# CVEs published 2020-01-02

53 CVEs were published on January 2, 2020: 1 critical, 2 high. Days are UTC.

- [CVE-2019-20329](https://cve.now/CVE-2019-20329.md): OpenLambda 2019-09-10 allows DNS rebinding attacks against the OL server for the REST API on TCP port 5000. (no CVSS)
- [CVE-2014-8182](https://cve.now/CVE-2014-8182.md): An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. (no CVSS, openldap)
- [CVE-2014-6275](https://cve.now/CVE-2014-6275.md): FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. (no CVSS, Red Hat FusionForge)
- [CVE-2013-1420](https://cve.now/CVE-2013-1420.md): Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2013-1642](https://cve.now/CVE-2013-1642.md): Multiple cross-site scripting (XSS) vulnerabilities in QuiXplorer before 2.5.5 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2013-0737](https://cve.now/CVE-2013-0737.md): Cross-site scripting (XSS) vulnerability in BoltWire 3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the (no CVSS, BoltWire)
- [CVE-2014-3590](https://cve.now/CVE-2014-3590.md): Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. (no CVSS, Red Hat Satellite)
- [CVE-2014-0245](https://cve.now/CVE-2014-0245.md): It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. (no CVSS, Red Hat JBoss Portal)
- [CVE-2013-7351](https://cve.now/CVE-2013-7351.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in Shaarli allow remote attackers to inject arbitrary web script or HTML vi (no CVSS, Shaarli)
- [CVE-2013-3246](https://cve.now/CVE-2013-3246.md): Stack-based buffer overflow in xnview.exe in XnView before 2.03 allows remote attackers to execute arbitrary code via a crafted image layer (no CVSS, XnView)
- [CVE-2013-3247](https://cve.now/CVE-2013-3247.md): Heap-based buffer overflow in xnview.exe in XnView before 2.03 allows remote attackers to execute arbitrary code via a crafted RLE compresse (no CVSS, XnView)
- [CVE-2014-0011](https://cve.now/CVE-2014-0011.md): Multiple heap-based buffer overflows in the ZRLE\_DECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled (no CVSS, TigerVNC)
- [CVE-2013-3932](https://cve.now/CVE-2013-3932.md): SQL injection vulnerability in the Jomres (com\_jomres) component before 7.3.1 for Joomla! allows remote authenticated users with the "Busine (no CVSS, Jomres component for Joomla!)
- [CVE-2013-3931](https://cve.now/CVE-2013-3931.md): Cross-site scripting (XSS) vulnerability in the Jomres (com\_jomres) component before 7.3.1 for Joomla! allows remote authenticated users wit (no CVSS, Jomres component for Joomla!)
- [CVE-2014-0183](https://cve.now/CVE-2014-0183.md): Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registe (no CVSS, Katello)
- [CVE-2013-3937](https://cve.now/CVE-2013-3937.md): Heap-based buffer overflow in xnview.exe in XnView before 2.13 allows remote attackers to execute arbitrary code via the biBitCount field in (no CVSS, XnView)
- [CVE-2013-3939](https://cve.now/CVE-2013-3939.md): xnview.exe in XnView before 2.13 does not properly handle RLE strip lengths during processing of RGB files, which allows remote attackers to (no CVSS, XnView)
- [CVE-2013-3941](https://cve.now/CVE-2013-3941.md): Xjp2.dll in XnView before 2.13 allows remote attackers to execute arbitrary code via (1) the Csiz parameter in a SIZ marker, which triggers (no CVSS, XnView)
- [CVE-2014-0169](https://cve.now/CVE-2014-0169.md): In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain. (no CVSS, Red Hat JBoss EAP)
- [CVE-2013-3944](https://cve.now/CVE-2013-3944.md): Stack-based buffer overflow in the MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via (no CVSS, IrfanView MrSID plugin)
- [CVE-2013-3945](https://cve.now/CVE-2013-3945.md): The MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via a nband tag. (no CVSS, IrfanView MrSID plugin)
- [CVE-2013-3946](https://cve.now/CVE-2013-3946.md): Heap-based buffer overflow in the MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via a (no CVSS, IrfanView MrSID plugin)
- [CVE-2010-3782](https://cve.now/CVE-2010-3782.md): obs-server before 1.7.7 allows logins by 'unconfirmed' accounts due to a bug in the REST api implementation. (no CVSS)
- [CVE-2014-4553](https://cve.now/CVE-2014-4553.md): Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitra (no CVSS)
- [CVE-2013-7062](https://cve.now/CVE-2013-7062.md): Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, (no CVSS, plone)
- [CVE-2013-6242](https://cve.now/CVE-2013-6242.md): Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-re (no CVSS)
- [CVE-2013-7486](https://cve.now/CVE-2013-7486.md): Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev27 and 7.4.x before 7.4.0-rev20 (no CVSS)
- [CVE-2013-7485](https://cve.now/CVE-2013-7485.md): Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev26 and 7.4.x before 7.4.0-rev16 (no CVSS)
- [CVE-2013-3620](https://cve.now/CVE-2013-3620.md): Hardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards befo (no CVSS, Supermicro IPMI)
- [CVE-2013-3619](https://cve.now/CVE-2013-3619.md): Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT\_X9\_317 and firmware for (no CVSS, Supermicro IPMI)
- [CVE-2014-0161](https://cve.now/CVE-2014-0161.md): ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or (no CVSS, ovirt-engine-sdk-python)
- [CVE-2014-0104](https://cve.now/CVE-2014-0104.md): In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence\_cisco\_ucs.py script which can potentially allow for man-i (no CVSS, fence-agents)
- [CVE-2019-10205](https://cve.now/CVE-2019-10205.md): A flaw was found in the way Red Hat Quay stores robot account tokens in plain text. (CVSS 6.0, RED HAT quay)
- [CVE-2014-0048](https://cve.now/CVE-2014-0048.md): An issue was found in Docker before 1.6.0. (no CVSS, docker.io)
- [CVE-2013-4752](https://cve.now/CVE-2013-4752.md): Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. (no CVSS, symfony/symfony · symfony/http-foundation)
- [CVE-2013-4532](https://cve.now/CVE-2013-4532.md): Qemu 1.1.2+dfsg to 2.1+dfsg suffers from a buffer overrun which could potentially result in arbitrary code execution on the host with the pr (no CVSS, qemu)
- [CVE-2019-10775](https://cve.now/CVE-2019-10775.md): ecstatic have a denial of service vulnerability. (no CVSS, ecstatic)
- [CVE-2013-3935](https://cve.now/CVE-2013-3935.md): Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.1 and Opsview Core before 20130522 allows remote attackers to hijack t (no CVSS, Opsview)
- [CVE-2013-3936](https://cve.now/CVE-2013-3936.md): Multiple cross-site scripting (XSS) vulnerabilities in Opsview before 4.4.1 and Opsview Core before 20130522 allow remote attackers to injec (no CVSS, Opsview)
- [CVE-2019-10158](https://cve.now/CVE-2019-10158.md): A flaw was found in Infinispan through version 9.4.14.Final. (CVSS 5.4, Red Hat infinispan · org.infinispan:infinispan-core)
- [CVE-2019-14864](https://cve.now/CVE-2019-14864.md): Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no\_log set it (CVSS 5.7, Red Hat Ansible · ansible)
- [CVE-2019-14863](https://cve.now/CVE-2019-14863.md): There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web appli (CVSS 7.1, Red Hat angular: · angular)
- [CVE-2019-14862](https://cve.now/CVE-2019-14862.md): There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application (CVSS 6.1, Red Hat knockout · knockout)
- [CVE-2019-14859](https://cve.now/CVE-2019-14859.md): A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. (CVSS 7.4, Red Hat python-ecdsa · ecdsa)
- [CVE-2019-20219](https://cve.now/CVE-2019-20219.md): ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor in ngiflib.c. (no CVSS)
- [CVE-2019-20225](https://cve.now/CVE-2019-20225.md): MyBB before 1.8.22 allows an open redirect on login. (no CVSS)
- [CVE-2019-20220](https://cve.now/CVE-2019-20220.md): In Support Incident Tracker (SiT!) 3.67, the search\_id parameter in the search\_incidents\_advanced.php page is affected by XSS. (no CVSS)
- [CVE-2019-20221](https://cve.now/CVE-2019-20221.md): In Support Incident Tracker (SiT!) 3.67, Load Plugins input in the config.php page is affected by XSS. (no CVSS)
- [CVE-2019-20222](https://cve.now/CVE-2019-20222.md): In Support Incident Tracker (SiT!) 3.67, the Short Application Name and Application Name inputs in the config.php page are affected by XSS. (no CVSS)
- [CVE-2019-20223](https://cve.now/CVE-2019-20223.md): In Support Incident Tracker (SiT!) 3.67, the id parameter is affected by XSS on all endpoints that use this parameter, a related issue to CV (no CVSS)
- [CVE-2019-20218](https://cve.now/CVE-2019-20218.md): selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error. (no CVSS)
- [CVE-2019-20213](https://cve.now/CVE-2019-20213.md): D-Link DIR-859 routers before v1.07b03\_beta allow Unauthenticated Information Disclosure via the AUTHORIZED\_GROUP=1%0a value, as demonstrate (no CVSS)
- [CVE-2016-1000027](https://cve.now/CVE-2016-1000027.md): Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untru (CVSS 9.8, org.springframework:spring-web)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.