# CVEs published 2020-01-11

8 CVEs were published on January 11, 2020: 0 critical, 1 high. Days are UTC.

- [CVE-2020-6847](https://cve.now/CVE-2020-6847.md): OpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator attempts to delete a message that contains (CVSS 7.6)
- [CVE-2019-20377](https://cve.now/CVE-2019-20377.md): TopList before 2019-09-03 allows XSS via a title. (no CVSS)
- [CVE-2019-20378](https://cve.now/CVE-2019-20378.md): ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php ce parameter. (no CVSS)
- [CVE-2019-20379](https://cve.now/CVE-2019-20379.md): ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter. (no CVSS)
- [CVE-2020-6838](https://cve.now/CVE-2020-6838.md): In mruby 2.1.0, there is a use-after-free in hash\_values\_at in mrbgems/mruby-hash-ext/src/hash-ext.c. (no CVSS)
- [CVE-2020-6839](https://cve.now/CVE-2020-6839.md): In mruby 2.1.0, there is a stack-based buffer overflow in mrb\_str\_len\_to\_dbl in string.c. (no CVSS)
- [CVE-2020-6840](https://cve.now/CVE-2020-6840.md): In mruby 2.1.0, there is a use-after-free in hash\_slice in mrbgems/mruby-hash-ext/src/hash-ext.c. (no CVSS)
- [CVE-2020-6836](https://cve.now/CVE-2020-6836.md): grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. (no CVSS, hot-formula-parser)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.