CVEs published January 2, 2020
53 CVEs were published on January 2, 2020: 1 critical, 2 high.
- Published
- 53
- Critical
- 1
- High
- 2
- Medium
- 4
- Low
- 0
- Unrated
- 46
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- XnView
- 5
- IrfanView MrSID plugin
- 3
- Jomres component for Joomla!
- 2
- Opsview
- 2
- Supermicro IPMI
- 2
- BoltWire
- 1
- docker.io
- 1
- ecstatic
- 1
- fence-agents
- 1
- Katello
- 1
Critical 1
High 2
- CVE-2019-14863There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web appliRed Hat angular: · angular
- CVE-2019-14859A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding.Red Hat python-ecdsa · ecdsa
Medium, low and unrated 50
- CVE-2019-20329OpenLambda 2019-09-10 allows DNS rebinding attacks against the OL server for the REST API on TCP port 5000.
- CVE-2014-8182An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages.openldap
- CVE-2014-6275FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default.Red Hat FusionForge
- CVE-2013-1420Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbitrary web script or H
- CVE-2013-1642Multiple cross-site scripting (XSS) vulnerabilities in QuiXplorer before 2.5.5 allow remote attackers to inject arbitrary web script or HTML
- CVE-2013-0737Cross-site scripting (XSS) vulnerability in BoltWire 3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the BoltWire
- CVE-2014-3590Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action.Red Hat Satellite
- CVE-2014-0245It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe.Red Hat JBoss Portal
- CVE-2013-7351Multiple cross-site scripting (XSS) vulnerabilities in index.php in Shaarli allow remote attackers to inject arbitrary web script or HTML viShaarli
- CVE-2013-3246Stack-based buffer overflow in xnview.exe in XnView before 2.03 allows remote attackers to execute arbitrary code via a crafted image layer XnView
- CVE-2013-3247Heap-based buffer overflow in xnview.exe in XnView before 2.03 allows remote attackers to execute arbitrary code via a crafted RLE compresseXnView
- CVE-2014-0011Multiple heap-based buffer overflows in the ZRLE_DECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabledTigerVNC
- CVE-2013-3932SQL injection vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "BusineJomres component for Joomla!
- CVE-2013-3931Cross-site scripting (XSS) vulnerability in the Jomres (com_jomres) component before 7.3.1 for Joomla! allows remote authenticated users witJomres component for Joomla!
- CVE-2014-0183Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registeKatello
- CVE-2013-3937Heap-based buffer overflow in xnview.exe in XnView before 2.13 allows remote attackers to execute arbitrary code via the biBitCount field inXnView
- CVE-2013-3939xnview.exe in XnView before 2.13 does not properly handle RLE strip lengths during processing of RGB files, which allows remote attackers toXnView
- CVE-2013-3941Xjp2.dll in XnView before 2.13 allows remote attackers to execute arbitrary code via (1) the Csiz parameter in a SIZ marker, which triggers XnView
- CVE-2014-0169In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain.Red Hat JBoss EAP
- CVE-2013-3944Stack-based buffer overflow in the MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via IrfanView MrSID plugin
- CVE-2013-3945The MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via a nband tag.IrfanView MrSID plugin
- CVE-2013-3946Heap-based buffer overflow in the MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via aIrfanView MrSID plugin
- CVE-2010-3782obs-server before 1.7.7 allows logins by 'unconfirmed' accounts due to a bug in the REST api implementation.
- CVE-2014-4553Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitra
- CVE-2013-7062Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6,plone
- CVE-2013-6242Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-re
- CVE-2013-7486Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev27 and 7.4.x before 7.4.0-rev20
- CVE-2013-7485Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev26 and 7.4.x before 7.4.0-rev16
- CVE-2013-3620Hardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards befoSupermicro IPMI
- CVE-2013-3619Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro IPMI
- CVE-2014-0161ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or ovirt-engine-sdk-python
- CVE-2014-0104In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-ifence-agents
- CVE-2019-10205A flaw was found in the way Red Hat Quay stores robot account tokens in plain text.RED HAT quay
- CVE-2014-0048An issue was found in Docker before 1.6.0.docker.io
- CVE-2013-4752Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component.symfony/symfony · symfony/http-foundation
- CVE-2013-4532Qemu 1.1.2+dfsg to 2.1+dfsg suffers from a buffer overrun which could potentially result in arbitrary code execution on the host with the prqemu
- CVE-2019-10775ecstatic have a denial of service vulnerability.ecstatic
- CVE-2013-3935Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.1 and Opsview Core before 20130522 allows remote attackers to hijack tOpsview
- CVE-2013-3936Multiple cross-site scripting (XSS) vulnerabilities in Opsview before 4.4.1 and Opsview Core before 20130522 allow remote attackers to injecOpsview
- CVE-2019-10158A flaw was found in Infinispan through version 9.4.14.Final.Red Hat infinispan · org.infinispan:infinispan-core
- CVE-2019-14864Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it Red Hat Ansible · ansible
- CVE-2019-14862There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web applicationRed Hat knockout · knockout
- CVE-2019-20219ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor in ngiflib.c.
- CVE-2019-20225MyBB before 1.8.22 allows an open redirect on login.
- CVE-2019-20220In Support Incident Tracker (SiT!) 3.67, the search_id parameter in the search_incidents_advanced.php page is affected by XSS.
- CVE-2019-20221In Support Incident Tracker (SiT!) 3.67, Load Plugins input in the config.php page is affected by XSS.
- CVE-2019-20222In Support Incident Tracker (SiT!) 3.67, the Short Application Name and Application Name inputs in the config.php page are affected by XSS.
- CVE-2019-20223In Support Incident Tracker (SiT!) 3.67, the id parameter is affected by XSS on all endpoints that use this parameter, a related issue to CV
- CVE-2019-20218selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.
- CVE-2019-20213D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrate