CVEs published January 14, 2020
107 CVEs were published on January 14, 2020: 1 critical, 3 high. 3 are now in CISA KEV.
- Published
- 107
- Critical
- 1
- High
- 3
- Medium
- 5
- Low
- 1
- Unrated
- 97
- Now in CISA KEV
- 3
- Fix available
- 18
Most affected products
- Microsoft Windows
- 31
- ABRT
- 5
- Microsoft Windows Server
- 4
- Drupal Data-module · drupal/core
- 2
- Jcow CMS
- 2
- Microsoft Office · Microsoft Excel
- 2
- phpbb/phpbb
- 2
- WebsiteBaker
- 2
- ABB CP651 HMI products
- 1
- Apache Airflow · apache-airflow
- 1
Critical 1
High 3
- CVE-2020-0638An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an atMicrosoft Windows
- CVE-2020-0601A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacMicrosoft Windows · stdlib
- CVE-2019-16784Local Privilege Escalation present only on the Windows version of PyInstallerPyInstaller
Medium, low and unrated 103
- CVE-2020-5502phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.phpbb/phpbb
- CVE-2020-5501phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.phpbb/phpbb
- CVE-2020-0654A security feature bypass vulnerability exists in Microsoft OneDrive App for Android.This could allow an attacker to bypass the passcode or Microsoft One Drive for Android
- CVE-2020-0656A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web reqMicrosoft Dynamics 365 Field Service (on-premises) v7 series
- CVE-2020-0652A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka Microsoft Office
- CVE-2020-0653A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Office 365 ProPlus
- CVE-2020-0647A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Microsoft Office Online Server
- CVE-2020-0650A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Office · Microsoft Excel
- CVE-2020-0651A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Office · Microsoft Excel
- CVE-2020-0644An elevation of privilege vulnerability exists when Microsoft Windows implements predictable memory section names, aka 'Windows Elevation ofMicrosoft Windows
- CVE-2020-0642An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2020-0643An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface Plus (GDI+) handles objects in memory, Microsoft Windows
- CVE-2020-0640A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2020-0641An elevation of privilege vulnerability exists in Windows Media Service that allows file creation in arbitrary locations.To exploit the vulnMicrosoft Windows
- CVE-2020-0637An information disclosure vulnerability exists when Remote Desktop Web Access improperly handles credential information, aka 'Remote DesktopMicrosoft Windows Server
- CVE-2020-0639An information disclosure vulnerability exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle objects Microsoft Windows
- CVE-2020-0635An elevation of privilege vulnerability exists in Microsoft Windows when Windows fails to properly handle certain symbolic links, aka 'WindoMicrosoft Windows
- CVE-2020-0636An elevation of privilege vulnerability exists in the way that the Windows Subsystem for Linux handles files, aka 'Windows Subsystem for LinMicrosoft Windows
- CVE-2020-0633An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search IndMicrosoft Windows
- CVE-2020-0634An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aMicrosoft Windows
- CVE-2020-0630An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search IndMicrosoft Windows
- CVE-2020-0631An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search IndMicrosoft Windows
- CVE-2020-0632An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search IndMicrosoft Windows
- CVE-2020-0628An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search IndMicrosoft Windows
- CVE-2020-0629An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search IndMicrosoft Windows
- CVE-2020-0626An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search IndMicrosoft Windows
- CVE-2020-0627An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search IndMicrosoft Windows
- CVE-2020-0624An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2020-0625An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search IndMicrosoft Windows
- CVE-2020-0622An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory, aka 'MicrMicrosoft Windows
- CVE-2020-0623An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search IndMicrosoft Windows
- CVE-2020-0617A denial of service vulnerability exists when Microsoft Hyper-V Virtual PCI on a host server fails to properly validate input from a privileMicrosoft Windows
- CVE-2020-0620An elevation of privilege vulnerability exists when Microsoft Cryptographic Services improperly handles files, aka 'Microsoft Cryptographic Microsoft Windows
- CVE-2020-0621A security feature bypass vulnerability exists in Windows 10 when third party filters are called during a password update, aka 'Windows SecuMicrosoft Windows
- CVE-2020-0615An information disclosure vulnerability exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle objects Microsoft Windows
- CVE-2020-0616A denial of service vulnerability exists when Windows improperly handles hard links, aka 'Microsoft Windows Denial of Service Vulnerability'Microsoft Windows
- CVE-2020-0613An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search IndMicrosoft Windows
- CVE-2020-0614An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search IndMicrosoft Windows
- CVE-2020-0611A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote DeMicrosoft Windows
- CVE-2020-0612A denial of service vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an attacker connects to the target system usingMicrosoft Windows Server
- CVE-2020-0608An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information DisMicrosoft Windows
- CVE-2020-0609A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to theMicrosoft Windows Server
- CVE-2020-0610A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to theMicrosoft Windows Server
- CVE-2020-0606A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who sMicrosoft .NET Core · Microsoft .NET Framework 4.6/4.6.1… +7
- CVE-2020-0607An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft GraphiMicrosoft Windows
- CVE-2020-0603A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who suMicrosoft ASP.NET Core · Microsoft.AspNetCore.All +11
- CVE-2020-0605A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who sMicrosoft .NET Core · Microsoft .NET Framework 4.6/4.6.1… +1
- CVE-2020-0602A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service VulnerabilitMicrosoft ASP.NET Core · Microsoft.AspNetCore.All +10
- CVE-2020-7057Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities
- CVE-2011-2715An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column namDrupal Data-module · drupal/core
- CVE-2011-2714A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions,Drupal Data-module · drupal/core
- CVE-2011-2706A Cross-Site Scripting (XSS) vulnerability exists in the reorder administrator functions in sNews 1.71.sNews
- CVE-2016-6592A vulnerability was found in Symantec Norton Download Manager versions prior to 5.6.Symantec Norton Download Manager
- CVE-2020-7054MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c in libIEC61850 through 1.4.0 has a heap-based buffer overflow when parsing
- CVE-2011-2933An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploaWebsiteBaker
- CVE-2011-2934A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to inadequate WebsiteBaker
- CVE-2018-1002104Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.Kubernetes k8s.gcr.io/defaultbackend · k8s.io/ingress-nginx
- CVE-2011-3183A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier.Concrete CMS
- CVE-2020-7053In the Linux kernel 4.14 longterm through 4.14.165 and 4.19 longterm through 4.19.96 (and 5.x before 5.2), there is a use-after-free (write)
- CVE-2011-3202A Cross-Site Scripting (XSS) vulnerability exists in the g parameter to index.php in Jcow CMS 4.2 and earlier.Jcow CMS
- CVE-2011-3203A Code Execution vulnerability exists the attachment parameter to index.php in Jcow CMS 4.x to 4.2 and 5.2 to 5.2.Jcow CMS
- CVE-2020-5180Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a maliciou
- CVE-2019-13722Inappropriate implementation in WebRTC in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruptiGoogle Chrome
- CVE-2020-6173TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.tuf
- CVE-2019-3981MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks.MikroTik WinBox
- CVE-2020-5509PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image.
- CVE-2020-5505Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunction with "type":"applic
- CVE-2019-13537The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buffer overflow vulnerabiAVEVA Vijeo Citect and Citect SCADA
- CVE-2019-19548Norton Power Eraser, prior to 5.3.0.67, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attaSymantec Norton Power Eraser
- CVE-2015-3159The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process envABRT
- CVE-2020-6303SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting.SAP SE SAP Disclosure Management
- CVE-2020-6304Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22SAP SE SAP NetWeaver Internet Communication Manager
- CVE-2020-6305PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode user-controlled inputSAP SE SAP Process Integration - Rest Adapter
- CVE-2020-6306Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06SAP SE SAP Leasing
- CVE-2020-6307Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform sufficSAP SE Automated Note Search Tool
- CVE-2015-3151Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownersABRT
- CVE-2020-5193PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple reflected XSS vulnerabilities via the searchdata or Doctorspecializa
- CVE-2015-3150abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary files via the problem dirABRT
- CVE-2015-3147daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local uABRT
- CVE-2015-1869The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink ABRT
- CVE-2015-2326The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (o
- CVE-2015-2325The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out
- CVE-2015-0558The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6, and possibly other routers, uses "1236790
- CVE-2019-12398In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow meApache Airflow · apache-airflow
- CVE-2019-10995ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phasABB CP651 HMI products
- CVE-2020-5853In BIG-IP APM portal access on versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, when backend seF5 BIG-IP APM
- CVE-2014-7844BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.BSD mailx
- CVE-2014-2271cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls bac
- CVE-2020-5852Undisclosed traffic patterns received may cause a disruption of service to the Traffic Management Microkernel (TMM).F5 BIG-IP
- CVE-2014-5238XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers
- CVE-2014-5138Innovative Interfaces Sierra Library Services Platform 1.2_3 does not properly handle query strings with multiple instances of the same para
- CVE-2014-4609Integer overflow in the get_len function in libavutil/lzo.c in Libav before 0.8.13, 9.x before 9.14, and 10.x before 10.2 allows remote atta
- CVE-2014-4610Integer overflow in the get_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x before
- CVE-2015-8366Array index error in smal_decode_segment function in LibRaw before 0.17.1 allows context-dependent attackers to cause memory errors and poss
- CVE-2015-8367The phase_one_correct function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute arbitrary code, related
- CVE-2020-5851On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot detect modifications to specific system cBIG-IP
- CVE-2013-7185PotPlayer 1.5.40688: .avi File Memory Corruption
- CVE-2019-12399When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, anApache Kafka · org.apache.kafka:kafka
- CVE-2013-2773Nitro PDF 8.5.0.26: A specially crafted DLL file can facilitate Arbitrary Code Execution
- CVE-2019-0219A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a speciaApache Cordova · cordova-plugin-inappbrowser
- CVE-2014-9211ClickDesk version 4.3 and below has persistent cross site scripting
- CVE-2020-5194The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip functionality via an un
- CVE-2020-5196Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create files, display hidden