# CVEs published 2020-01-08

101 CVEs were published on January 8, 2020: 0 critical, 4 high. Days are UTC.

- [CVE-2019-11292](https://cve.now/CVE-2019-11292.md): Pivotal Ops Manager logs query parameters in tomcat access file (CVSS 8.8, Pivotal Ops Manager)
- [CVE-2020-6617](https://cve.now/CVE-2020-6617.md): stb stb\_truetype.h through 1.22 has an assertion failure in stbtt\_\_cff\_int. (no CVSS)
- [CVE-2020-6618](https://cve.now/CVE-2020-6618.md): stb stb\_truetype.h through 1.22 has a heap-based buffer over-read in stbtt\_\_find\_table. (no CVSS)
- [CVE-2020-6619](https://cve.now/CVE-2020-6619.md): stb stb\_truetype.h through 1.22 has an assertion failure in stbtt\_\_buf\_seek. (no CVSS)
- [CVE-2020-6620](https://cve.now/CVE-2020-6620.md): stb stb\_truetype.h through 1.22 has a heap-based buffer over-read in stbtt\_\_buf\_get8. (no CVSS)
- [CVE-2020-6621](https://cve.now/CVE-2020-6621.md): stb stb\_truetype.h through 1.22 has a heap-based buffer over-read in ttUSHORT. (no CVSS)
- [CVE-2020-6622](https://cve.now/CVE-2020-6622.md): stb stb\_truetype.h through 1.22 has a heap-based buffer over-read in stbtt\_\_buf\_peek8. (no CVSS)
- [CVE-2020-6623](https://cve.now/CVE-2020-6623.md): stb stb\_truetype.h through 1.22 has an assertion failure in stbtt\_\_cff\_get\_index. (no CVSS)
- [CVE-2011-5266](https://cve.now/CVE-2011-5266.md): Imperva SecureSphere Web Application Firewall (WAF) before 12-august-2010 allows SQL injection filter bypass. (no CVSS)
- [CVE-2011-5250](https://cve.now/CVE-2011-5250.md): Snare for Linux before 1.7.0 has CSRF in the web interface. (no CVSS)
- [CVE-2011-5247](https://cve.now/CVE-2011-5247.md): Snare for Linux before 1.7.0 has password disclosure because the rendered page contains the field RemotePassword. (no CVSS)
- [CVE-2011-5018](https://cve.now/CVE-2011-5018.md): Koala Framework before 2011-11-21 has XSS via the request\_uri parameter. (no CVSS)
- [CVE-2019-17001](https://cve.now/CVE-2019-17001.md): A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the protected document (no CVSS, Mozilla Firefox)
- [CVE-2019-9812](https://cve.now/CVE-2019-9812.md): Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.fir (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2019-17025](https://cve.now/CVE-2019-17025.md): Mozilla developers reported memory safety bugs present in Firefox 71. (no CVSS, Mozilla Firefox)
- [CVE-2019-17024](https://cve.now/CVE-2019-17024.md): Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2019-17023](https://cve.now/CVE-2019-17023.md): After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in (no CVSS, Mozilla Firefox)
- [CVE-2019-17022](https://cve.now/CVE-2019-17022.md): When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2019-17021](https://cve.now/CVE-2019-17021.md): During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2019-17020](https://cve.now/CVE-2019-17020.md): If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be (no CVSS, Mozilla Firefox)
- [CVE-2019-17019](https://cve.now/CVE-2019-17019.md): When Python was installed on Windows, a python file being served with the MIME type of text/plain could be executed by Python instead of bei (no CVSS, Mozilla Firefox)
- [CVE-2019-17018](https://cve.now/CVE-2019-17018.md): When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve the accuracy of the keyboard. (no CVSS, Mozilla Firefox)
- [CVE-2019-17017](https://cve.now/CVE-2019-17017.md): Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2019-17016](https://cve.now/CVE-2019-17016.md): When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2019-17015](https://cve.now/CVE-2019-17015.md): During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially explo (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2019-17014](https://cve.now/CVE-2019-17014.md): If an image had not loaded correctly (such as when it is not actually an image), it could be dragged and dropped cross-domain, resulting in (no CVSS, Mozilla Firefox)
- [CVE-2019-17013](https://cve.now/CVE-2019-17013.md): Mozilla developers reported memory safety bugs present in Firefox 70. (no CVSS, Mozilla Firefox)
- [CVE-2019-17012](https://cve.now/CVE-2019-17012.md): Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2019-17011](https://cve.now/CVE-2019-17011.md): Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2019-17010](https://cve.now/CVE-2019-17010.md): Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have c (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2019-17009](https://cve.now/CVE-2019-17009.md): When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to lo (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2019-17008](https://cve.now/CVE-2019-17008.md): When using nested workers, a use-after-free could occur during worker destruction. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2019-17005](https://cve.now/CVE-2019-17005.md): The plain text serializer used a fixed-size array for the number of \<ol\> elements it could process; however it was possible to overflow the (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2019-17002](https://cve.now/CVE-2019-17002.md): If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was n (no CVSS, Mozilla Firefox)
- [CVE-2020-6609](https://cve.now/CVE-2020-6609.md): GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in read\_pages\_map in decode\_r2007.c. (no CVSS)
- [CVE-2020-6610](https://cve.now/CVE-2020-6610.md): GNU LibreDWG 0.9.3.2564 has an attempted excessive memory allocation in read\_sections\_map in decode\_r2007.c. (no CVSS)
- [CVE-2020-6611](https://cve.now/CVE-2020-6611.md): GNU LibreDWG 0.9.3.2564 has a NULL pointer dereference in get\_next\_owned\_entity in dwg.c. (no CVSS)
- [CVE-2020-6612](https://cve.now/CVE-2020-6612.md): GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in copy\_compressed\_bytes in decode\_r2007.c. (no CVSS)
- [CVE-2020-6613](https://cve.now/CVE-2020-6613.md): GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bit\_search\_sentinel in bits.c. (no CVSS)
- [CVE-2020-6614](https://cve.now/CVE-2020-6614.md): GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in bfr\_read in decode.c. (no CVSS)
- [CVE-2020-6615](https://cve.now/CVE-2020-6615.md): GNU LibreDWG 0.9.3.2564 has an invalid pointer dereference in dwg\_dynapi\_entity\_value in dynapi.c (dynapi.c is generated by gen-dynapi.pl). (no CVSS)
- [CVE-2019-17000](https://cve.now/CVE-2019-17000.md): An object tag with a data URI did not correctly inherit the document's Content Security Policy. (no CVSS, Mozilla Firefox)
- [CVE-2019-11765](https://cve.now/CVE-2019-11765.md): A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown. (no CVSS, Mozilla Firefox)
- [CVE-2019-11764](https://cve.now/CVE-2019-11764.md): Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2019-11763](https://cve.now/CVE-2019-11763.md): Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2019-11762](https://cve.now/CVE-2019-11762.md): If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/ (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2019-11761](https://cve.now/CVE-2019-11761.md): By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2019-11760](https://cve.now/CVE-2019-11760.md): A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2019-11759](https://cve.now/CVE-2019-11759.md): An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2019-11758](https://cve.now/CVE-2019-11758.md): Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2019-11757](https://cve.now/CVE-2019-11757.md): When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2019-11756](https://cve.now/CVE-2019-11756.md): Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). (no CVSS, Mozilla Firefox)
- [CVE-2019-11745](https://cve.now/CVE-2019-11745.md): When encrypting with a block cipher, if a call to NSC\_EncryptUpdate was made with data smaller than the block size, a small out of bounds wr (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2020-6583](https://cve.now/CVE-2020-6583.md): BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. (no CVSS)
- [CVE-2016-5346](https://cve.now/CVE-2016-5346.md): An Information Disclosure vulnerability exists in the Google Pixel/Pixel SL Qualcomm Avtimer Driver due to a NULL pointer dereference when p (no CVSS)
- [CVE-2020-0008](https://cve.now/CVE-2020-0008.md): In LowEnergyClient::MtuChangedCallback of low\_energy\_client.cc, there is a possible out of bounds read due to a race condition. (no CVSS, Android)
- [CVE-2020-0007](https://cve.now/CVE-2020-0007.md): In flattenString8 of Sensor.cpp, there is a possible information disclosure of heap memory due to uninitialized data. (no CVSS, Android)
- [CVE-2020-0006](https://cve.now/CVE-2020-0006.md): In rw\_i93\_send\_cmd\_write\_single\_block of rw\_i93.cc, there is a possible information disclosure of heap memory due to uninitialized data. (no CVSS, Android)
- [CVE-2020-0004](https://cve.now/CVE-2020-0004.md): In generateCrop of WallpaperManagerService.java, there is a possible sysui crash due to image exceeding maximum texture size. (no CVSS, Android)
- [CVE-2020-0003](https://cve.now/CVE-2020-0003.md): In onCreate of InstallStart.java, there is a possible package validation bypass due to a time-of-check time-of-use vulnerability. (no CVSS, Android)
- [CVE-2020-0002](https://cve.now/CVE-2020-0002.md): In ih264d\_init\_decoder of ih264d\_api.c, there is a possible out of bounds write due to a use after free. (no CVSS, Android)
- [CVE-2020-0001](https://cve.now/CVE-2020-0001.md): In getProcessRecordLocked of ActivityManagerService.java isolated apps are not handled correctly. (no CVSS, Android)
- [CVE-2016-6585](https://cve.now/CVE-2016-6585.md): A Denial of Service vulnerability exists in Symantec Norton Mobile Security for Android prior to 3.16, which could let a remote malicious us (no CVSS, Symantec Norton Mobile Security for Android)
- [CVE-2020-5511](https://cve.now/CVE-2020-5511.md): PHPGurukul Small CRM v2.0 was found vulnerable to authentication bypass via SQL injection when logging into the administrator login page. (no CVSS)
- [CVE-2020-5510](https://cve.now/CVE-2020-5510.md): PHPGurukul Hostel Management System v2.0 allows SQL injection via the id parameter in the full-profile.php file. (no CVSS)
- [CVE-2020-5183](https://cve.now/CVE-2020-5183.md): FTPGetter Professional 5.97.0.223 is vulnerable to a memory corruption bug when a user sends a specially crafted string to the application. (no CVSS)
- [CVE-2019-19495](https://cve.now/CVE-2019-19495.md): The web interface on the Technicolor TC7230 STEB 01.25 is vulnerable to DNS rebinding, which allows a remote attacker to configure the cable (no CVSS)
- [CVE-2016-6587](https://cve.now/CVE-2016-6587.md): An Information Disclosure vulnerability exists in the mid.dat file stored on the SD card in Symantec Norton Mobile Security for Android befo (no CVSS, Symantec Norton Mobile Security for Android)
- [CVE-2016-6586](https://cve.now/CVE-2016-6586.md): A security bypass vulnerability exists in Symantec Norton Mobile Security for Android before 3.16, which could let a malicious user conduct (no CVSS, Symantec Norton Mobile Security for Android)
- [CVE-2019-20367](https://cve.now/CVE-2019-20367.md): nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab). (no CVSS)
- [CVE-2014-5287](https://cve.now/CVE-2014-5287.md): A Bash script injection vulnerability exists in Kemp Load Master 7.1-16 and earlier due to a failure to sanitize input in the Web User Inter (no CVSS)
- [CVE-2019-20363](https://cve.now/CVE-2019-20363.md): An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents. (no CVSS)
- [CVE-2019-20364](https://cve.now/CVE-2019-20364.md): An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp. (no CVSS)
- [CVE-2019-20365](https://cve.now/CVE-2019-20365.md): An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page. (no CVSS)
- [CVE-2019-20366](https://cve.now/CVE-2019-20366.md): An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents. (no CVSS, org.igniterealtime.openfire:parent)
- [CVE-2019-5082](https://cve.now/CVE-2019-5082.md): An exploitable heap buffer overflow vulnerability exists in the iocheckd service I/O-Check functionality of WAGO PFC200 Firmware version 03. (no CVSS, WAGO PFC200 · WAGO PFC100)
- [CVE-2019-10777](https://cve.now/CVE-2019-10777.md): In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function wi (no CVSS, aws-lambda)
- [CVE-2016-6588](https://cve.now/CVE-2016-6588.md): A Cross-Site Scripting (XSS) vulnerability exists in the ITMS workflow process manager console in Symantec IT Management Suite 8.0. (no CVSS, Symantec IT Management Suite)
- [CVE-2019-19544](https://cve.now/CVE-2019-19544.md): CA Automic Dollar Universe 5.3.3 contains a vulnerability, related to the uxdqmsrv binary being setuid root, that allows local attackers to (no CVSS, CA Automic Dollar Universe)
- [CVE-2019-19518](https://cve.now/CVE-2019-19518.md): CA Automic Sysload 5.6.0 through 6.1.2 contains a vulnerability, related to a lack of authentication on the File Server port, that potential (no CVSS, CA Automic Sysload)
- [CVE-2019-17076](https://cve.now/CVE-2019-17076.md): An issue was discovered in Jamf Pro 9.x and 10.x before 10.15.1. (no CVSS)
- [CVE-2016-6589](https://cve.now/CVE-2016-6589.md): A Denial of Service vulnerability exists in the ITMS workflow process manager login window in Symantec IT Management Suite 8.0. (no CVSS, Symantec IT Management Suite)
- [CVE-2019-5188](https://cve.now/CVE-2019-5188.md): A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. (CVSS 7.5, E2fsprogs)
- [CVE-2016-6590](https://cve.now/CVE-2016-6590.md): A privilege escalation vulnerability exists when loading DLLs during boot up and reboot in Symantec IT Management Suite 8.0 prior to 8.0 HF4 (no CVSS, Symantec IT Management Suite · Symantec Ghost Solution S… +2)
- [CVE-2014-2072](https://cve.now/CVE-2014-2072.md): Dassault Systemes Catia V5-6R2013: Stack Buffer Overflow due to inadequate boundary checks (no CVSS)
- [CVE-2014-1860](https://cve.now/CVE-2014-1860.md): Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities (no CVSS)
- [CVE-2020-0009](https://cve.now/CVE-2020-0009.md): In calc\_vm\_may\_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. (no CVSS, Android)
- [CVE-2014-1409](https://cve.now/CVE-2014-1409.md): MobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 have an authentication bypass vulnerability due to an XML file with (no CVSS)
- [CVE-2016-6591](https://cve.now/CVE-2016-6591.md): A security bypass vulnerability exists in Symantec Norton App Lock 1.0.3.186 and earlier if application pinning is enabled, which could let (no CVSS, Symantec Norton App Lock)
- [CVE-2019-10778](https://cve.now/CVE-2019-10778.md): devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. (no CVSS, devcert-sanscache)
- [CVE-2016-6593](https://cve.now/CVE-2016-6593.md): A code-execution vulnerability exists during startup in jhi.dll and otpiha.dll in Symantec VIP Access Desktop before 2.2.2, which could let (no CVSS, Symantec VIP Access Desktop)
- [CVE-2019-14820](https://cve.now/CVE-2019-14820.md): It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be (CVSS 4.3, keycloak · org.keycloak:keycloak-core)
- [CVE-2014-9908](https://cve.now/CVE-2014-9908.md): A Denial of Service vulnerability exists in Google Android 4.4.4, 5.0.2, and 5.1.1, which allows malicious users to block Bluetooh access (A (no CVSS, Google Android)
- [CVE-2019-20362](https://cve.now/CVE-2019-20362.md): In Teradici PCoIP Agent before 19.08.1 and PCoIP Client before 19.08.3, an unquoted service path can cause execution of %PROGRAMFILES(X86)%\\ (no CVSS)
- [CVE-2014-1598](https://cve.now/CVE-2014-1598.md): centurystar 7.12 ActiveX Control has a Stack Buffer Overflow (no CVSS)
- [CVE-2014-1454](https://cve.now/CVE-2014-1454.md): Pearson eSIS (Enterprise Student Information System) message board has stored XSS due to improper validation of user input (no CVSS)
- [CVE-2020-6170](https://cve.now/CVE-2020-6170.md): An authentication bypass vulnerability on Genexis Platinum-4410 v2.1 P4410-V2 1.28 devices allows attackers to obtain cleartext credentials (no CVSS)
- [CVE-2019-20361](https://cve.now/CVE-2019-20361.md): There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the data (CVSS 8.3)
- [CVE-2019-20360](https://cve.now/CVE-2019-20360.md): A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally id (CVSS 7.5)
- [CVE-2020-6163](https://cve.now/CVE-2020-6163.md): The WikibaseMediaInfo extension 1.35 for MediaWiki allows XSS because of improper template syntax within the PropertySuggestionsWidget templ (no CVSS)
- [CVE-2014-5209](https://cve.now/CVE-2014-5209.md): An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET\_RESTRICT control message, which could l (no CVSS, NTP)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.