# CVEs published 2020-01-31

51 CVEs were published on January 31, 2020: 0 critical, 1 high. Days are UTC.

- [CVE-2020-8512](https://cve.now/CVE-2020-8512.md): In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter. (no CVSS)
- [CVE-2014-2025](https://cve.now/CVE-2014-2025.md): Unrestricted file upload vulnerability in an unspecified third party tool in United Planet Intrexx Professional before 5.2 Online Update… (no CVSS)
- [CVE-2014-8141](https://cve.now/CVE-2014-8141.md): Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary… (no CVSS, Info-ZIP UnZip)
- [CVE-2014-8140](https://cve.now/CVE-2014-8140.md): Heap-based buffer overflow in the test\_compr\_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary… (no CVSS, Info-ZIP UnZip)
- [CVE-2014-8139](https://cve.now/CVE-2014-8139.md): Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code… (no CVSS, Info-ZIP UnZip)
- [CVE-2014-3809](https://cve.now/CVE-2014-3809.md): Cross-site scripting (XSS) vulnerability in the management interface in Alcatel-Lucent 1830 Photonic Service Switch (PSS) 6.0 and earlier… (no CVSS)
- [CVE-2014-5039](https://cve.now/CVE-2014-5039.md): Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.2 allows remote attackers to inject… (no CVSS)
- [CVE-2014-8338](https://cve.now/CVE-2014-8338.md): Cross-site scripting (XSS) vulnerability in vwrooms/js/jsor-jcarousel/examples/special\_textscroller.php in the VideoWhisper Webcam plugins… (no CVSS)
- [CVE-2013-3565](https://cve.now/CVE-2013-3565.md): Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers… (no CVSS)
- [CVE-2014-8126](https://cve.now/CVE-2014-8126.md): The scheduler in HTCondor before 8.2.6 allows remote authenticated users to execute arbitrary code. (no CVSS, HTCondor)
- [CVE-2015-6815](https://cve.now/CVE-2015-6815.md): The process\_tx\_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a… (no CVSS, QEMU)
- [CVE-2020-8504](https://cve.now/CVE-2020-8504.md): School Management Software PHP/mySQL through 2019-03-14 allows office\_admin/?action=addadmin CSRF to add an administrative user. (no CVSS)
- [CVE-2020-8505](https://cve.now/CVE-2020-8505.md): School Management Software PHP/mySQL through 2019-03-14 allows office\_admin/?action=deleteadmin CSRF to delete a user. (no CVSS)
- [CVE-2014-8322](https://cve.now/CVE-2014-8322.md): Stack-based buffer overflow in the tcp\_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute… (no CVSS)
- [CVE-2014-8321](https://cve.now/CVE-2014-8321.md): Stack-based buffer overflow in the gps\_tracker function in airodump-ng.c in Aircrack-ng before 1.2 RC 1 allows local users to execute… (no CVSS)
- [CVE-2014-5236](https://cve.now/CVE-2014-5236.md): Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before… (no CVSS)
- [CVE-2014-3868](https://cve.now/CVE-2014-3868.md): Multiple SQL injection vulnerabilities in ZeusCart 4.x. (no CVSS)
- [CVE-2014-3119](https://cve.now/CVE-2014-3119.md): Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands… (no CVSS)
- [CVE-2020-8503](https://cve.now/CVE-2020-8503.md): Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 and 6.0.1000 through 6.0.1003 allows Insecure Direct Object Reference (IDOR)… (no CVSS)
- [CVE-2016-2032](https://cve.now/CVE-2016-2032.md): A vulnerability exists in the Aruba AirWave Management Platform 8.x prior to 8.2 in the management interface of an underlying system… (no CVSS)
- [CVE-2019-3016](https://cve.now/CVE-2019-3016.md): In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in… (CVSS 6.2, linux\_kernel)
- [CVE-2019-13000](https://cve.now/CVE-2019-13000.md): Eclair through 0.3 allows attackers to trigger loss of funds because of Incorrect Access Control. (no CVSS)
- [CVE-2019-12999](https://cve.now/CVE-2019-12999.md): Lightning Network Daemon (lnd) before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control. (no CVSS, github.com/lightningnetwork/lnd)
- [CVE-2019-12998](https://cve.now/CVE-2019-12998.md): c-lightning before 0.7.1 allows attackers to trigger loss of funds because of Incorrect Access Control. (no CVSS)
- [CVE-2016-2031](https://cve.now/CVE-2016-2031.md): Multiple vulnerabilities exists in Aruba Instate before 4.1.3.0 and 4.2.3.1 due to insufficient validation of user-supplied input and… (no CVSS)
- [CVE-2014-2843](https://cve.now/CVE-2014-2843.md): Cross-site scripting (XSS) vulnerability in infoware MapSuite MapAPI 1.0.x before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers… (no CVSS)
- [CVE-2020-5234](https://cve.now/CVE-2020-5234.md): Untrusted data can lead to DoS attack in MessagePack for C# and Unity (CVSS 4.8, neuecc MessagePack · neuecc MessagePack.ImmutableCollect… +7)
- [CVE-2013-3489](https://cve.now/CVE-2013-3489.md): Buffer overflow in Media Player Classic - Home Cinema (MPC-HC) before 1.7.0 allows remote attackers to execute arbitrary code via a… (no CVSS, Media Player Classic - Home Cinema)
- [CVE-2013-3488](https://cve.now/CVE-2013-3488.md): Stack-based buffer overflow in Media Player Classic - Home Cinema (MPC-HC) before 1.7.0.7858 allows remote attackers to execute arbitrary… (no CVSS, Media Player Classic - Home Cinema)
- [CVE-2011-4115](https://cve.now/CVE-2011-4115.md): Parallel::ForkManager module before 1.0.0 for Perl does not properly handle temporary files. (no CVSS, Parallel::ForkManager)
- [CVE-2011-4116](https://cve.now/CVE-2011-4116.md): \_is\_safe in the File::Temp module for Perl does not properly handle symlinks. (no CVSS, File::Temp)
- [CVE-2011-4117](https://cve.now/CVE-2011-4117.md): The Batch::BatchRun module 1.03 for Perl does not properly handle temporary files. (no CVSS, Batch::BatchRun)
- [CVE-2011-4088](https://cve.now/CVE-2011-4088.md): ABRT might allow attackers to obtain sensitive information from crash reports. (no CVSS, ABRT)
- [CVE-2019-4720](https://cve.now/CVE-2019-4720.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. (CVSS 7.5, IBM WebSphere Application Server)
- [CVE-2020-8422](https://cve.now/CVE-2020-8422.md): An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. (CVSS 4.3)
- [CVE-2014-4859](https://cve.now/CVE-2014-4859.md): Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows… (no CVSS, Phoenix Technologies SCT3 · American Megatrends Incorporate…)
- [CVE-2014-4860](https://cve.now/CVE-2014-4860.md): Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2… (no CVSS, Phoenix Technologies SCT3 · American Megatrends Incorporate…)
- [CVE-2013-5116](https://cve.now/CVE-2013-5116.md): Evernote prior to 5.5.1 has insecure password change (no CVSS)
- [CVE-2013-5113](https://cve.now/CVE-2013-5113.md): LastPass prior to 2.5.1 has an insecure PIN implementation. (no CVSS)
- [CVE-2013-5114](https://cve.now/CVE-2013-5114.md): LastPass prior to 2.5.1 allows secure wipe bypass. (no CVSS)
- [CVE-2013-5112](https://cve.now/CVE-2013-5112.md): Evernote before 5.5.1 has insecure PIN storage (no CVSS)
- [CVE-2019-19550](https://cve.now/CVE-2019-19550.md): Remote Authentication Bypass in Senior Rubiweb 6.2.34.28 and 6.2.34.37 allows admin access to sensitive information of affected users… (no CVSS)
- [CVE-2020-8440](https://cve.now/CVE-2020-8440.md): controllers/page\_apply.php in Simplejobscript.com SJS through 1.66 is prone to unauthenticated Remote Code Execution by uploading a PHP… (no CVSS)
- [CVE-2013-3322](https://cve.now/CVE-2013-3322.md): NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to inject arbitrary commands in the Halt/Reboot interface. (no CVSS)
- [CVE-2020-7956](https://cve.now/CVE-2020-7956.md): HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC… (no CVSS, github.com/hashicorp/nomad)
- [CVE-2020-7219](https://cve.now/CVE-2020-7219.md): HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to… (no CVSS, github.com/hashicorp/consul)
- [CVE-2020-7218](https://cve.now/CVE-2020-7218.md): HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to… (no CVSS, github.com/hashicorp/nomad)
- [CVE-2020-7955](https://cve.now/CVE-2020-7955.md): HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential… (no CVSS, github.com/hashicorp/consul)
- [CVE-2020-7914](https://cve.now/CVE-2020-7914.md): In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file read operations over the network. (no CVSS)
- [CVE-2020-5526](https://cve.now/CVE-2020-5526.md): The AWMS Mobile App for Android 2.0.0 to 2.0.5 and for iOS 2.0.0 to 2.0.8 does not verify X.509 certificates from servers, which allows… (no CVSS, Fuji Xerox Co. AWMS Mobile App)
- [CVE-2019-18913](https://cve.now/CVE-2019-18913.md): A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks. (no CVSS, HP Intel-based Business PCs that support Microsoft Windows…)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2020-01-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.