [CVE-2020-2108](https://cve.now/CVE-2020-2108.md): Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a… (no CVSS, Jenkins project Jenkins WebSphere Deployer Plugin · org.jen…)
- [CVE-2020-2105](https://cve.now/CVE-2020-2105.md): REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks. (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-2106](https://cve.now/CVE-2020-2106.md): Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a… (no CVSS, Jenkins project Jenkins Code Coverage API Plugin · io.jenki…)
- [CVE-2020-2103](https://cve.now/CVE-2020-2103.md): Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page. (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-2104](https://cve.now/CVE-2020-2104.md): Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart. (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-2100](https://cve.now/CVE-2020-2100.md): Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848. (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-2101](https://cve.now/CVE-2020-2101.md): Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets… (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-2102](https://cve.now/CVE-2020-2102.md): Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC. (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-2099](https://cve.now/CVE-2020-2099.md): Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3… (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2013-0161](https://cve.now/CVE-2013-0161.md): Havalite CMS 1.1.7 has a stored XSS vulnerability (no CVSS, Havalite CMS)
- [CVE-2012-5776](https://cve.now/CVE-2012-5776.md): Dokeos 2.1.1 has multiple XSS issues involving "extra\_" parameters in main/auth/profile.php. (no CVSS)
- [CVE-2012-4383](https://cve.now/CVE-2012-4383.md): contao prior to 2.11.4 has a sql injection vulnerability (no CVSS, contao · contao/core)
- [CVE-2020-7965](https://cve.now/CVE-2020-7965.md): flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. (no CVSS, webargs)
- [CVE-2019-20217](https://cve.now/CVE-2019-20217.md): D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method… (no CVSS)
- [CVE-2019-20216](https://cve.now/CVE-2019-20216.md): D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method… (no CVSS)
- [CVE-2019-20215](https://cve.now/CVE-2019-20215.md): D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2020-01-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.