CVEs published January 6, 2020
63 CVEs were published on January 6, 2020: 3 critical, 10 high.
- Published
- 63
- Critical
- 3
- High
- 10
- Medium
- 3
- Low
- 1
- Unrated
- 46
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Cisco Data Center Network Manager
- 12
- Android
- 5
- ANGLERSNET Co,.Ltd. Access analysis CGI An-Analyzer
- 4
- Schneider Electric SE Modicon M580, Modicon M340, Modicon Q…
- 3
- EcoStruxure Control Expert (all versions prior to 14.1 Hot…
- 1
- EcoStruxure Geo SCADA Expert (ClearSCADA) with initial rele…
- 1
- fileview
- 1
- hashbrown-cms
- 1
- marked
- 1
- seeftl
- 1
Critical 3
- CVE-2019-15977Cisco Data Center Network Manager Authentication Bypass VulnerabilitiesCisco Data Center Network Manager
- CVE-2019-15975Cisco Data Center Network Manager Authentication Bypass VulnerabilitiesCisco Data Center Network Manager
- CVE-2019-15976Cisco Data Center Network Manager Authentication Bypass VulnerabilitiesCisco Data Center Network Manager
High 10
- CVE-2018-7794A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, ModiconSchneider Electric SE Modicon M580, Modicon M340, Modicon Q…
- CVE-2019-6857A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, ModiconSchneider Electric SE Modicon M580, Modicon M340, Modicon Q…
- CVE-2019-6856A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, ModiconSchneider Electric SE Modicon M580, Modicon M340, Modicon Q…
- CVE-2019-15978Cisco Data Center Network Manager Command Injection VulnerabilitiesCisco Data Center Network Manager
- CVE-2019-15979Cisco Data Center Network Manager Command Injection VulnerabilitiesCisco Data Center Network Manager
- CVE-2019-15980Cisco Data Center Network Manager Path Traversal VulnerabilitiesCisco Data Center Network Manager
- CVE-2019-15981Cisco Data Center Network Manager Path Traversal VulnerabilitiesCisco Data Center Network Manager
- CVE-2019-15982Cisco Data Center Network Manager Path Traversal VulnerabilitiesCisco Data Center Network Manager
- CVE-2019-15984Cisco Data Center Network Manager SQL Injection VulnerabilitiesCisco Data Center Network Manager
- CVE-2019-15985Cisco Data Center Network Manager SQL Injection VulnerabilitiesCisco Data Center Network Manager
Medium, low and unrated 50
- CVE-2019-6855Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), MEcoStruxure Control Expert (all versions prior to 14.1 Hot…
- CVE-2019-6854A CWE-287: Improper Authentication vulnerability exists in a folder within EcoStruxure Geo SCADA Expert (ClearSCADA) -with initial releases EcoStruxure Geo SCADA Expert (ClearSCADA) with initial rele…
- CVE-2014-8674Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_m
- CVE-2014-9405A Cross-Site Scripting (XSS) vulnerability exists in the description field of an Download RSS item or Contacts in Freebox OS Web interface 3
- CVE-2015-4553A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.
- CVE-2015-5951A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to upload arbitrary PHP
- CVE-2019-20348OKER G232V1 v1.03.02.20161129 devices provide a root terminal on a UART serial interface without proper access control.
- CVE-2019-18842A cross-site scripting (XSS) vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Modul
- CVE-2020-5846An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0.30 via a "PUT /obs/obm7/file/upload" reque
- CVE-2019-18625An issue was discovered in Suricata 5.0.0.
- CVE-2019-16271DTEN D5 and D7 before 1.3.2 devices allows remote attackers to read saved whiteboard image PDF documents via storage/emulated/0/Notes/PDF on
- CVE-2019-16272On DTEN D5 and D7 before 1.3.4 devices, factory settings allows for firmware reflash and Android Debug Bridge (adb) enablement.
- CVE-2019-16273DTEN D5 and D7 before 1.3.4 devices allow unauthenticated root shell access through Android Debug Bridge (adb), leading to arbitrary code ex
- CVE-2019-16274DTEN D5 before 1.3 and D7 before 1.3 devices transfer customer data files via unencrypted HTTP.
- CVE-2019-16716OX App Suite through 7.10.2 has Incorrect Access Control.
- CVE-2014-3743Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrarymarked
- CVE-2019-16717OX App Suite through 7.10.2 has XSS.
- CVE-2019-19509An issue was discovered in rConfig 3.9.3.
- CVE-2019-19585An issue was discovered in rConfig 3.9.3.
- CVE-2020-5512Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal.
- CVE-2020-5204Buffer overflow vulnerability in uftpdtroglobit uftpd
- CVE-2020-5513Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal.
- CVE-2020-5514Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI.
- CVE-2015-4039Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inje
- CVE-2020-5515Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection.
- CVE-2019-18792An issue was discovered in Suricata 5.0.0.
- CVE-2019-9468In export_key_der of export_key.cpp, there is possible memory corruption due to a double free.Android
- CVE-2019-9469In km_compute_shared_hmac of km4.c, there is a possible out of bounds write due to improper input validation.Android
- CVE-2019-9470In dma_sblk_start of abc-pcie.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2019-9471In set_outbound_iatu of abc-pcie.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2019-9472In DCRYPTO_equals of compare.c, there is a possible timing attack due to improperly used crypto.Android
- CVE-2020-5840An issue was discovered in HashBrown CMS before 1.3.2.hashbrown-cms
- CVE-2019-15602The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability infileview
- CVE-2019-15603The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directoryseeftl
- CVE-2016-11017The application login page in AKIPS Network Monitor 15.37 through 16.5 allows a remote unauthenticated attacker to execute arbitrary OS comm
- CVE-2019-20343The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element (within a pl
- CVE-2020-5519The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > Ext
- CVE-2019-15983Cisco Data Center Network Manager XML External Entity Read Access VulnerabilityCisco Data Center Network Manager
- CVE-2019-15999Cisco Data Center Network Manager JBoss EAP Unauthorized Access VulnerabilityCisco Data Center Network Manager
- CVE-2019-20354The web application component of piSignage before 2.6.4 allows a remote attacker (authenticated as a low-privilege user) to download arbitra
- CVE-2019-5988Stored cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers toANGLERSNET Co,.Ltd. Access analysis CGI An-Analyzer
- CVE-2019-5989DOM-based cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackersANGLERSNET Co,.Ltd. Access analysis CGI An-Analyzer
- CVE-2019-5990Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allow remote attackers to obtain a login password via HTTP referer.ANGLERSNET Co,.Ltd. Access analysis CGI An-Analyzer
- CVE-2019-5987Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote authenticated attackers to execute arbitrary OS commands ANGLERSNET Co,.Ltd. Access analysis CGI An-Analyzer
- CVE-2019-20352In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand
- CVE-2020-5191PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple Persistent XSS vulnerabilities.
- CVE-2020-5192PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages and parameters are not
- CVE-2019-19265IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts.
- CVE-2019-19266IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 2 of 2) in notes for objects.
- CVE-2019-18179An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.12, and Community Edition 5.0.x through 5.0.38 and 6.0.x thro