# CVEs published 2020-01-09

74 CVEs were published on January 9, 2020: 2 critical, 3 high. Days are UTC.

- [CVE-2019-20374](https://cve.now/CVE-2019-20374.md): A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution (CVSS 8.3)
- [CVE-2019-20373](https://cve.now/CVE-2019-20373.md): LTSP LDM through 2.18.06 allows fat-client root access because the LDM\_USERNAME variable may have an empty value if the user's shell lacks s (no CVSS)
- [CVE-2020-6756](https://cve.now/CVE-2020-6756.md): languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows unauthenticated attackers to remotely execute code (CVSS 9.8)
- [CVE-2020-6758](https://cve.now/CVE-2020-6758.md): A cross-site scripting (XSS) vulnerability in Option/optionsAll.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows rem (CVSS 5.4)
- [CVE-2020-6757](https://cve.now/CVE-2020-6757.md): contentHostProperties.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows authenticated attackers to remotely execute c (CVSS 7.4)
- [CVE-2020-5504](https://cve.now/CVE-2020-5504.md): In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2012-3810](https://cve.now/CVE-2012-3810.md): Samsung Kies before 2.5.0.12094\_27\_11 has registry modification. (no CVSS)
- [CVE-2012-3809](https://cve.now/CVE-2012-3809.md): Samsung Kies before 2.5.0.12094\_27\_11 has arbitrary directory modification. (no CVSS)
- [CVE-2012-3808](https://cve.now/CVE-2012-3808.md): Samsung Kies before 2.5.0.12094\_27\_11 has arbitrary file modification. (no CVSS)
- [CVE-2012-3807](https://cve.now/CVE-2012-3807.md): Samsung Kies before 2.5.0.12094\_27\_11 has arbitrary file execution. (no CVSS)
- [CVE-2012-3806](https://cve.now/CVE-2012-3806.md): Samsung Kies before 2.5.0.12094\_27\_11 contains a NULL pointer dereference vulnerability which could allow remote attackers to perform a deni (no CVSS)
- [CVE-2019-20178](https://cve.now/CVE-2019-20178.md): Advisto PEEL Shopping 9.2.1 has CSRF via administrer/utilisateurs.php to delete a user. (no CVSS)
- [CVE-2019-20179](https://cve.now/CVE-2019-20179.md): SOPlanning 1.45 has SQL injection via the user\_list.php "by" parameter. (no CVSS)
- [CVE-2019-20183](https://cve.now/CVE-2019-20183.md): uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only o (no CVSS)
- [CVE-2019-20181](https://cve.now/CVE-2019-20181.md): The awesome-support plugin 5.8.0 for WordPress allows XSS via the post\_title parameter. (no CVSS)
- [CVE-2019-20184](https://cve.now/CVE-2019-20184.md): KeePass 2.4.1 allows CSV injection in the title field of a CSV export. (no CVSS)
- [CVE-2012-2950](https://cve.now/CVE-2012-2950.md): Gateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability which allows remote attackers to execute lo (no CVSS)
- [CVE-2019-20182](https://cve.now/CVE-2019-20182.md): The FooGallery plugin 1.8.12 for WordPress allow XSS via the post\_title parameter. (no CVSS)
- [CVE-2012-2931](https://cve.now/CVE-2012-2931.md): PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code into the (no CVSS)
- [CVE-2010-3282](https://cve.now/CVE-2010-3282.md): 389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is e (no CVSS, Red Hat 389 Directory Server · HP-UX Directory Server)
- [CVE-2012-2142](https://cve.now/CVE-2012-2142.md): The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escape (no CVSS, poppler)
- [CVE-2012-5558](https://cve.now/CVE-2012-5558.md): Cross-site scripting (XSS) vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1 and Smileys module 6.x-1.x versions prior to (no CVSS, Smiley;Smileys Smiley · Smiley;Smileys Smileys)
- [CVE-2012-4434](https://cve.now/CVE-2012-4434.md): fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibly execute arbitrary code. (no CVSS, fwknop)
- [CVE-2012-3490](https://cve.now/CVE-2012-3490.md): The (1) my\_popenv\_impl and (2) my\_spawnv functions in src/condor\_utils/my\_popen.cpp and the (3) systemCommand function in condor\_vm-gahp/vmg (no CVSS, Condor)
- [CVE-2012-2226](https://cve.now/CVE-2012-2226.md): Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information o (no CVSS)
- [CVE-2012-1915](https://cve.now/CVE-2012-1915.md): EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss\_clean() Filter and perform XSS attacks. (no CVSS)
- [CVE-2019-18859](https://cve.now/CVE-2019-18859.md): Digi AnywhereUSB 14 allows XSS via a link for the Digi Page. (no CVSS)
- [CVE-2019-20372](https://cve.now/CVE-2019-20372.md): NGINX before 1.17.7, with certain error\_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to (no CVSS)
- [CVE-2020-6168](https://cve.now/CVE-2020-6168.md): A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable (CVSS 7.6)
- [CVE-2012-2714](https://cve.now/CVE-2012-2714.md): The BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary u (no CVSS, BrowserID)
- [CVE-2020-6166](https://cve.now/CVE-2020-6166.md): A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export (CVSS 5.4)
- [CVE-2012-2724](https://cve.now/CVE-2012-2724.md): The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email add (no CVSS, Simplenews)
- [CVE-2012-1261](https://cve.now/CVE-2012-1261.md): Cross-site scripting (XSS) vulnerability in cgi-bin/scrut\_fa\_exclusions.cgi in Plixer International Scrutinizer NetFlow and sFlow Analyzer 8 (no CVSS)
- [CVE-2012-1260](https://cve.now/CVE-2012-1260.md): Cross-site scripting (XSS) vulnerability in cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, (no CVSS)
- [CVE-2012-1259](https://cve.now/CVE-2012-1259.md): Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other versions (no CVSS)
- [CVE-2012-1258](https://cve.now/CVE-2012-1258.md): cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer before 9.0.1.19899 does not validate user permissions, wh (no CVSS)
- [CVE-2016-5311](https://cve.now/CVE-2016-5311.md): A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security wit (no CVSS, Symantec Norton Antivirus, Norton AntiVirus with Backup, No…)
- [CVE-2020-6750](https://cve.now/CVE-2020-6750.md): GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server wh (no CVSS)
- [CVE-2019-6319](https://cve.now/CVE-2019-6319.md): HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmware version SWP1FN19 (no CVSS, HP DeskJet 3630 All-in-One Printer series)
- [CVE-2019-6320](https://cve.now/CVE-2019-6320.md): Certain HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmware version (no CVSS, HP DeskJet 3630 All-in-One Printer series)
- [CVE-2020-1925](https://cve.now/CVE-2020-1925.md): Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a (no CVSS, Apache Software Foundation Apache Olingo · org.apache.oling…)
- [CVE-2019-6330](https://cve.now/CVE-2019-6330.md): A potential security vulnerability has been identified in the software solution HP Access Control versions prior to 16.7. (no CVSS, HP Access Control)
- [CVE-2019-6331](https://cve.now/CVE-2019-6331.md): An issue was found in Samsung Mobile Print (Android) versions prior to 4.08.007. (no CVSS, Samsung Mobile Print)
- [CVE-2019-6332](https://cve.now/CVE-2019-6332.md): A potential security vulnerability has been identified with certain HP InkJet printers. (no CVSS, HP DeskJet 2600 All-in-One Printer series · HP DeskJet I… +9)
- [CVE-2020-6167](https://cve.now/CVE-2020-6167.md): A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject (CVSS 9.6)
- [CVE-2020-1810](https://cve.now/CVE-2020-1810.md): There is a weak algorithm vulnerability in some Huawei products. (no CVSS, CloudEngine 12800;S5700;S6700)
- [CVE-2020-1786](https://cve.now/CVE-2020-1786.md): HUAWEI Mate 20 Pro smartphones versions earlier than 10.0.0.175(C00E69R3P8) have an improper authentication vulnerability. (no CVSS, HUAWEI Mate 20 Pro)
- [CVE-2019-4651](https://cve.now/CVE-2019-4651.md): IBM Jazz Reporting Service (JRS) 6.0.6.1 is vulnerable to SQL injection. (CVSS 5.4, IBM Jazz Reporting Service)
- [CVE-2020-1787](https://cve.now/CVE-2020-1787.md): HUAWEI Mate 20 smartphones versions earlier than 9.1.0.139(C00E133R3P1) have an improper authentication vulnerability. (no CVSS, HUAWEI Mate)
- [CVE-2020-1826](https://cve.now/CVE-2020-1826.md): Huawei Honor Magic2 mobile phones with versions earlier than 10.0.0.175(C00E59R2P11) have an information leak vulnerability. (no CVSS, Huawei Honor Magic2)
- [CVE-2019-14920](https://cve.now/CVE-2019-14920.md): Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an authenticated attacker to gain root execution privileges over the device vi (no CVSS)
- [CVE-2019-14919](https://cve.now/CVE-2019-14919.md): An exposed Telnet Service on the Billion Smart Energy Router SG600R2 with firmware v3.02.rc6 allows a local network attacker to authenticate (no CVSS)
- [CVE-2019-14918](https://cve.now/CVE-2019-14918.md): XSS in the DHCP lease-status table in Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an attacker to inject arbitrary HTML/Jav (no CVSS)
- [CVE-2019-20224](https://cve.now/CVE-2019-20224.md): netflow\_get\_stats in functions\_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell (no CVSS)
- [CVE-2019-19332](https://cve.now/CVE-2019-19332.md): An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kernel's KVM hypervisor ha (CVSS 6.1, Linux Kernel)
- [CVE-2014-3753](https://cve.now/CVE-2014-3753.md): AgileBits 1Password through 1.0.9.340 allows security feature bypass (no CVSS)
- [CVE-2014-3449](https://cve.now/CVE-2014-3449.md): BSS Continuity CMS 4.2.22640.0 has an Authentication Bypass vulnerability (no CVSS)
- [CVE-2014-3448](https://cve.now/CVE-2014-3448.md): BSS Continuity CMS 4.2.22640.0 has a Remote Code Execution vulnerability due to unauthenticated file upload (no CVSS)
- [CVE-2014-3447](https://cve.now/CVE-2014-3447.md): BSS Continuity CMS 4.2.22640.0 has a Remote Denial Of Service vulnerability (no CVSS)
- [CVE-2014-3211](https://cve.now/CVE-2014-3211.md): Publify before 8.0.1 is vulnerable to a Denial of Service attack (no CVSS, publify\_core)
- [CVE-2014-2650](https://cve.now/CVE-2014-2650.md): Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interf (no CVSS)
- [CVE-2014-2651](https://cve.now/CVE-2014-2651.md): Unify OpenStage/OpenScape Desk Phone IP SIP before V3 R3.11.0 has an authentication bypass in the default mode of the Workpoint Interface (no CVSS)
- [CVE-2014-2686](https://cve.now/CVE-2014-2686.md): Ansible prior to 1.5.4 mishandles the evaluation of some strings. (no CVSS, ansible)
- [CVE-2020-5308](https://cve.now/CVE-2020-5308.md): PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to XSS, as demonstrated by the category and CategoryCode parameters in add-ca (no CVSS)
- [CVE-2019-19494](https://cve.now/CVE-2019-19494.md): Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary (no CVSS)
- [CVE-2020-5205](https://cve.now/CVE-2020-5205.md): Session fixation attack in Pow (Hex package) (CVSS 6.5, danschultzer Pow)
- [CVE-2020-6632](https://cve.now/CVE-2020-6632.md): In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a QuickAccess link. (no CVSS)
- [CVE-2020-6628](https://cve.now/CVE-2020-6628.md): Ming (aka libming) 0.4.8 has a heap-based buffer over-read in the function decompile\_SWITCH() in decompile.c. (no CVSS)
- [CVE-2020-6629](https://cve.now/CVE-2020-6629.md): Ming (aka libming) 0.4.8 has z NULL pointer dereference in the function decompileGETURL2() in decompile.c. (no CVSS)
- [CVE-2020-6630](https://cve.now/CVE-2020-6630.md): An issue was discovered in GPAC version 0.8.0. (no CVSS)
- [CVE-2020-6631](https://cve.now/CVE-2020-6631.md): An issue was discovered in GPAC version 0.8.0. (no CVSS)
- [CVE-2019-20180](https://cve.now/CVE-2019-20180.md): The TablePress plugin 1.9.2 for WordPress allows tablepress\[data\] CSV injection by Editor users. (no CVSS)
- [CVE-2020-6624](https://cve.now/CVE-2020-6624.md): jhead through 3.04 has a heap-based buffer over-read in process\_DQT in jpgqguess.c. (no CVSS)
- [CVE-2020-6625](https://cve.now/CVE-2020-6625.md): jhead through 3.04 has a heap-based buffer over-read in Get32s when called from ProcessGpsInfo in gpsinfo.c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.