# CVEs published 2020-02-14

34 CVEs were published on February 14, 2020: 2 critical, 1 high. Days are UTC.

- [CVE-2020-8128](https://cve.now/CVE-2020-8128.md): An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute… (no CVSS, jsreport)
- [CVE-2019-15594](https://cve.now/CVE-2019-15594.md): GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request… (no CVSS, GitLab)
- [CVE-2020-8129](https://cve.now/CVE-2020-8129.md): An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code. (no CVSS, script-manager)
- [CVE-2019-15592](https://cve.now/CVE-2019-15592.md): GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID… (no CVSS, GitLab)
- [CVE-2019-5187](https://cve.now/CVE-2019-5187.md): An exploitable out-of-bounds write vulnerability exists in the TIFreadstripdata function of the igcore19d.dll library of Accusoft… (CVSS 9.8, Accusoft)
- [CVE-2020-6068](https://cve.now/CVE-2020-6068.md): An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll PNG pngread parser of the Accusoft ImageGear 19.5.0 library. (CVSS 9.8, Accusoft)
- [CVE-2019-4392](https://cve.now/CVE-2019-4392.md): HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized… (no CVSS, IBM HCL AppScan Standard Edition)
- [CVE-2019-13967](https://cve.now/CVE-2019-13967.md): iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) via many requests to launch a compile… (no CVSS)
- [CVE-2019-13966](https://cve.now/CVE-2019-13966.md): In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard. (no CVSS)
- [CVE-2019-13965](https://cve.now/CVE-2019-13965.md): Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via the param\_file… (no CVSS)
- [CVE-2013-4211](https://cve.now/CVE-2013-4211.md): A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a… (no CVSS, OpenX Ad Server)
- [CVE-2020-8594](https://cve.now/CVE-2020-8594.md): The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja\_forms\[recaptcha\_site\_key\]… (no CVSS)
- [CVE-2020-8843](https://cve.now/CVE-2020-8843.md): An issue was discovered in Istio 1.3 through 1.3.6. (no CVSS)
- [CVE-2020-8612](https://cve.now/CVE-2020-8612.md): In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious… (no CVSS)
- [CVE-2020-8611](https://cve.now/CVE-2020-8611.md): In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in… (no CVSS)
- [CVE-2019-11215](https://cve.now/CVE-2019-11215.md): In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by… (no CVSS)
- [CVE-2019-6195](https://cve.now/CVE-2019-6195.md): An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a… (CVSS 4.8, Lenovo XClarity Controller)
- [CVE-2019-6194](https://cve.now/CVE-2019-6194.md): An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that… (CVSS 5.7, Lenovo XClarity Administrator)
- [CVE-2019-6193](https://cve.now/CVE-2019-6193.md): An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow… (CVSS 7.5, Lenovo XClarity Administrator)
- [CVE-2019-6190](https://cve.now/CVE-2019-6190.md): Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All… (CVSS 5.0, Lenovo BIOS)
- [CVE-2019-19758](https://cve.now/CVE-2019-19758.md): A vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1.406.34763 and prior could allow an… (CVSS 6.1, Lenovo EZ Media & Backup Center ix2 · Lenovo EZ Media & Bac…)
- [CVE-2019-19757](https://cve.now/CVE-2019-19757.md): An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site… (CVSS 5.4, Lenovo XClarity Administrator)
- [CVE-2019-19879](https://cve.now/CVE-2019-19879.md): HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions. (no CVSS)
- [CVE-2019-20045](https://cve.now/CVE-2019-20045.md): The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. (no CVSS)
- [CVE-2019-20046](https://cve.now/CVE-2019-20046.md): The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. (no CVSS)
- [CVE-2018-21032](https://cve.now/CVE-2018-21032.md): A vulnerability in Hitachi Command Suite prior to 8.7.1-00 and Hitachi Automation Director prior to 8.5.0-00 allow authenticated remote… (CVSS 4.3)
- [CVE-2018-21033](https://cve.now/CVE-2018-21033.md): A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director prior to 8.6.2-00 and Hitachi Infrastructure… (CVSS 5.0)
- [CVE-2019-20455](https://cve.now/CVE-2019-20455.md): Gateways/Gateway.php in Heartland & Global Payments PHP SDK before 2.0.0 does not enforce SSL certificate validations. (no CVSS, globalpayments/php-sdk)
- [CVE-2020-7251](https://cve.now/CVE-2020-7251.md): ESConfig Tool able to edit configuration for newer version (CVSS 5.0, Mcafee Endpoint Security)
- [CVE-2020-5532](https://cve.now/CVE-2020-5532.md): ilbo App (ilbo App for Android prior to version 1.1.8 and ilbo App for iOS prior to version 1.2.01) allows an attacker on the same network… (no CVSS, EXTRUN ilbo App)
- [CVE-2020-8991](https://cve.now/CVE-2020-8991.md): vg\_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running… (no CVSS)
- [CVE-2020-8992](https://cve.now/CVE-2020-8992.md): ext4\_protect\_reserved\_inode in fs/ext4/block\_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service… (no CVSS)
- [CVE-2016-2338](https://cve.now/CVE-2016-2338.md): An exploitable heap overflow vulnerability exists in the Psych::Emitter start\_document function of Ruby. (no CVSS)
- [CVE-2019-20454](https://cve.now/CVE-2019-20454.md): An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \\X is JIT compiled and used to match specially crafted subjects… (CVSS 5.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2020-02-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.