CVEs published February 12, 2020
117 CVEs were published on February 12, 2020: 0 critical, 7 high. Browse them by severity, product and exploitation status.
- Published
- 117
- Critical
- 0
- High
- 7
- Medium
- 16
- Low
- 1
- Unrated
- 93
- Now in CISA KEV
- 0
- Fix available
- 29
Most affected products
- Jenkins project Jenkins Pipeline GitHub Notify Step Plugin…
- 3
- Atlassian Jira Server
- 2
- Digi International ConnectPort LTS 32 MEI
- 2
- Google Android
- 2
- Jenkins project Jenkins Git Parameter Plugin · org.jenkins-…
- 2
- Jenkins project Jenkins Harvest SCM Plugin · org.jenkins-ci…
- 2
- LinuxKI
- 2
- SAP SE SAP Host Agent
- 2
- SAP SE SAP Landscape Management
- 2
- SAP SE SAP NetWeaver
- 2
High 7
- CVE-2020-5241XSS/Script injection vulnerability in matestackmatestack-ui-core
- CVE-2020-1977Expedition Migration Tool: Insufficient Cross Site Request Forgery protection.Palo Alto Networks Expedition
- CVE-2020-5399CredHub does not properly enable TLS for MySQL database connectionsCloud Foundry CredHub
- CVE-2020-6186SAP Host Agent, version 7.21, allows an attacker to cause a slowdown in processing of username/password-based authentication requests of…SAP SE SAP Host Agent
- CVE-2020-6191SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in…SAP SE SAP Landscape Management
- CVE-2020-6192SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP…SAP SE SAP Landscape Management
- CVE-2020-7046lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as…
Medium, low and unrated 110
- CVE-2018-3987An exploitable information disclosure vulnerability exists in the 'Secret Chats' functionality of Rakuten Viber on Android 9.3.0.6.Rakuten Viber
- CVE-2019-5322A remotely exploitable information disclosure vulnerability is present in Aruba Intelligent Edge Switch models 5400, 3810, 2920, 2930…Aruba Intelligent Edge Switch 5400 3810 2920 2930 2530 with…
- CVE-2020-7209LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.LinuxKI
- CVE-2020-7208LinuxKI v6.0-1 and earlier is vulnerable to an XSS which is resolved in release 6.0-2.LinuxKI
- CVE-2019-18915A potential security vulnerability has been identified with certain versions of HP System Event Utility prior to version 1.4.33.HP System Event Utility
- CVE-2020-6973Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2.Digi International ConnectPort LTS 32 MEI
- CVE-2020-6975Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2.Digi International ConnectPort LTS 32 MEI
- CVE-2020-1976GlobalProtect on MacOS: Local denial-of-service (DoS) vulnerability.Palo Alto Networks GlobalProtect
- CVE-2020-1975Missing XML Validation in PAN-OS Web InterfacePalo Alto Networks PAN-OS
- CVE-2020-8955irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer…
- CVE-2013-6022A Cross-Site Scripting (XSS) vulnerability exists in Tiki Wiki CMG Groupware 11.0 via the id paraZeroClipboard.swf, which could let a…Tiki
- CVE-2013-5106A Code Execution vulnerability exists in select.py when using python-mode 2012-12-19.
- CVE-2013-4602A Denial of Service (infinite loop) vulnerability exists in Avira AntiVir Engine before 8.2.12.58 via an unspecified function in the PDF…
- CVE-2011-4908TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.Joomla! TinyBrowser Plugin
- CVE-2011-4906Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.Joomla! Tiny browser included with TinyMCE
- CVE-2020-8950The AUEPLauncher service in Radeon AMD User Experience Program Launcher through 1.0.0.1 on Windows allows elevation of privilege by…
- CVE-2020-6185Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51…SAP SE SAP NetWeaver · SAP SE SAP S/4HANA
- CVE-2020-6181Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform…SAP SE SAP NetWeaver · SAP SE SAP ABAP Platform
- CVE-2020-6183SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to…SAP SE SAP Host Agent
- CVE-2020-6184Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51…SAP SE Automated Note Search Tool
- CVE-2020-6188VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP…SAP SE SAP ERP · SAP SE SAP S/4 HANA
- CVE-2020-6190Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable…SAP SE SAP NetWeaver AS Java
- CVE-2020-6189Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give…SAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6187SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input…SAP SE SAP NetWeaver
- CVE-2020-6177SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to…SAP SE SAP Mobile Platform
Show all 110 entriesShow fewer entries
- CVE-2020-6193SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to execute malicious…SAP SE SAP NetWeaver
- CVE-2011-3901Android SQLite Journal before 4.0.1 has an information disclosure vulnerability.Google Android
- CVE-2011-3336regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion.Apple macOS
- CVE-2011-2499Mambo CMS through 4.6.5 has multiple XSS.Mambo CMS
- CVE-2011-2343The Bluetooth stack in Android before 2.3.6 allows a physically proximate attacker to obtain contact information via an AT phonebook…Google Android
- CVE-2020-8949Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000…
- CVE-2011-4338Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman.shaman
- CVE-2019-19192The Bluetooth Low Energy implementation on STMicroelectronics BLE Stack through 1.3.1 for STM32WB5x devices does not properly handle…
- CVE-2013-3725Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution.
- CVE-2019-17519The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload…
- CVE-2019-16336The Bluetooth Low Energy implementation in Cypress PSoC 4 BLE component 3.61 and earlier processes data channel frames with a payload…
- CVE-2014-3860Xilisoft Video Converter Ultimate 7.8.1 build-20140505 has a DLL Hijacking vulnerability
- CVE-2020-8947functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the…
- CVE-2013-7286MobileIron VSP < 5.9.1 and Sentry < 5.0 has a weak password obfuscation algorithm
- CVE-2020-8946Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the…
- CVE-2019-11867Realtek NDIS driver rt640x64.sys, file version 10.1.505.2015, fails to do any size checking on an input buffer from user space, which the…
- CVE-2020-8945The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by…github.com/proglottis/gpgme
- CVE-2012-0951A Memory Corruption Vulnerability exists in NVIDIA Graphics Drivers 29549 due to an unknown function in the file…NVIDIA graphics drivers
- CVE-2020-7957The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the…
- CVE-2011-4661A memory leak vulnerability exists in Cisco IOS before 15.2(1)T due to a memory leak in the HTTP PROXY Server process (aka CSCtu52820)…Cisco IOS
- CVE-2019-4741IBM Content Navigator 3.0CD is vulnerable to Server Side Request Forgery (SSRF).IBM Content Navigator
- CVE-2019-4431IBM Rational Publishing Engine 6.0.6 and 6.0.6.1 is vulnerable to cross-site scripting.IBM Rational Publishing Engine
- CVE-2019-4427IBM Cloud CLI 0.6.0 through 0.16.1 windows installers are signed using SHA1 certificate.IBM Cloud CLI
- CVE-2013-2637A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via…
- CVE-2013-6681Tube Map Live Underground for Android before 3.0.22 has an Information Disclosure Vulnerability
- CVE-2013-6236IZON IP 2.0.2: hard-coded password vulnerability
- CVE-2013-3685A Privilege Escalation Vulnerability exists in Sprite Software Spritebud 1.3.24 and 1.3.28 and Backup 2.5.4105 and 2.5.4108 on LG Android…
- CVE-2013-1924Commerce Skrill (Formerly Moneybookers) has an Access bypass vulnerability in all versions prior to 7.x-1.2Commerce Skrill
- CVE-2013-4395Simple Machines Forum (SMF) through 2.0.5 has XSSSMF
- CVE-2013-3494A Code Execution Vulnerability exists in UMPlayer 0.98 in wintab32.dll due to insufficient path restrictions when loading external…UMPlayer
- CVE-2013-4090Varnish HTTP cache before 3.0.4: ACL bug
- CVE-2013-2097ZPanel through 10.1.0 has Remote Command ExecutionZPanel
- CVE-2013-1938Zimbra 2013 has XSS in aspell.phpZimbra
- CVE-2013-1410Perforce P4web 2011.1 and 2012.1 has multiple XSS vulnerabilities
- CVE-2015-7890Multiple buffer overflows in the esa_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung S6 Edge, allow…
- CVE-2013-2010WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution VulnerabilityW3 Total Cache Plugin authors W3 Total Cache Plugin
- CVE-2020-8839Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cgi TF_submask field.
- CVE-2020-8815Improper connection handling in the base connection handler in IKTeam BearFTP before v0.3.1 allows a remote attacker to achieve denial of…
- CVE-2020-2133Jenkins Applatix Plugin 1.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed…Jenkins project Jenkins Applatix Plugin · com.applatix.jenk…
- CVE-2020-2130Jenkins Harvest SCM Plugin 0.5.1 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it…Jenkins project Jenkins Harvest SCM Plugin · org.jenkins-ci…
- CVE-2020-2131Jenkins Harvest SCM Plugin 0.5.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins master where they can be…Jenkins project Jenkins Harvest SCM Plugin · org.jenkins-ci…
- CVE-2020-2132Jenkins Parasoft Environment Manager Plugin 2.14 and earlier stores a password unencrypted in job config.xml files on the Jenkins master…Jenkins project Jenkins Parasoft Environment Manager Plugin…
- CVE-2020-2128Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where…Jenkins project Jenkins ECX Copy Data Management Plugin · c…
- CVE-2020-2129Jenkins Eagle Tester Plugin 1.0.9 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where…Jenkins project Jenkins Eagle Tester Plugin · com.mobileene…
- CVE-2020-2125Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the…Jenkins project Jenkins Debian Package Builder Plugin · ru.…
- CVE-2020-2126Jenkins DigitalOcean Plugin 1.1 and earlier stores a token unencrypted in the global config.xml file on the Jenkins master where it can be…Jenkins project Jenkins DigitalOcean Plugin · com.dubture.j…
- CVE-2020-2127Jenkins BMC Release Package and Deployment Plugin 1.1 and earlier stores credentials unencrypted in its global configuration file on the…Jenkins project Jenkins BMC Release Package and Deployment…
- CVE-2020-2123Jenkins RadarGun Plugin 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a…Jenkins project Jenkins RadarGun Plugin · org.jenkins-ci.pl…
- CVE-2020-2124Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins…Jenkins project Jenkins Dynamic Extended Choice Parameter P…
- CVE-2020-2121Jenkins Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary…Jenkins project Jenkins Google Kubernetes Engine Plugin · o…
- CVE-2020-2122Jenkins Brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored…Jenkins project Jenkins Brakeman Plugin · org.jenkins-ci.pl…
- CVE-2020-2118A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with…Jenkins project Jenkins Pipeline GitHub Notify Step Plugin…
- CVE-2020-2119Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form…Jenkins project Jenkins Azure AD Plugin · org.jenkins-ci.pl…
- CVE-2020-2120Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins FitNesse Plugin · org.jenkins-ci.pl…
- CVE-2020-2116A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to…Jenkins project Jenkins Pipeline GitHub Notify Step Plugin…
- CVE-2020-2117A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission…Jenkins project Jenkins Pipeline GitHub Notify Step Plugin…
- CVE-2020-2114Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration…Jenkins project Jenkins S3 publisher Plugin · org.jenkins-c…
- CVE-2020-2115Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins NUnit Plugin · org.jenkins-ci.plugi…
- CVE-2020-2111Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation…Jenkins project Jenkins Subversion Plugin · org.jenkins-ci.…
- CVE-2020-2112Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site…Jenkins project Jenkins Git Parameter Plugin · org.jenkins-…
- CVE-2020-2113Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site…Jenkins project Jenkins Git Parameter Plugin · org.jenkins-…
- CVE-2020-2109Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in…Jenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…
- CVE-2020-2110Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by…Jenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2015-5617SQL injection vulnerability in pub/m_pending_news/delete_pending_news.jsp in Enorth Webpublisher CMS allows remote attackers to execute…
- CVE-2013-7381libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to…libnotify
- CVE-2019-19194The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for…
- CVE-2019-19196The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for…
- CVE-2020-8595Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass.
- CVE-2019-20100The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF).Atlassian Application Links · Atlassian Jira Server
- CVE-2019-20099The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site…Atlassian Jira Server
- CVE-2019-20098The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to…Atlassian Jira Server
- CVE-2013-7378scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.hubot-scripts
- CVE-2014-4607Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers…
- CVE-2009-5139The SIP implementation on the Gizmo5 software phone provides hashed credentials in a response to an invalid authentication challenge…
- CVE-2009-5140The SIP implementation on the Linksys SPA2102 phone adapter provides hashed credentials in a response to an invalid authentication…
- CVE-2014-2560The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, which makes it easier…
- CVE-2012-0810The int3 handler in the Linux kernel before 3.3 relies on a per-CPU debug stack, which allows local users to cause a denial of service…Linux Foundation Linux kernel
- CVE-2015-7508Heap-based buffer overflow in the bmp_decode_rle function in libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a…Libnsbmp
- CVE-2014-8128LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attackers to cause a…LibTIFF
- CVE-2014-9390Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial…mercurial · org.eclipse.jgit:org.eclipse.jgit
- CVE-2014-6262Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other products, allow…
- CVE-2014-2595Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent…
- CVE-2014-4968The WebView class and use of the WebView.addJavascriptInterface method in the Boat Browser application 8.0 and 8.0.1 for Android allow…
- CVE-2014-0234The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account…Red Hat OpenShift Enterprise
- CVE-2019-19921runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go.github.com/opencontainers/runc