CVEs published February 19, 2020
61 CVEs were published on February 19, 2020: 1 critical, 7 high. 1 is now in CISA KEV.
- Published
- 61
- Critical
- 1
- High
- 7
- Medium
- 17
- Low
- 0
- Unrated
- 36
- Now in CISA KEV
- 1
- Fix available
- 7
Most affected products
- IBM DB2 for Linux- UNIX and Windows
- 5
- Cisco Data Center Network Manager
- 3
- VMWare vRealize Operations for Horizon Adapter
- 3
- CoTURN
- 2
- BOINC
- 1
- Cisco AnyConnect Secure Mobility Client
- 1
- Cisco ASA
- 1
- Cisco Cloud Web Security
- 1
- Cisco Email Security Appliance
- 1
- Cisco Finesse
- 1
Critical 1
High 7
- CVE-2019-1950Cisco IOS XE SD-WAN Software Default Credentials VulnerabilityCisco IOS XE SD-WAN Software
- CVE-2020-3112Cisco Data Center Network Manager Privilege Escalation VulnerabilityCisco Data Center Network Manager
- CVE-2020-3114Cisco Data Center Network Manager Cross-Site Request Forgery VulnerabilityCisco Data Center Network Manager
- CVE-2020-6061An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests.CoTURN
- CVE-2019-17333TIBCO EBX Exposes Cross-Site Scripting VulnerabilityTIBCO Software TIBCO EBX
- CVE-2020-4204IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow…IBM DB2 for Linux- UNIX and Windows
- CVE-2020-4135IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated user to…IBM DB2 for Linux- UNIX and Windows
Medium, low and unrated 53
- CVE-2013-2018Multiple SQL injection vulnerabilities in BOINC allow remote attackers to execute arbitrary SQL commands via unspecified vectors.BOINC
- CVE-2020-7942Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a…Puppet
- CVE-2015-7747Buffer overflow in the afReadFrames function in audiofile (aka libaudiofile and Audio File Library) allows user-assisted remote attackers…
- CVE-2020-6970A Heap-based Buffer Overflow was found in Emerson OpenEnterprise SCADA Server 2.83 (if Modbus or ROC Interfaces have been installed and…Emerson OpenEnterprise SCADA Server · Emerson OpenEnterprise
- CVE-2020-3943vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) uses a JMX RMI service which is not securely…VMWare vRealize Operations for Horizon Adapter
- CVE-2020-3944vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) has an improper trust store configuration leading…VMWare vRealize Operations for Horizon Adapter
- CVE-2020-3945vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) contains an information disclosure vulnerability…VMWare vRealize Operations for Horizon Adapter
- CVE-2014-9617Open redirect vulnerability in remotereporter/load_logfiles.php in Netsweeper before 4.0.5 allows remote attackers to redirect users to…
- CVE-2014-9615Cross-site scripting (XSS) vulnerability in Netsweeper 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url…
- CVE-2014-9614The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote…
- CVE-2014-9613Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote attackers to execute arbitrary SQL commands via the (1)…
- CVE-2014-9612SQL injection vulnerability in remotereporter/load_logfiles.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2…
- CVE-2014-9609Directory traversal vulnerability in webadmin/reporter/view_server_log.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x…
- CVE-2014-9608Cross-site scripting (XSS) vulnerability in webadmin/policy/group_table_ajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and…
- CVE-2014-9607Cross-site scripting (XSS) vulnerability in remotereporter/load_logfiles.php in Netsweeper 4.0.3 and 4.0.4 allows remote attackers to…
- CVE-2014-9606Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote…
- CVE-2020-3113Cisco Data Center Network Manager Stored Cross-Site Scripting VulnerabilityCisco Data Center Network Manager
- CVE-2020-3132Cisco Email Security Appliance Shortened URL Denial of Service VulnerabilityCisco Email Security Appliance
- CVE-2020-3138Cisco Enterprise NFV Infrastructure Software Remote Code Execution Vulnerability
- CVE-2020-3153Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path VulnerabilityCisco AnyConnect Secure Mobility Client
- CVE-2020-3154Cisco Cloud Web Security SQL Injection VulnerabilityCisco Cloud Web Security
- CVE-2020-3156Cisco Identity Services Engine Cross-Site Scripting VulnerabilityCisco Identity Services Engine Software
- CVE-2020-3159Cisco Finesse Web-Based Management Interface Cross-Site Scripting VulnerabilityCisco Finesse
- CVE-2020-3160Cisco Meeting Server Extensible Messaging and Presence Protocol Denial of Service VulnerabilityCisco Meeting Server
- CVE-2020-3163Cisco Unified Contact Center Enterprise Denial of Service VulnerabilityCisco Unified Contact Center Enterprise
Show all 53 entriesShow fewer entries
- CVE-2020-6062An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests.CoTURN
- CVE-2019-10797Netty in WSO2 transport-http before v6.3.1 is vulnerable to HTTP Response Splitting due to HTTP Header validation being disabled.Snyk WSO2 transport-http · org.wso2.transport.http:org.wso2…
- CVE-2012-0055OverlayFS in the Linux kernel before 3.0.0-16.28, as used in Ubuntu 10.0.4 LTS and 11.10, is missing inode security checks which could…Linux kernel OverlayFS
- CVE-2019-12246SilverStripe through 4.3.3 allows a Denial of Service on flush and development URL tools.silverstripe/framework
- CVE-2019-12437In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,silverstripe/graphql
- CVE-2020-8441JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function.org.jyaml:jyaml
- CVE-2020-8959Western Digital WesternDigitalSSDDashboardSetup.exe before 3.0.2.0 allows DLL Hijacking.
- CVE-2020-8824Hitron CODA-4582U 7.1.1.30 devices allow XSS via a Managed Device name on the Wireless > Access Control > Add Managed Device screen.
- CVE-2020-4230IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 and 11.5 is vulnerable to an escalation of privilege when an…IBM DB2 for Linux- UNIX and Windows
- CVE-2020-4200IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated attacker to send…IBM DB2 for Linux- UNIX and Windows
- CVE-2020-4161IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 could allow an authenticated attacker to cause a denial of service…IBM DB2 for Linux- UNIX and Windows
- CVE-2019-4640IBM Security Secret Server 10.7 processes patches, image backups and other updates without sufficiently verifying the origin and integrity…IBM Security Secret Server
- CVE-2019-4457IBM Jazz Foundation 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 could allow an authenticated user to obtain sensitive…IBM Rational Rhapsody Design Manager
- CVE-2019-4429IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting.IBM Maximo Asset Management
- CVE-2012-6685Nokogiri before 1.5.4 is vulnerable to XXE attacksnokogiri
- CVE-2012-1932A cross-site scripting (XSS) vulnerability in Wolf CMS 0.75 and earlier allows remote attackers to inject arbitrary web script or HTML via…
- CVE-2012-6614D-Link DSR-250N devices before 1.08B31 allow remote authenticated users to obtain "persistent root access" via the BusyBox CLI, as…
- CVE-2014-2727The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection.
- CVE-2014-2228The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML…
- CVE-2014-3622Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote…PHP
- CVE-2016-1000109HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the…
- CVE-2016-1000005mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data…
- CVE-2016-1000004Insufficient type checks were employed prior to casting input data in SimpleXMLElement_exportNode and simplexml_import_dom.
- CVE-2019-20477PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g…pyyaml
- CVE-2019-20478In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument.
- CVE-2011-2054Cisco ASA Secondary Authentication Bypass VulnerabilityCisco ASA
- CVE-2015-0749Cisco Unified Communications Manager Cross-Site Scripting VulnerabilityCisco Unified Communications Manager
- CVE-2015-9543An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0.nova