# CVEs published 2020-02-05

65 CVEs were published on February 5, 2020: 1 critical, 8 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2011-1597](https://cve.now/CVE-2011-1597.md): OpenVAS Manager v2.0.3 allows plugin remote code execution. (no CVSS, OpenVAS Manager)
- [CVE-2011-1517](https://cve.now/CVE-2011-1517.md): SAP NetWeaver 7.0 allows Remote Code Execution and Denial of Service caused by an error in the DiagTraceHex() function. (no CVSS)
- [CVE-2011-1151](https://cve.now/CVE-2011-1151.md): Joomla! 1.6.0 is vulnerable to SQL Injection via the filter\_order and filer\_order\_Dir parameters. (no CVSS, Joomla!)
- [CVE-2011-1150](https://cve.now/CVE-2011-1150.md): bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter. (no CVSS, bbPress · bbpress/bbpress)
- [CVE-2020-8644](https://cve.now/CVE-2020-8644.md): PlaySMS before 1.4.3 does not sanitize inputs from a malicious string. (CVSS 9.8, KEV)
- [CVE-2013-2682](https://cve.now/CVE-2013-2682.md): Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain sensitive… (no CVSS)
- [CVE-2013-2681](https://cve.now/CVE-2013-2681.md): Cisco Linksys E4200 1.0.05 Build 7 devices contain a Security Bypass Vulnerability which could allow remote attackers to gain unauthorized… (no CVSS)
- [CVE-2013-2680](https://cve.now/CVE-2013-2680.md): Cisco Linksys E4200 1.0.05 Build 7 devices store passwords in cleartext allowing remote attackers to obtain sensitive information. (no CVSS)
- [CVE-2011-1069](https://cve.now/CVE-2011-1069.md): PHPShop through 0.8.1 has XSS. (no CVSS, PHPShop)
- [CVE-2011-1009](https://cve.now/CVE-2011-1009.md): Vanilla Forums 2.0.17.1 through 2.0.17.5 has XSS in /vanilla/index.php via the p parameter. (no CVSS, Vanilla Forums)
- [CVE-2020-6854](https://cve.now/CVE-2020-6854.md): A cross-site scripting (XSS) vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to inject… (no CVSS)
- [CVE-2011-0525](https://cve.now/CVE-2011-0525.md): Batavi before 1.0 has CSRF. (no CVSS, Batavi)
- [CVE-2020-8641](https://cve.now/CVE-2020-8641.md): Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page\_slug parameter. (no CVSS)
- [CVE-2019-20173](https://cve.now/CVE-2019-20173.md): The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php. (no CVSS)
- [CVE-2011-0220](https://cve.now/CVE-2011-0220.md): Apple Bonjour before 2011 allows a crash via a crafted multicast DNS packet. (no CVSS, Apple Bonjour)
- [CVE-2010-5304](https://cve.now/CVE-2010-5304.md): A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. (no CVSS)
- [CVE-2019-20447](https://cve.now/CVE-2019-20447.md): Jobberbase 2.0 has SQL injection via the PATH\_INFO to the jobs-in endpoint. (no CVSS)
- [CVE-2010-4815](https://cve.now/CVE-2010-4815.md): Coppermine gallery before 1.4.26 has an input validation vulnerability that allows for code execution. (no CVSS, coppermine gallery)
- [CVE-2015-5626](https://cve.now/CVE-2015-5626.md): Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry… (no CVSS, Yokogawa CENTUM CS · Yokogawa CENTUM VP +16)
- [CVE-2015-5628](https://cve.now/CVE-2015-5628.md): Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry… (no CVSS, Yokogawa CENTUM CS · Yokogawa CENTUM VP +16)
- [CVE-2015-5627](https://cve.now/CVE-2015-5627.md): Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry… (no CVSS, Yokogawa CENTUM CS · Yokogawa CENTUM VP +16)
- [CVE-2010-4662](https://cve.now/CVE-2010-4662.md): PmWiki before 2.2.21 has XSS. (no CVSS, pmwiki)
- [CVE-2020-3120](https://cve.now/CVE-2020-3120.md): Cisco FXOS, IOS XR, and NX-OS Software Cisco Discovery Protocol Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XR Software)
- [CVE-2020-3149](https://cve.now/CVE-2020-3149.md): Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Identity Services Engine Software)
- [CVE-2020-3119](https://cve.now/CVE-2020-3119.md): Cisco NX-OS Software Cisco Discovery Protocol Remote Code Execution Vulnerability (CVSS 8.8, Cisco Unified Computing System)
- [CVE-2020-3118](https://cve.now/CVE-2020-3118.md): Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability (CVSS 8.8, KEV, Cisco IOS XR Software)
- [CVE-2020-3111](https://cve.now/CVE-2020-3111.md): Cisco IP Phone Remote Code Execution and Denial of Service Vulnerability (CVSS 8.8, Cisco IP phone)
- [CVE-2020-3110](https://cve.now/CVE-2020-3110.md): Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execution and Denial of Service Vulnerability (CVSS 8.8, Cisco Video Surveillance 8000 Series IP Cameras)
- [CVE-2013-2675](https://cve.now/CVE-2013-2675.md): Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could allow remote… (no CVSS)
- [CVE-2020-3123](https://cve.now/CVE-2020-3123.md): A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an… (CVSS 7.5, Cisco ClamAV)
- [CVE-2019-15253](https://cve.now/CVE-2019-15253.md): Cisco Digital Network Architecture Center Stored Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Digital Network Architecture Center)
- [CVE-2015-0102](https://cve.now/CVE-2015-0102.md): IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote… (no CVSS, IBM Workflow for Bluemix)
- [CVE-2020-6833](https://cve.now/CVE-2020-6833.md): An issue was discovered in GitLab EE 11.3 and later. (no CVSS)
- [CVE-2019-15126](https://cve.now/CVE-2019-15126.md): An issue was discovered on Broadcom Wi-Fi client devices. (no CVSS)
- [CVE-2020-6754](https://cve.now/CVE-2020-6754.md): dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. (no CVSS)
- [CVE-2019-12180](https://cve.now/CVE-2019-12180.md): An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. (no CVSS)
- [CVE-2019-11516](https://cve.now/CVE-2019-11516.md): An issue was discovered in the Bluetooth component of the Cypress (formerly owned by Broadcom) Wireless IoT codebase. (no CVSS)
- [CVE-2020-7966](https://cve.now/CVE-2020-7966.md): GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal. (no CVSS)
- [CVE-2020-7967](https://cve.now/CVE-2020-7967.md): GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2). (no CVSS)
- [CVE-2020-7968](https://cve.now/CVE-2020-7968.md): GitLab EE 8.0 through 12.7.2 has Incorrect Access Control. (no CVSS)
- [CVE-2020-7969](https://cve.now/CVE-2020-7969.md): GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure. (no CVSS)
- [CVE-2020-7971](https://cve.now/CVE-2020-7971.md): GitLab EE 11.0 and later through 12.7.2 allows XSS. (no CVSS)
- [CVE-2020-7972](https://cve.now/CVE-2020-7972.md): GitLab EE 12.2 has Insecure Permissions (issue 2 of 2). (no CVSS)
- [CVE-2020-7973](https://cve.now/CVE-2020-7973.md): GitLab through 12.7.2 allows XSS. (no CVSS)
- [CVE-2020-7974](https://cve.now/CVE-2020-7974.md): GitLab EE 10.1 through 12.7.2 allows Information Disclosure. (no CVSS)
- [CVE-2020-6174](https://cve.now/CVE-2020-6174.md): TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature. (no CVSS, tuf)
- [CVE-2020-7976](https://cve.now/CVE-2020-7976.md): GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control. (no CVSS)
- [CVE-2013-0507](https://cve.now/CVE-2013-0507.md): IBM InfoSphere Information Server 8.1, 8.5, 8.7, 9.1 has a Session Fixation Vulnerability (no CVSS, IBM InfoSphere Information Server)
- [CVE-2020-7977](https://cve.now/CVE-2020-7977.md): GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions. (no CVSS)
- [CVE-2020-7978](https://cve.now/CVE-2020-7978.md): GitLab EE 12.6 and later through 12.7.2 allows Denial of Service. (no CVSS)
- [CVE-2019-4670](https://cve.now/CVE-2019-4670.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper… (CVSS 6.5, IBM WebSphere Application Server)
- [CVE-2019-4616](https://cve.now/CVE-2019-4616.md): IBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or session cookies. (CVSS 4.3, IBM Cloud Automation Manager)
- [CVE-2019-4613](https://cve.now/CVE-2019-4613.md): IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized… (CVSS 4.3, IBM Planning Analytics)
- [CVE-2020-8506](https://cve.now/CVE-2020-8506.md): The Global TV application 2.3.2 for Android and 4.7.5 for iOS sends Unencrypted Analytics. (no CVSS)
- [CVE-2019-16204](https://cve.now/CVE-2019-16204.md): Brocade Fabric OS Versions before v7.4.2f, v8.2.2a, v8.1.2j and v8.2.1d could expose external passwords, common secrets or authentication… (no CVSS, Brocade Fabric OS)
- [CVE-2019-16203](https://cve.now/CVE-2019-16203.md): Brocade Fabric OS Versions before v8.2.2a and v8.2.1d could expose the credentials of the remote ESRS server when these credentials are… (no CVSS, Brocade Fabric OS)
- [CVE-2020-8507](https://cve.now/CVE-2020-8507.md): The Citytv Video application 4.08.0 for Android and 3.35 for iOS sends Unencrypted Analytics. (no CVSS)
- [CVE-2020-6969](https://cve.now/CVE-2020-6969.md): It is possible to unmask credentials and other sensitive information on “unprotected” project files, which may allow an attacker to… (no CVSS, C-More Touch Panels EA9 series)
- [CVE-2020-7979](https://cve.now/CVE-2020-7979.md): GitLab EE 8.9 and later through 12.7.2 has Insecure Permission (no CVSS)
- [CVE-2020-8114](https://cve.now/CVE-2020-8114.md): GitLab EE 8.9 and later through 12.7.2 has Insecure Permission (no CVSS)
- [CVE-2020-7216](https://cve.now/CVE-2020-7216.md): An ni\_dhcp4\_parse\_response memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by… (no CVSS)
- [CVE-2020-5208](https://cve.now/CVE-2020-5208.md): remote code execution vulnerability in ipmitool (CVSS 7.7, ipmitool)
- [CVE-2020-5237](https://cve.now/CVE-2020-5237.md): Relative Path Traversal in oneup/uploader-bundle (CVSS 8.8, 1up-lab oneup/uploader-bundle · oneup/uploader-bundle)
- [CVE-2020-8632](https://cve.now/CVE-2020-8632.md): In cloud-init through 19.4, rand\_user\_password in cloudinit/config/cc\_set\_passwords.py has a small default pwlen value, which makes it… (no CVSS)
- [CVE-2020-8631](https://cve.now/CVE-2020-8631.md): cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2020-02-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.