# CVEs published 2020-01-10

40 CVEs were published on January 10, 2020: 1 critical, 0 high. Days are UTC.

- [CVE-2019-19475](https://cve.now/CVE-2019-19475.md): An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. (no CVSS)
- [CVE-2020-6377](https://cve.now/CVE-2020-6377.md): Use after free in audio in Google Chrome prior to 79.0.3945.117 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2019-13767](https://cve.now/CVE-2019-13767.md): Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the renderer process to (no CVSS, Google Chrome)
- [CVE-2020-6835](https://cve.now/CVE-2020-6835.md): An issue was discovered in Bftpd before 5.4. (no CVSS)
- [CVE-2012-4603](https://cve.now/CVE-2012-4603.md): Citrix XenApp Online Plug-in for Windows 12.1 and earlier, and Citrix Receiver for Windows 3.2 and earlier could allow remote attackers to e (no CVSS)
- [CVE-2012-3821](https://cve.now/CVE-2012-3821.md): A Security Bypass vulnerability exists in the activate.asp page in Arial Software Campaign Enterprise 11.0.551, which could let a remote mal (no CVSS)
- [CVE-2012-4284](https://cve.now/CVE-2012-4284.md): A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHe (no CVSS)
- [CVE-2019-18588](https://cve.now/CVE-2019-18588.md): Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMax (CVSS 9.0, Dell Unisphere for PowerMax)
- [CVE-2011-5020](https://cve.now/CVE-2011-5020.md): An SQL Injection vulnerability exists in the ID parameter in Online TV Database 2011. (no CVSS)
- [CVE-2019-14301](https://cve.now/CVE-2019-14301.md): Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 1 of 2). (no CVSS)
- [CVE-2019-14302](https://cve.now/CVE-2019-14302.md): On Ricoh SP C250DN 1.06 devices, a debug port can be used. (no CVSS)
- [CVE-2019-14306](https://cve.now/CVE-2019-14306.md): Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 2 of 2). (no CVSS)
- [CVE-2019-14304](https://cve.now/CVE-2019-14304.md): Ricoh SP C250DN 1.06 devices allow CSRF. (no CVSS)
- [CVE-2019-18194](https://cve.now/CVE-2019-18194.md): TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. (no CVSS)
- [CVE-2012-4030](https://cve.now/CVE-2012-4030.md): Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete (no CVSS)
- [CVE-2012-3824](https://cve.now/CVE-2012-3824.md): In Arial Campaign Enterprise before 11.0.551, multiple pages are accessible without authentication or authorization. (no CVSS)
- [CVE-2012-3823](https://cve.now/CVE-2012-3823.md): Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved. (no CVSS)
- [CVE-2012-3822](https://cve.now/CVE-2012-3822.md): Arial Campaign Enterprise before 11.0.551 has unauthorized access to the User-Edit.asp page, which allows remote attackers to enumerate user (no CVSS)
- [CVE-2020-6162](https://cve.now/CVE-2020-6162.md): An issue was discovered in Bftpd 5.3. (no CVSS)
- [CVE-2019-4559](https://cve.now/CVE-2019-4559.md): IBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users. (CVSS 5.3, IBM QRadar SIEM)
- [CVE-2019-4508](https://cve.now/CVE-2019-4508.md): IBM QRadar SIEM 7.3.0 through 7.3.3 uses weak credential storage in some instances which could be decrypted by a local attacker. (CVSS 5.1, IBM QRadar SIEM)
- [CVE-2020-1767](https://cve.now/CVE-2020-1767.md): Possible to send drafted messages as wrong agent (CVSS 3.5, OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS)
- [CVE-2020-1766](https://cve.now/CVE-2020-1766.md): Improper handling of uploaded inline images (CVSS 2.0, OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS)
- [CVE-2020-1765](https://cve.now/CVE-2020-1765.md): Spoofing of From field in several screens (CVSS 3.5, OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS)
- [CVE-2014-5093](https://cve.now/CVE-2014-5093.md): Status2k does not remove the install directory allowing credential reset. (no CVSS)
- [CVE-2014-5092](https://cve.now/CVE-2014-5092.md): Status2k allows Remote Command Execution in admin/options/editpl.php. (no CVSS)
- [CVE-2013-6430](https://cve.now/CVE-2013-6430.md): The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properl (no CVSS, Pivotal Spring MVC · org.springframework:spring-web)
- [CVE-2011-4595](https://cve.now/CVE-2011-4595.md): Pretty-Link WordPress plugin 1.5.2 has XSS (no CVSS, pretty-link plugin)
- [CVE-2013-7380](https://cve.now/CVE-2013-7380.md): The Etherpad Lite ep\_imageconvert Plugin has a Remote Command Injection Vulnerability (no CVSS)
- [CVE-2013-6231](https://cve.now/CVE-2013-6231.md): SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script (no CVSS)
- [CVE-2014-4561](https://cve.now/CVE-2014-4561.md): The ultimate-weather plugin 1.0 for WordPress has XSS (no CVSS)
- [CVE-2014-4530](https://cve.now/CVE-2014-4530.md): flog plugin 0.1 for WordPress has XSS (no CVSS)
- [CVE-2014-4982](https://cve.now/CVE-2014-4982.md): LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on the application server. (no CVSS)
- [CVE-2014-5081](https://cve.now/CVE-2014-5081.md): sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass (no CVSS)
- [CVE-2014-4984](https://cve.now/CVE-2014-4984.md): Déjà Vu Crescendo Sales CRM has remote SQL Injection (no CVSS)
- [CVE-2014-5011](https://cve.now/CVE-2014-5011.md): DOMPDF before 0.6.2 allows Information Disclosure. (no CVSS, dompdf/dompdf)
- [CVE-2014-5012](https://cve.now/CVE-2014-5012.md): DOMPDF before 0.6.2 allows denial of service. (no CVSS, dompdf/dompdf)
- [CVE-2014-5013](https://cve.now/CVE-2014-5013.md): DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383. (no CVSS, dompdf/dompdf)
- [CVE-2019-20375](https://cve.now/CVE-2019-20375.md): A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2019-20376](https://cve.now/CVE-2019-20376.md): A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.