# CVEs published 2020-01-07 33 CVEs were published on January 7, 2020: 1 critical, 6 high. Days are UTC. - [CVE-2019-17148](https://cve.now/CVE-2019-17148.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop version 14 (CVSS 7.8, Parallels Desktop) - [CVE-2019-17151](https://cve.now/CVE-2019-17151.md): This vulnerability allows remote attackers redirect users to an external resource on affected installations of Tencent WeChat Prior to 7.0.9 (CVSS 4.3, Tencent WeChat) - [CVE-2019-17146](https://cve.now/CVE-2019-17146.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link DCS-960L v1.07.102. (CVSS 8.8, D-Link DCS-960L) - [CVE-2019-17147](https://cve.now/CVE-2019-17147.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers. (CVSS 8.8, TP-Link TL-WR841N) - [CVE-2019-18652](https://cve.now/CVE-2019-18652.md): A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript (no CVSS) - [CVE-2020-5841](https://cve.now/CVE-2020-5841.md): An issue was discovered in OpServices OpMon 9.3.1-1. (no CVSS) - [CVE-2019-6529](https://cve.now/CVE-2019-6529.md): An attacker could specially craft an FTP request that could crash the PR100088 Modbus gateway versions prior to release R02 (or Software Ver (no CVSS, PR100088 Modbus gateway) - [CVE-2019-14906](https://cve.now/CVE-2019-14906.md): A flaw was found with the RHSA-2019:3950 erratum, where it did not fix the CVE-2019-13616 SDL vulnerability. (CVSS 8.1, Red Hat SDL) - [CVE-2020-5842](https://cve.now/CVE-2020-5842.md): Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI. (no CVSS) - [CVE-2018-10465](https://cve.now/CVE-2018-10465.md): Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. (no CVSS) - [CVE-2020-5307](https://cve.now/CVE-2020-5307.md): PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the (no CVSS) - [CVE-2019-18386](https://cve.now/CVE-2019-18386.md): Systems management on Unisys ClearPath Forward Libra and ClearPath MCP Software Series can fault and have other unspecified impact when rece (no CVSS) - [CVE-2019-10776](https://cve.now/CVE-2019-10776.md): In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. (no CVSS, git-diff-apply) - [CVE-2019-16154](https://cve.now/CVE-2019-16154.md): An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may allow an unauthenticated user to perfo (no CVSS, Fortinet FortiAuthenticator WEB UI) - [CVE-2019-6700](https://cve.now/CVE-2019-6700.md): An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated (no CVSS, Fortinet FortiSIEM) - [CVE-2019-9465](https://cve.now/CVE-2019-9465.md): In the Titan M handling of cryptographic operations, there is a possible information disclosure due to an unusual root cause. (no CVSS, Android) - [CVE-2014-8673](https://cve.now/CVE-2014-8673.md): Multiple SQL vulnerabilities exist in planning.php, user\_list.php, projets.php, user\_groupes.php, and groupe\_list.php in Simple Online Plann (no CVSS) - [CVE-2019-14819](https://cve.now/CVE-2019-14819.md): A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. (CVSS 7.5, \[Red Hat\] openshift-ansible) - [CVE-2019-14866](https://cve.now/CVE-2019-14866.md): In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. (CVSS 6.7, Red Hat cpio) - [CVE-2013-5658](https://cve.now/CVE-2013-5658.md): AultWare pwStore 2010.8.30.0 has XSS (no CVSS) - [CVE-2013-5657](https://cve.now/CVE-2013-5657.md): AultWare pwStore 2010.8.30.0 has DoS via an empty HTTP request (no CVSS) - [CVE-2019-14854](https://cve.now/CVE-2019-14854.md): OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Deb (CVSS 5.3, Red Hat library-go) - [CVE-2013-5656](https://cve.now/CVE-2013-5656.md): FuzeZip 1.0.0.131625 has a Local Buffer Overflow vulnerability (no CVSS) - [CVE-2019-14843](https://cve.now/CVE-2019-14843.md): A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. (CVSS 7.5, Red Hat wildfly-security-manager) - [CVE-2019-14837](https://cve.now/CVE-2019-14837.md): A flaw was found in keycloack before version 8.0.0. (CVSS 9.1, Red Hat keycloak · org.keycloak:keycloak-core) - [CVE-2013-5638](https://cve.now/CVE-2013-5638.md): Transcend WiFiSD 1.8 has persistent XSS (no CVSS) - [CVE-2019-14834](https://cve.now/CVE-2019-14834.md): A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a denial of service (memory (CVSS 3.7, The Dnsmasq Project dnsmasq) - [CVE-2013-5637](https://cve.now/CVE-2013-5637.md): PQI AirCard has persistent XSS (no CVSS) - [CVE-2019-14879](https://cve.now/CVE-2019-14879.md): A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. (CVSS 4.2, \[UNKNOWN\] moodle · moodle/moodle) - [CVE-2020-5393](https://cve.now/CVE-2020-5393.md): In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS. (no CVSS) - [CVE-2013-5122](https://cve.now/CVE-2013-5122.md): Cisco Linksys Routers EA2700, EA3500, E4200, EA4500: A bug can cause an unsafe TCP port to open which leads to unauthenticated access (no CVSS) - [CVE-2013-5571](https://cve.now/CVE-2013-5571.md): HMailServer 5.3.x and prior: Memory Corruption which could cause DOS (no CVSS) - [CVE-2020-5843](https://cve.now/CVE-2020-5843.md): Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-01-07 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.