CVEs published January 10, 2020
40 CVEs were published on January 10, 2020: 1 critical, 0 high.
- Published
- 40
- Critical
- 1
- High
- 0
- Medium
- 2
- Low
- 3
- Unrated
- 34
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- dompdf/dompdf
- 3
- OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- 3
- Google Chrome
- 2
- IBM QRadar SIEM
- 2
- Dell Unisphere for PowerMax
- 1
- Pivotal Spring MVC · org.springframework:spring-web
- 1
- pretty-link plugin
- 1
Critical 1
Medium, low and unrated 39
- CVE-2019-19475An issue was discovered in ManageEngine Applications Manager 14 with Build 14360.
- CVE-2020-6377Use after free in audio in Google Chrome prior to 79.0.3945.117 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2019-13767Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2020-6835An issue was discovered in Bftpd before 5.4.
- CVE-2012-4603Citrix XenApp Online Plug-in for Windows 12.1 and earlier, and Citrix Receiver for Windows 3.2 and earlier could allow remote attackers to e
- CVE-2012-3821A Security Bypass vulnerability exists in the activate.asp page in Arial Software Campaign Enterprise 11.0.551, which could let a remote mal
- CVE-2012-4284A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHe
- CVE-2011-5020An SQL Injection vulnerability exists in the ID parameter in Online TV Database 2011.
- CVE-2019-14301Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 1 of 2).
- CVE-2019-14302On Ricoh SP C250DN 1.06 devices, a debug port can be used.
- CVE-2019-14306Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 2 of 2).
- CVE-2019-14304Ricoh SP C250DN 1.06 devices allow CSRF.
- CVE-2019-18194TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation.
- CVE-2012-4030Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete
- CVE-2012-3824In Arial Campaign Enterprise before 11.0.551, multiple pages are accessible without authentication or authorization.
- CVE-2012-3823Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved.
- CVE-2012-3822Arial Campaign Enterprise before 11.0.551 has unauthorized access to the User-Edit.asp page, which allows remote attackers to enumerate user
- CVE-2020-6162An issue was discovered in Bftpd 5.3.
- CVE-2019-4559IBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users.IBM QRadar SIEM
- CVE-2019-4508IBM QRadar SIEM 7.3.0 through 7.3.3 uses weak credential storage in some instances which could be decrypted by a local attacker.IBM QRadar SIEM
- CVE-2020-1767Possible to send drafted messages as wrong agentOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2020-1766Improper handling of uploaded inline imagesOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2020-1765Spoofing of From field in several screensOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2014-5093Status2k does not remove the install directory allowing credential reset.
- CVE-2014-5092Status2k allows Remote Command Execution in admin/options/editpl.php.
- CVE-2013-6430The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properlPivotal Spring MVC · org.springframework:spring-web
- CVE-2011-4595Pretty-Link WordPress plugin 1.5.2 has XSSpretty-link plugin
- CVE-2013-7380The Etherpad Lite ep_imageconvert Plugin has a Remote Command Injection Vulnerability
- CVE-2013-6231SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script
- CVE-2014-4561The ultimate-weather plugin 1.0 for WordPress has XSS
- CVE-2014-4530flog plugin 0.1 for WordPress has XSS
- CVE-2014-4982LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on the application server.
- CVE-2014-5081sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass
- CVE-2014-4984Déjà Vu Crescendo Sales CRM has remote SQL Injection
- CVE-2014-5011DOMPDF before 0.6.2 allows Information Disclosure.dompdf/dompdf
- CVE-2014-5012DOMPDF before 0.6.2 allows denial of service.dompdf/dompdf
- CVE-2014-5013DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.dompdf/dompdf
- CVE-2019-20375A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML
- CVE-2019-20376A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML