# CVEs published 2020-01-05

15 CVEs were published on January 5, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2020-5306](https://cve.now/CVE-2020-5306.md): Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content. (no CVSS)
- [CVE-2020-5305](https://cve.now/CVE-2020-5305.md): Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen. (no CVSS)
- [CVE-2019-20155](https://cve.now/CVE-2019-20155.md): An issue was discovered in report\_edit.jsp in Determine (formerly Selectica) Contract Lifecycle Management (CLM) v5.4. (no CVSS)
- [CVE-2019-20154](https://cve.now/CVE-2019-20154.md): An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) v5.4. (no CVSS)
- [CVE-2019-20153](https://cve.now/CVE-2019-20153.md): An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) in v5.4. (no CVSS)
- [CVE-2019-20077](https://cve.now/CVE-2019-20077.md): The Typesetter CMS 5.1 logout functionality is affected by a CSRF vulnerability. (no CVSS)
- [CVE-2019-20004](https://cve.now/CVE-2019-20004.md): An issue was discovered on Intelbras IWR 3000N 1.8.7 devices. (no CVSS)
- [CVE-2019-19911](https://cve.now/CVE-2019-19911.md): There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer (no CVSS, pillow)
- [CVE-2019-19629](https://cve.now/CVE-2019-19629.md): In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed (no CVSS)
- [CVE-2019-19628](https://cve.now/CVE-2019-19628.md): In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privi (no CVSS)
- [CVE-2019-19314](https://cve.now/CVE-2019-19314.md): GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext. (no CVSS)
- [CVE-2019-19313](https://cve.now/CVE-2019-19313.md): GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service. (no CVSS)
- [CVE-2019-19312](https://cve.now/CVE-2019-19312.md): GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. (no CVSS)
- [CVE-2019-20336](https://cve.now/CVE-2019-20336.md): In PHP Scripts Mall advanced-real-estate-script 4.0.9, the search-results.php searchtext parameter is vulnerable to XSS. (no CVSS)
- [CVE-2019-20337](https://cve.now/CVE-2019-20337.md): In PHP Scripts Mall advanced-real-estate-script 4.0.9, the news\_edit.php news\_id parameter is vulnerable to SQL Injection. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.