# CVEs published 2020-01-03

53 CVEs were published on January 3, 2020: 1 critical, 2 high. Days are UTC.

- [CVE-2019-5845](https://cve.now/CVE-2019-5845.md): Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2019-5846](https://cve.now/CVE-2019-5846.md): Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2019-13766](https://cve.now/CVE-2019-13766.md): Use-after-free in accessibility in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2019-5844](https://cve.now/CVE-2019-5844.md): Out of bounds access in SwiftShader in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2019-13765](https://cve.now/CVE-2019-13765.md): Use-after-free in content delivery manager in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to potentially exploit heap corr (no CVSS, Google Chrome)
- [CVE-2019-3768](https://cve.now/CVE-2019-3768.md): RSA Authentication Manager versions prior to 8.4 P7 contain an XML Entity Injection Vulnerability. (CVSS 6.5, Dell RSA Authentication Manager)
- [CVE-2019-9541](https://cve.now/CVE-2019-9541.md): Telos Automated Message Handling System information disclosure in itemlookup.asp (no CVSS, Telos Automated Message Handling System)
- [CVE-2019-9542](https://cve.now/CVE-2019-9542.md): Telos Automated Message Handling System reflected XSS in itemlookup.asp (no CVSS, Telos Automated Message Handling System)
- [CVE-2019-9539](https://cve.now/CVE-2019-9539.md): Telos Automated Message Handling System reflected XSS in ModalWindowPopup.asp (no CVSS, Telos Automated Message Handling System)
- [CVE-2019-9540](https://cve.now/CVE-2019-9540.md): Telos Automated Message Handling System reflected XSS in prefs.asp (no CVSS, Telos Automated Message Handling System)
- [CVE-2019-9537](https://cve.now/CVE-2019-9537.md): Telos Automated Message Handling System reflected XSS in uploaditem.asp (no CVSS, Telos Automated Message Handling System)
- [CVE-2019-9538](https://cve.now/CVE-2019-9538.md): Telos Automated Message Handling System reflected XSS in LDAP cbURL parameter (no CVSS, Telos Automated Message Handling System)
- [CVE-2019-19959](https://cve.now/CVE-2019-19959.md): ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\\0' characters in filenames, le (no CVSS)
- [CVE-2014-8516](https://cve.now/CVE-2014-8516.md): Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a fi (no CVSS)
- [CVE-2014-8337](https://cve.now/CVE-2014-8337.md): Unrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in HelpDEZk 1.0.1 and earlier allows remote attack (no CVSS)
- [CVE-2014-5516](https://cve.now/CVE-2014-5516.md): Cross-site request forgery (CSRF) vulnerability in the Storefront Application in DS Data Systems KonaKart before 7.3.0.0 allows remote attac (no CVSS)
- [CVE-2014-5140](https://cve.now/CVE-2014-5140.md): The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : (colon) chara (no CVSS)
- [CVE-2014-10398](https://cve.now/CVE-2014-10398.md): Multiple cross-site scripting (XSS) vulnerabilities in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client. (no CVSS)
- [CVE-2014-4196](https://cve.now/CVE-2014-4196.md): Cross-site scripting (XSS) vulnerability in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client 3.17.9 allows remote attackers to inject arbitr (no CVSS)
- [CVE-2012-5878](https://cve.now/CVE-2012-5878.md): Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacha (no CVSS)
- [CVE-2012-5693](https://cve.now/CVE-2012-5693.md): Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters (no CVSS)
- [CVE-2019-11994](https://cve.now/CVE-2019-11994.md): A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE Simpli (no CVSS, HPE SimpliVity 2600 Gen10; HPE SimpliVity 380 Gen10; HPE Si…)
- [CVE-2019-11993](https://cve.now/CVE-2019-11993.md): A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE Simpli (no CVSS, SimpliVity OmniCube; HPE SimpliVity 380 Gen9; HPE SimpliVit…)
- [CVE-2019-5064](https://cve.now/CVE-2019-5064.md): An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. (CVSS 8.8, OpenCV · opencv-python +3)
- [CVE-2019-5063](https://cve.now/CVE-2019-5063.md): An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0. (CVSS 8.8, OpenCV · opencv-python-headless +3)
- [CVE-2019-19310](https://cve.now/CVE-2019-19310.md): GitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure. (no CVSS)
- [CVE-2019-19309](https://cve.now/CVE-2019-19309.md): GitLab Enterprise Edition (EE) 8.90 and later through 12.5 has Incorrect Access Control. (no CVSS)
- [CVE-2019-19263](https://cve.now/CVE-2019-19263.md): GitLab Enterprise Edition (EE) 8.2 and later through 12.5 has Insecure Permissions. (no CVSS)
- [CVE-2019-19262](https://cve.now/CVE-2019-19262.md): GitLab Enterprise Edition (EE) 11.9 and later through 12.5 has Insecure Permissions. (no CVSS)
- [CVE-2019-19261](https://cve.now/CVE-2019-19261.md): GitLab Enterprise Edition (EE) 6.7 and later through 12.5 allows SSRF. (no CVSS)
- [CVE-2019-19260](https://cve.now/CVE-2019-19260.md): GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 2 of 2). (no CVSS)
- [CVE-2019-19259](https://cve.now/CVE-2019-19259.md): GitLab Enterprise Edition (EE) 11.3 and later through 12.5 allows an Insecure Direct Object Reference (IDOR). (no CVSS)
- [CVE-2019-19258](https://cve.now/CVE-2019-19258.md): GitLab Enterprise Edition (EE) 10.8 and later through 12.5 has Incorrect Access Control. (no CVSS)
- [CVE-2019-19257](https://cve.now/CVE-2019-19257.md): GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 1 of 2). (no CVSS)
- [CVE-2019-19256](https://cve.now/CVE-2019-19256.md): GitLab Enterprise Edition (EE) 12.2 and later through 12.5 has Incorrect Access Control. (no CVSS)
- [CVE-2019-19255](https://cve.now/CVE-2019-19255.md): GitLab Enterprise Edition (EE) 12.3 and later through 12.5 has Incorrect Access Control. (no CVSS)
- [CVE-2012-4451](https://cve.now/CVE-2012-4451.md): Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web scri (no CVSS, Zend Technologies Zend Framework)
- [CVE-2019-19254](https://cve.now/CVE-2019-19254.md): GitLab Community Edition (CE) and Enterprise Edition (EE). (no CVSS)
- [CVE-2019-19088](https://cve.now/CVE-2019-19088.md): Gitlab Enterprise Edition (EE) 11.3 through 12.4.2 allows Directory Traversal. (no CVSS)
- [CVE-2019-19087](https://cve.now/CVE-2019-19087.md): Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 2 of 2). (no CVSS)
- [CVE-2019-19086](https://cve.now/CVE-2019-19086.md): Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 1 of 2). (no CVSS)
- [CVE-2019-19311](https://cve.now/CVE-2019-19311.md): GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields. (no CVSS)
- [CVE-2020-1785](https://cve.now/CVE-2020-1785.md): Mate 10 Pro;Honor V10;Honor 10;Nova 4 smartphones have a denial of service vulnerability. (no CVSS, Mate 10 Pro;Honor V10;Honor 10;Nova)
- [CVE-2019-5304](https://cve.now/CVE-2019-5304.md): Some Huawei products have a buffer error vulnerability. (no CVSS, AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;A…)
- [CVE-2020-1871](https://cve.now/CVE-2020-1871.md): USG9500 with software of V500R001C30SPC100; V500R001C30SPC200; V500R001C30SPC600; V500R001C60SPC500; V500R005C00SPC100; V500R005C00SPC200 ha (no CVSS, USG9500)
- [CVE-2019-19441](https://cve.now/CVE-2019-19441.md): HUAWEI P30 smart phones with versions earlier than 10.0.0.166(C00E66R1P11) have an information leak vulnerability. (no CVSS, HUAWEI P30)
- [CVE-2019-20330](https://cve.now/CVE-2019-20330.md): FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking. (CVSS 9.8, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-5310](https://cve.now/CVE-2020-5310.md): libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc. (no CVSS, pillow)
- [CVE-2020-5311](https://cve.now/CVE-2020-5311.md): libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow. (no CVSS, pillow)
- [CVE-2020-5312](https://cve.now/CVE-2020-5312.md): libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. (no CVSS, pillow)
- [CVE-2020-5313](https://cve.now/CVE-2020-5313.md): libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow. (no CVSS, pillow)
- [CVE-2020-5395](https://cve.now/CVE-2020-5395.md): FontForge 20190801 has a use-after-free in SFD\_GetFontMetaData in sfd.c. (no CVSS)
- [CVE-2020-5496](https://cve.now/CVE-2020-5496.md): FontForge 20190801 has a heap-based buffer overflow in the Type2NotDefSplines() function in splinesave.c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.