CVEs published January 3, 2020
53 CVEs were published on January 3, 2020: 1 critical, 2 high.
- Published
- 53
- Critical
- 1
- High
- 2
- Medium
- 1
- Low
- 0
- Unrated
- 49
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- Telos Automated Message Handling System
- 6
- Google Chrome
- 5
- pillow
- 4
- AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;A…
- 1
- com.fasterxml.jackson.core:jackson-databind
- 1
- Dell RSA Authentication Manager
- 1
- HPE SimpliVity 2600 Gen10; HPE SimpliVity 380 Gen10; HPE Si…
- 1
- HUAWEI P30
- 1
- Mate 10 Pro;Honor V10;Honor 10;Nova
- 1
- OpenCV · opencv-python +3
- 1
Critical 1
High 2
- CVE-2019-5064An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0.OpenCV · opencv-python +3
- CVE-2019-5063An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0.OpenCV · opencv-python-headless +3
Medium, low and unrated 50
- CVE-2019-5845Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2019-5846Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2019-13766Use-after-free in accessibility in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2019-5844Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2019-13765Use-after-free in content delivery manager in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to potentially exploit heap corrGoogle Chrome
- CVE-2019-3768RSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability.Dell RSA Authentication Manager
- CVE-2019-9541Telos Automated Message Handling System information disclosure in itemlookup.aspTelos Automated Message Handling System
- CVE-2019-9542Telos Automated Message Handling System reflected XSS in itemlookup.aspTelos Automated Message Handling System
- CVE-2019-9539Telos Automated Message Handling System reflected XSS in ModalWindowPopup.aspTelos Automated Message Handling System
- CVE-2019-9540Telos Automated Message Handling System reflected XSS in prefs.aspTelos Automated Message Handling System
- CVE-2019-9537Telos Automated Message Handling System reflected XSS in uploaditem.aspTelos Automated Message Handling System
- CVE-2019-9538Telos Automated Message Handling System reflected XSS in LDAP cbURL parameterTelos Automated Message Handling System
- CVE-2019-19959ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, le
- CVE-2014-8516Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a fi
- CVE-2014-8337Unrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in HelpDEZk 1.0.1 and earlier allows remote attack
- CVE-2014-5516Cross-site request forgery (CSRF) vulnerability in the Storefront Application in DS Data Systems KonaKart before 7.3.0.0 allows remote attac
- CVE-2014-5140The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) chara
- CVE-2014-10398Multiple cross-site scripting (XSS) vulnerabilities in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client.
- CVE-2014-4196Cross-site scripting (XSS) vulnerability in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client 3.17.9 allows remote attackers to inject arbitr
- CVE-2012-5878Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacha
- CVE-2012-5693Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters
- CVE-2019-11994A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliHPE SimpliVity 2600 Gen10; HPE SimpliVity 380 Gen10; HPE Si…
- CVE-2019-11993A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliSimpliVity OmniCube; HPE SimpliVity 380 Gen9; HPE SimpliVit…
- CVE-2019-19310GitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure.
- CVE-2019-19309GitLab Enterprise Edition (EE) 8.90 and later through 12.5 has Incorrect Access Control.
- CVE-2019-19263GitLab Enterprise Edition (EE) 8.2 and later through 12.5 has Insecure Permissions.
- CVE-2019-19262GitLab Enterprise Edition (EE) 11.9 and later through 12.5 has Insecure Permissions.
- CVE-2019-19261GitLab Enterprise Edition (EE) 6.7 and later through 12.5 allows SSRF.
- CVE-2019-19260GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 2 of 2).
- CVE-2019-19259GitLab Enterprise Edition (EE) 11.3 and later through 12.5 allows an Insecure Direct Object Reference (IDOR).
- CVE-2019-19258GitLab Enterprise Edition (EE) 10.8 and later through 12.5 has Incorrect Access Control.
- CVE-2019-19257GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 1 of 2).
- CVE-2019-19256GitLab Enterprise Edition (EE) 12.2 and later through 12.5 has Incorrect Access Control.
- CVE-2019-19255GitLab Enterprise Edition (EE) 12.3 and later through 12.5 has Incorrect Access Control.
- CVE-2012-4451Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web scriZend Technologies Zend Framework
- CVE-2019-19254GitLab Community Edition (CE) and Enterprise Edition (EE).
- CVE-2019-19088Gitlab Enterprise Edition (EE) 11.3 through 12.4.2 allows Directory Traversal.
- CVE-2019-19087Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 2 of 2).
- CVE-2019-19086Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 1 of 2).
- CVE-2019-19311GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields.
- CVE-2020-1785Mate 10 Pro;Honor V10;Honor 10;Nova 4 smartphones have a denial of service vulnerability.Mate 10 Pro;Honor V10;Honor 10;Nova
- CVE-2019-5304Some Huawei products have a buffer error vulnerability.AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;A…
- CVE-2020-1871USG9500 with software of V500R001C30SPC100; V500R001C30SPC200; V500R001C30SPC600; V500R001C60SPC500; V500R005C00SPC100; V500R005C00SPC200 haUSG9500
- CVE-2019-19441HUAWEI P30 smart phones with versions earlier than 10.0.0.166(C00E66R1P11) have an information leak vulnerability.HUAWEI P30
- CVE-2020-5310libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.pillow
- CVE-2020-5311libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.pillow
- CVE-2020-5312libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.pillow
- CVE-2020-5313libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.pillow
- CVE-2020-5395FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c.
- CVE-2020-5496FontForge 20190801 has a heap-based buffer overflow in the Type2NotDefSplines() function in splinesave.c.