CVEs published January 9, 2020
74 CVEs were published on January 9, 2020: 2 critical, 3 high.
- Published
- 74
- Critical
- 2
- High
- 3
- Medium
- 5
- Low
- 0
- Unrated
- 64
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- HP DeskJet 3630 All-in-One Printer series
- 2
- ansible
- 1
- Apache Software Foundation Apache Olingo · org.apache.oling…
- 1
- BrowserID
- 1
- CloudEngine 12800;S5700;S6700
- 1
- Condor
- 1
- danschultzer Pow
- 1
- fwknop
- 1
- HP Access Control
- 1
- HP DeskJet 2600 All-in-One Printer series · HP DeskJet I… +9
- 1
Critical 2
- CVE-2020-6756languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows unauthenticated attackers to remotely execute code
- CVE-2020-6167A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject
High 3
- CVE-2019-20374A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution
- CVE-2020-6757contentHostProperties.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows authenticated attackers to remotely execute c
- CVE-2020-6168A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable
Medium, low and unrated 69
- CVE-2019-20373LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the user's shell lacks s
- CVE-2020-6758A cross-site scripting (XSS) vulnerability in Option/optionsAll.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows rem
- CVE-2020-5504In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page.phpmyadmin/phpmyadmin
- CVE-2012-3810Samsung Kies before 2.5.0.12094_27_11 has registry modification.
- CVE-2012-3809Samsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification.
- CVE-2012-3808Samsung Kies before 2.5.0.12094_27_11 has arbitrary file modification.
- CVE-2012-3807Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution.
- CVE-2012-3806Samsung Kies before 2.5.0.12094_27_11 contains a NULL pointer dereference vulnerability which could allow remote attackers to perform a deni
- CVE-2019-20178Advisto PEEL Shopping 9.2.1 has CSRF via administrer/utilisateurs.php to delete a user.
- CVE-2019-20179SOPlanning 1.45 has SQL injection via the user_list.php "by" parameter.
- CVE-2019-20183uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only o
- CVE-2019-20181The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter.
- CVE-2019-20184KeePass 2.4.1 allows CSV injection in the title field of a CSV export.
- CVE-2012-2950Gateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability which allows remote attackers to execute lo
- CVE-2019-20182The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter.
- CVE-2012-2931PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code into the
- CVE-2010-3282389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is eRed Hat 389 Directory Server · HP-UX Directory Server
- CVE-2012-2142The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escapepoppler
- CVE-2012-5558Cross-site scripting (XSS) vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1 and Smileys module 6.x-1.x versions prior toSmiley;Smileys Smiley · Smiley;Smileys Smileys
- CVE-2012-4434fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibly execute arbitrary code.fwknop
- CVE-2012-3490The (1) my_popenv_impl and (2) my_spawnv functions in src/condor_utils/my_popen.cpp and the (3) systemCommand function in condor_vm-gahp/vmgCondor
- CVE-2012-2226Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information o
- CVE-2012-1915EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks.
- CVE-2019-18859Digi AnywhereUSB 14 allows XSS via a link for the Digi Page.
- CVE-2019-20372NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to
- CVE-2012-2714The BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary uBrowserID
- CVE-2020-6166A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export
- CVE-2012-2724The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addSimplenews
- CVE-2012-1261Cross-site scripting (XSS) vulnerability in cgi-bin/scrut_fa_exclusions.cgi in Plixer International Scrutinizer NetFlow and sFlow Analyzer 8
- CVE-2012-1260Cross-site scripting (XSS) vulnerability in cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204,
- CVE-2012-1259Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other versions
- CVE-2012-1258cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer before 9.0.1.19899 does not validate user permissions, wh
- CVE-2016-5311A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security witSymantec Norton Antivirus, Norton AntiVirus with Backup, No…
- CVE-2020-6750GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server wh
- CVE-2019-6319HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmware version SWP1FN19HP DeskJet 3630 All-in-One Printer series
- CVE-2019-6320Certain HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmware version HP DeskJet 3630 All-in-One Printer series
- CVE-2020-1925Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends aApache Software Foundation Apache Olingo · org.apache.oling…
- CVE-2019-6330A potential security vulnerability has been identified in the software solution HP Access Control versions prior to 16.7.HP Access Control
- CVE-2019-6331An issue was found in Samsung Mobile Print (Android) versions prior to 4.08.007.Samsung Mobile Print
- CVE-2019-6332A potential security vulnerability has been identified with certain HP InkJet printers.HP DeskJet 2600 All-in-One Printer series · HP DeskJet I… +9
- CVE-2020-1810There is a weak algorithm vulnerability in some Huawei products.CloudEngine 12800;S5700;S6700
- CVE-2020-1786HUAWEI Mate 20 Pro smartphones versions earlier than 10.0.0.175(C00E69R3P8) have an improper authentication vulnerability.HUAWEI Mate 20 Pro
- CVE-2019-4651IBM Jazz Reporting Service (JRS) 6.0.6.1 is vulnerable to SQL injection.IBM Jazz Reporting Service
- CVE-2020-1787HUAWEI Mate 20 smartphones versions earlier than 9.1.0.139(C00E133R3P1) have an improper authentication vulnerability.HUAWEI Mate
- CVE-2020-1826Huawei Honor Magic2 mobile phones with versions earlier than 10.0.0.175(C00E59R2P11) have an information leak vulnerability.Huawei Honor Magic2
- CVE-2019-14920Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an authenticated attacker to gain root execution privileges over the device vi
- CVE-2019-14919An exposed Telnet Service on the Billion Smart Energy Router SG600R2 with firmware v3.02.rc6 allows a local network attacker to authenticate
- CVE-2019-14918XSS in the DHCP lease-status table in Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an attacker to inject arbitrary HTML/Jav
- CVE-2019-20224netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell
- CVE-2019-19332An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kernel's KVM hypervisor haLinux Kernel
- CVE-2014-3753AgileBits 1Password through 1.0.9.340 allows security feature bypass
- CVE-2014-3449BSS Continuity CMS 4.2.22640.0 has an Authentication Bypass vulnerability
- CVE-2014-3448BSS Continuity CMS 4.2.22640.0 has a Remote Code Execution vulnerability due to unauthenticated file upload
- CVE-2014-3447BSS Continuity CMS 4.2.22640.0 has a Remote Denial Of Service vulnerability
- CVE-2014-3211Publify before 8.0.1 is vulnerable to a Denial of Service attackpublify_core
- CVE-2014-2650Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interf
- CVE-2014-2651Unify OpenStage/OpenScape Desk Phone IP SIP before V3 R3.11.0 has an authentication bypass in the default mode of the Workpoint Interface
- CVE-2014-2686Ansible prior to 1.5.4 mishandles the evaluation of some strings.ansible
- CVE-2020-5308PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to XSS, as demonstrated by the category and CategoryCode parameters in add-ca
- CVE-2019-19494Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary
- CVE-2020-5205Session fixation attack in Pow (Hex package)danschultzer Pow
- CVE-2020-6632In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a QuickAccess link.
- CVE-2020-6628Ming (aka libming) 0.4.8 has a heap-based buffer over-read in the function decompile_SWITCH() in decompile.c.
- CVE-2020-6629Ming (aka libming) 0.4.8 has z NULL pointer dereference in the function decompileGETURL2() in decompile.c.
- CVE-2020-6630An issue was discovered in GPAC version 0.8.0.
- CVE-2020-6631An issue was discovered in GPAC version 0.8.0.
- CVE-2019-20180The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users.
- CVE-2020-6624jhead through 3.04 has a heap-based buffer over-read in process_DQT in jpgqguess.c.
- CVE-2020-6625jhead through 3.04 has a heap-based buffer over-read in Get32s when called from ProcessGpsInfo in gpsinfo.c.