# CVEs published 2020-01-13

43 CVEs were published on January 13, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2020-6958](https://cve.now/CVE-2020-6958.md): An XXE vulnerability in JnlpSupport in Yet Another Java Service Wrapper (YAJSW) 12.14, as used in NSA Ghidra and other products, allows atta (no CVSS)
- [CVE-2020-6954](https://cve.now/CVE-2020-6954.md): An issue was discovered on Cayin SMP-PRO4 devices. (no CVSS)
- [CVE-2020-6955](https://cve.now/CVE-2020-6955.md): An issue was discovered on Cayin SMP-PRO4 devices. (no CVSS)
- [CVE-2019-19680](https://cve.now/CVE-2019-19680.md): A file-extension filtering vulnerability in Proofpoint Enterprise Protection (PPS / PoD), in the unpatched versions of PPS through 8.9.22 an (no CVSS)
- [CVE-2019-20142](https://cve.now/CVE-2019-20142.md): An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.3 through 12.6.1. (no CVSS)
- [CVE-2019-20143](https://cve.now/CVE-2019-20143.md): An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 12.6. (no CVSS)
- [CVE-2019-20144](https://cve.now/CVE-2019-20144.md): An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 10.8 through 12.6.1. (no CVSS)
- [CVE-2019-20145](https://cve.now/CVE-2019-20145.md): An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.4 through 12.6.1. (no CVSS)
- [CVE-2019-20146](https://cve.now/CVE-2019-20146.md): An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 11.0 through 12.6. (no CVSS)
- [CVE-2019-20147](https://cve.now/CVE-2019-20147.md): An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 9.1 through 12.6.1. (no CVSS)
- [CVE-2019-20148](https://cve.now/CVE-2019-20148.md): An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 8.13 through 12.6.1. (no CVSS)
- [CVE-2020-5197](https://cve.now/CVE-2020-5197.md): An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 5.1 through 12.6.1. (no CVSS)
- [CVE-2020-6832](https://cve.now/CVE-2020-6832.md): An issue was discovered in GitLab Enterprise Edition (EE) 8.9.0 through 12.6.1. (no CVSS)
- [CVE-2012-4750](https://cve.now/CVE-2012-4750.md): A Code Execution vulnerability exists in the memcpy function when processing AMF requests in Ezhometech EzServer 7.0, which could let a remo (no CVSS)
- [CVE-2012-4761](https://cve.now/CVE-2012-4761.md): A Privilege Escalation vulnerability exists in the unquoted Service Binary in SDPAgent or SDBAgent in Safend Data Protector Agent 3.4.5586.9 (no CVSS)
- [CVE-2012-4760](https://cve.now/CVE-2012-4760.md): A Privilege Escalation vulnerability exists in the SDBagent service in Safend Data Protector Agent 3.4.5586.9772, which could let a local ma (no CVSS)
- [CVE-2020-6948](https://cve.now/CVE-2020-6948.md): A remote code execution issue was discovered in HashBrown CMS through 1.3.3. (no CVSS, hashbrown-cms)
- [CVE-2020-6949](https://cve.now/CVE-2020-6949.md): A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. (no CVSS)
- [CVE-2012-4767](https://cve.now/CVE-2012-4767.md): An issue exists in Safend Data Protector Agent 3.4.5586.9772 in the securitylayer.log file in the logs.9972 directory, which could let a mal (no CVSS)
- [CVE-2019-19727](https://cve.now/CVE-2019-19727.md): SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has weak slurmdbd.conf permissions. (no CVSS)
- [CVE-2019-19728](https://cve.now/CVE-2019-19728.md): SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 executes srun --uid with incorrect privileges. (no CVSS)
- [CVE-2020-5390](https://cve.now/CVE-2020-5390.md): PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is (no CVSS, pysaml2)
- [CVE-2019-20212](https://cve.now/CVE-2019-20212.md): The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat (no CVSS)
- [CVE-2019-19891](https://cve.now/CVE-2019-19891.md): An encryption key vulnerability on Mitel SIP-DECT wireless devices 8.0 and 8.1 could allow an attacker to launch a man-in-the-middle attack. (no CVSS)
- [CVE-2019-20211](https://cve.now/CVE-2019-20211.md): The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing A (no CVSS)
- [CVE-2020-5195](https://cve.now/CVE-2020-5195.md): Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attacker to execute arbitra (no CVSS)
- [CVE-2019-20210](https://cve.now/CVE-2019-20210.md): The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search q (no CVSS)
- [CVE-2019-20209](https://cve.now/CVE-2019-20209.md): The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Refere (no CVSS)
- [CVE-2020-6859](https://cve.now/CVE-2020-6859.md): Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for W (no CVSS)
- [CVE-2019-18894](https://cve.now/CVE-2019-18894.md): In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 2 (no CVSS)
- [CVE-2019-18893](https://cve.now/CVE-2019-18893.md): XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to (no CVSS)
- [CVE-2019-19547](https://cve.now/CVE-2019-19547.md): Symantec Endpoint Detection and Response (SEDR), prior to 4.3.0, may be susceptible to a cross site scripting (XSS) issue. (no CVSS, Symantec Endpoint Detection and Response)
- [CVE-2014-9382](https://cve.now/CVE-2014-9382.md): Freebox OS Web interface 3.0.2 has CSRF which can allow VPN user account creation (no CVSS)
- [CVE-2011-2670](https://cve.now/CVE-2011-2670.md): Mozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets (no CVSS, Mozilla Firefox)
- [CVE-2013-6225](https://cve.now/CVE-2013-6225.md): LiveZilla 5.0.1.4 has a Remote Code Execution vulnerability (no CVSS)
- [CVE-2014-5381](https://cve.now/CVE-2014-5381.md): Grand MA 300 allows a brute-force attack on the PIN. (no CVSS)
- [CVE-2014-5380](https://cve.now/CVE-2014-5380.md): Grand MA 300 allows retrieval of the access PIN from sniffed data. (no CVSS)
- [CVE-2014-6039](https://cve.now/CVE-2014-6039.md): ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. (no CVSS)
- [CVE-2014-6038](https://cve.now/CVE-2014-6038.md): Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. (no CVSS)
- [CVE-2014-6059](https://cve.now/CVE-2014-6059.md): WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite Vulnerability (no CVSS)
- [CVE-2020-6860](https://cve.now/CVE-2020-6860.md): libmysofa 0.9.1 has a stack-based buffer overflow in readDataVar in hdf/dataobject.c during the reading of a header message attribute. (no CVSS)
- [CVE-2020-6851](https://cve.now/CVE-2020-6851.md): OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj\_t1\_clbl\_decode\_processor in openjp2/t1.c because of lack of opj\_j2k\_update\_im (no CVSS)
- [CVE-2020-6848](https://cve.now/CVE-2020-6848.md): Axper Vision II 4 devices allow XSS via the DEVICE\_NAME (aka Device Name) parameter to the configWebParams.cgi URI. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.