# CVEs published 2020-01-14

107 CVEs were published on January 14, 2020: 1 critical, 3 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2020-5502](https://cve.now/CVE-2020-5502.md): phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships. (no CVSS, phpbb/phpbb)
- [CVE-2020-5501](https://cve.now/CVE-2020-5501.md): phpBB 3.2.8 allows a CSRF attack that can modify a group avatar. (no CVSS, phpbb/phpbb)
- [CVE-2020-0654](https://cve.now/CVE-2020-0654.md): A security feature bypass vulnerability exists in Microsoft OneDrive App for Android.This could allow an attacker to bypass the passcode or (no CVSS, Microsoft One Drive for Android)
- [CVE-2020-0656](https://cve.now/CVE-2020-0656.md): A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web req (no CVSS, Microsoft Dynamics 365 Field Service (on-premises) v7 series)
- [CVE-2020-0652](https://cve.now/CVE-2020-0652.md): A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka (no CVSS, Microsoft Office)
- [CVE-2020-0653](https://cve.now/CVE-2020-0653.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka ' (no CVSS, Microsoft Office 365 ProPlus)
- [CVE-2020-0647](https://cve.now/CVE-2020-0647.md): A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly, aka 'Microsoft Office (no CVSS, Microsoft Office Online Server)
- [CVE-2020-0650](https://cve.now/CVE-2020-0650.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka ' (no CVSS, Microsoft Office · Microsoft Excel)
- [CVE-2020-0651](https://cve.now/CVE-2020-0651.md): A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka ' (no CVSS, Microsoft Office · Microsoft Excel)
- [CVE-2020-0644](https://cve.now/CVE-2020-0644.md): An elevation of privilege vulnerability exists when Microsoft Windows implements predictable memory section names, aka 'Windows Elevation of (no CVSS, Microsoft Windows)
- [CVE-2020-0646](https://cve.now/CVE-2020-0646.md): A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote (CVSS 9.8, KEV, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2… +4)
- [CVE-2020-0642](https://cve.now/CVE-2020-0642.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k (no CVSS, Microsoft Windows)
- [CVE-2020-0643](https://cve.now/CVE-2020-0643.md): An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface Plus (GDI+) handles objects in memory, (no CVSS, Microsoft Windows)
- [CVE-2020-0640](https://cve.now/CVE-2020-0640.md): A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Cor (no CVSS, Microsoft Internet Explorer)
- [CVE-2020-0641](https://cve.now/CVE-2020-0641.md): An elevation of privilege vulnerability exists in Windows Media Service that allows file creation in arbitrary locations.To exploit the vuln (no CVSS, Microsoft Windows)
- [CVE-2020-0637](https://cve.now/CVE-2020-0637.md): An information disclosure vulnerability exists when Remote Desktop Web Access improperly handles credential information, aka 'Remote Desktop (no CVSS, Microsoft Windows Server)
- [CVE-2020-0638](https://cve.now/CVE-2020-0638.md): An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an at (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2020-0639](https://cve.now/CVE-2020-0639.md): An information disclosure vulnerability exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle objects (no CVSS, Microsoft Windows)
- [CVE-2020-0635](https://cve.now/CVE-2020-0635.md): An elevation of privilege vulnerability exists in Microsoft Windows when Windows fails to properly handle certain symbolic links, aka 'Windo (no CVSS, Microsoft Windows)
- [CVE-2020-0636](https://cve.now/CVE-2020-0636.md): An elevation of privilege vulnerability exists in the way that the Windows Subsystem for Linux handles files, aka 'Windows Subsystem for Lin (no CVSS, Microsoft Windows)
- [CVE-2020-0633](https://cve.now/CVE-2020-0633.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Ind (no CVSS, Microsoft Windows)
- [CVE-2020-0634](https://cve.now/CVE-2020-0634.md): An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, a (no CVSS, Microsoft Windows)
- [CVE-2020-0630](https://cve.now/CVE-2020-0630.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Ind (no CVSS, Microsoft Windows)
- [CVE-2020-0631](https://cve.now/CVE-2020-0631.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Ind (no CVSS, Microsoft Windows)
- [CVE-2020-0632](https://cve.now/CVE-2020-0632.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Ind (no CVSS, Microsoft Windows)
- [CVE-2020-0628](https://cve.now/CVE-2020-0628.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Ind (no CVSS, Microsoft Windows)
- [CVE-2020-0629](https://cve.now/CVE-2020-0629.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Ind (no CVSS, Microsoft Windows)
- [CVE-2020-0626](https://cve.now/CVE-2020-0626.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Ind (no CVSS, Microsoft Windows)
- [CVE-2020-0627](https://cve.now/CVE-2020-0627.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Ind (no CVSS, Microsoft Windows)
- [CVE-2020-0624](https://cve.now/CVE-2020-0624.md): An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k (no CVSS, Microsoft Windows)
- [CVE-2020-0625](https://cve.now/CVE-2020-0625.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Ind (no CVSS, Microsoft Windows)
- [CVE-2020-0622](https://cve.now/CVE-2020-0622.md): An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory, aka 'Micr (no CVSS, Microsoft Windows)
- [CVE-2020-0623](https://cve.now/CVE-2020-0623.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Ind (no CVSS, Microsoft Windows)
- [CVE-2020-0617](https://cve.now/CVE-2020-0617.md): A denial of service vulnerability exists when Microsoft Hyper-V Virtual PCI on a host server fails to properly validate input from a privile (no CVSS, Microsoft Windows)
- [CVE-2020-0620](https://cve.now/CVE-2020-0620.md): An elevation of privilege vulnerability exists when Microsoft Cryptographic Services improperly handles files, aka 'Microsoft Cryptographic (no CVSS, Microsoft Windows)
- [CVE-2020-0621](https://cve.now/CVE-2020-0621.md): A security feature bypass vulnerability exists in Windows 10 when third party filters are called during a password update, aka 'Windows Secu (no CVSS, Microsoft Windows)
- [CVE-2020-0615](https://cve.now/CVE-2020-0615.md): An information disclosure vulnerability exists in the Windows Common Log File System (CLFS) driver when it fails to properly handle objects (no CVSS, Microsoft Windows)
- [CVE-2020-0616](https://cve.now/CVE-2020-0616.md): A denial of service vulnerability exists when Windows improperly handles hard links, aka 'Microsoft Windows Denial of Service Vulnerability' (no CVSS, Microsoft Windows)
- [CVE-2020-0613](https://cve.now/CVE-2020-0613.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Ind (no CVSS, Microsoft Windows)
- [CVE-2020-0614](https://cve.now/CVE-2020-0614.md): An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Ind (no CVSS, Microsoft Windows)
- [CVE-2020-0611](https://cve.now/CVE-2020-0611.md): A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote De (no CVSS, Microsoft Windows)
- [CVE-2020-0612](https://cve.now/CVE-2020-0612.md): A denial of service vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an attacker connects to the target system using (no CVSS, Microsoft Windows Server)
- [CVE-2020-0608](https://cve.now/CVE-2020-0608.md): An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Dis (no CVSS, Microsoft Windows)
- [CVE-2020-0609](https://cve.now/CVE-2020-0609.md): A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the (no CVSS, Microsoft Windows Server)
- [CVE-2020-0610](https://cve.now/CVE-2020-0610.md): A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the (no CVSS, Microsoft Windows Server)
- [CVE-2020-0606](https://cve.now/CVE-2020-0606.md): A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who s (no CVSS, Microsoft .NET Core · Microsoft .NET Framework 4.6/4.6.1… +7)
- [CVE-2020-0607](https://cve.now/CVE-2020-0607.md): An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphi (no CVSS, Microsoft Windows)
- [CVE-2020-0603](https://cve.now/CVE-2020-0603.md): A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who su (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.All +11)
- [CVE-2020-0605](https://cve.now/CVE-2020-0605.md): A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who s (no CVSS, Microsoft .NET Core · Microsoft .NET Framework 4.6/4.6.1… +1)
- [CVE-2020-0601](https://cve.now/CVE-2020-0601.md): A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attac (CVSS 8.1, KEV, Microsoft Windows · stdlib)
- [CVE-2020-0602](https://cve.now/CVE-2020-0602.md): A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerabilit (no CVSS, Microsoft ASP.NET Core · Microsoft.AspNetCore.All +10)
- [CVE-2020-7057](https://cve.now/CVE-2020-7057.md): Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities (no CVSS)
- [CVE-2011-2715](https://cve.now/CVE-2011-2715.md): An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column nam (no CVSS, Drupal Data-module · drupal/core)
- [CVE-2011-2714](https://cve.now/CVE-2011-2714.md): A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, (no CVSS, Drupal Data-module · drupal/core)
- [CVE-2011-2706](https://cve.now/CVE-2011-2706.md): A Cross-Site Scripting (XSS) vulnerability exists in the reorder administrator functions in sNews 1.71. (no CVSS, sNews)
- [CVE-2016-6592](https://cve.now/CVE-2016-6592.md): A vulnerability was found in Symantec Norton Download Manager versions prior to 5.6. (no CVSS, Symantec Norton Download Manager)
- [CVE-2020-7054](https://cve.now/CVE-2020-7054.md): MmsValue\_decodeMmsData in mms/iso\_mms/server/mms\_access\_result.c in libIEC61850 through 1.4.0 has a heap-based buffer overflow when parsing (no CVSS)
- [CVE-2011-2933](https://cve.now/CVE-2011-2933.md): An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploa (no CVSS, WebsiteBaker)
- [CVE-2011-2934](https://cve.now/CVE-2011-2934.md): A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to inadequate (no CVSS, WebsiteBaker)
- [CVE-2018-1002104](https://cve.now/CVE-2018-1002104.md): Versions \< 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly. (CVSS 5.3, Kubernetes k8s.gcr.io/defaultbackend · k8s.io/ingress-nginx)
- [CVE-2019-16784](https://cve.now/CVE-2019-16784.md): Local Privilege Escalation present only on the Windows version of PyInstaller (CVSS 7.0, PyInstaller)
- [CVE-2011-3183](https://cve.now/CVE-2011-3183.md): A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier. (no CVSS, Concrete CMS)
- [CVE-2020-7053](https://cve.now/CVE-2020-7053.md): In the Linux kernel 4.14 longterm through 4.14.165 and 4.19 longterm through 4.19.96 (and 5.x before 5.2), there is a use-after-free (write) (no CVSS)
- [CVE-2011-3202](https://cve.now/CVE-2011-3202.md): A Cross-Site Scripting (XSS) vulnerability exists in the g parameter to index.php in Jcow CMS 4.2 and earlier. (no CVSS, Jcow CMS)
- [CVE-2011-3203](https://cve.now/CVE-2011-3203.md): A Code Execution vulnerability exists the attachment parameter to index.php in Jcow CMS 4.x to 4.2 and 5.2 to 5.2. (no CVSS, Jcow CMS)
- [CVE-2020-5180](https://cve.now/CVE-2020-5180.md): Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a maliciou (no CVSS)
- [CVE-2019-13722](https://cve.now/CVE-2019-13722.md): Inappropriate implementation in WebRTC in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corrupti (no CVSS, Google Chrome)
- [CVE-2020-6173](https://cve.now/CVE-2020-6173.md): TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption. (no CVSS, tuf)
- [CVE-2019-3981](https://cve.now/CVE-2019-3981.md): MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. (no CVSS, MikroTik WinBox)
- [CVE-2020-5509](https://cve.now/CVE-2020-5509.md): PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image. (no CVSS)
- [CVE-2020-5505](https://cve.now/CVE-2020-5505.md): Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunction with "type":"applic (no CVSS)
- [CVE-2019-13537](https://cve.now/CVE-2019-13537.md): The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buffer overflow vulnerabi (no CVSS, AVEVA Vijeo Citect and Citect SCADA)
- [CVE-2019-19548](https://cve.now/CVE-2019-19548.md): Norton Power Eraser, prior to 5.3.0.67, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an atta (no CVSS, Symantec Norton Power Eraser)
- [CVE-2015-3159](https://cve.now/CVE-2015-3159.md): The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process env (no CVSS, ABRT)
- [CVE-2020-6303](https://cve.now/CVE-2020-6303.md): SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting. (CVSS 5.4, SAP SE SAP Disclosure Management)
- [CVE-2020-6304](https://cve.now/CVE-2020-6304.md): Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22 (CVSS 5.9, SAP SE SAP NetWeaver Internet Communication Manager)
- [CVE-2020-6305](https://cve.now/CVE-2020-6305.md): PI Rest Adapter of SAP Process Integration (update provided in SAP\_XIAF 7.31, 7.40, 7.50) does not sufficiently encode user-controlled input (CVSS 6.1, SAP SE SAP Process Integration - Rest Adapter)
- [CVE-2020-6306](https://cve.now/CVE-2020-6306.md): Missing authorization check in a transaction within SAP Leasing (update provided in SAP\_APPL 6.18, EA-APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06 (CVSS 2.7, SAP SE SAP Leasing)
- [CVE-2020-6307](https://cve.now/CVE-2020-6307.md): Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform suffic (CVSS 4.3, SAP SE Automated Note Search Tool)
- [CVE-2015-3151](https://cve.now/CVE-2015-3151.md): Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change owners (no CVSS, ABRT)
- [CVE-2020-5193](https://cve.now/CVE-2020-5193.md): PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple reflected XSS vulnerabilities via the searchdata or Doctorspecializa (no CVSS)
- [CVE-2015-3150](https://cve.now/CVE-2015-3150.md): abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary files via the problem dir (no CVSS, ABRT)
- [CVE-2015-3147](https://cve.now/CVE-2015-3147.md): daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local u (no CVSS, ABRT)
- [CVE-2015-1869](https://cve.now/CVE-2015-1869.md): The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink (no CVSS, ABRT)
- [CVE-2015-2326](https://cve.now/CVE-2015-2326.md): The pcre\_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (o (no CVSS)
- [CVE-2015-2325](https://cve.now/CVE-2015-2325.md): The compile\_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out (no CVSS)
- [CVE-2015-0558](https://cve.now/CVE-2015-0558.md): The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG\_TEF\_SP\_4.06L.6, and possibly other routers, uses "1236790 (no CVSS)
- [CVE-2019-12398](https://cve.now/CVE-2019-12398.md): In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow me (no CVSS, Apache Airflow · apache-airflow)
- [CVE-2019-10995](https://cve.now/CVE-2019-10995.md): ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phas (no CVSS, ABB CP651 HMI products)
- [CVE-2020-5853](https://cve.now/CVE-2020-5853.md): In BIG-IP APM portal access on versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, when backend se (no CVSS, F5 BIG-IP APM)
- [CVE-2014-7844](https://cve.now/CVE-2014-7844.md): BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address. (no CVSS, BSD mailx)
- [CVE-2014-2271](https://cve.now/CVE-2014-2271.md): cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls bac (no CVSS)
- [CVE-2020-5852](https://cve.now/CVE-2020-5852.md): Undisclosed traffic patterns received may cause a disruption of service to the Traffic Management Microkernel (TMM). (no CVSS, F5 BIG-IP)
- [CVE-2014-5238](https://cve.now/CVE-2014-5238.md): XML external entity (XXE) vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev11 and 7.6.x before 7.6.0-rev9 allows remote attackers (no CVSS)
- [CVE-2014-5138](https://cve.now/CVE-2014-5138.md): Innovative Interfaces Sierra Library Services Platform 1.2\_3 does not properly handle query strings with multiple instances of the same para (no CVSS)
- [CVE-2014-4609](https://cve.now/CVE-2014-4609.md): Integer overflow in the get\_len function in libavutil/lzo.c in Libav before 0.8.13, 9.x before 9.14, and 10.x before 10.2 allows remote atta (no CVSS)
- [CVE-2014-4610](https://cve.now/CVE-2014-4610.md): Integer overflow in the get\_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x before (no CVSS)
- [CVE-2015-8366](https://cve.now/CVE-2015-8366.md): Array index error in smal\_decode\_segment function in LibRaw before 0.17.1 allows context-dependent attackers to cause memory errors and poss (no CVSS)
- [CVE-2015-8367](https://cve.now/CVE-2015-8367.md): The phase\_one\_correct function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute arbitrary code, related (no CVSS)
- [CVE-2020-5851](https://cve.now/CVE-2020-5851.md): On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot detect modifications to specific system c (no CVSS, BIG-IP)
- [CVE-2013-7185](https://cve.now/CVE-2013-7185.md): PotPlayer 1.5.40688: .avi File Memory Corruption (no CVSS)
- [CVE-2019-12399](https://cve.now/CVE-2019-12399.md): When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, an (no CVSS, Apache Kafka · org.apache.kafka:kafka)
- [CVE-2013-2773](https://cve.now/CVE-2013-2773.md): Nitro PDF 8.5.0.26: A specially crafted DLL file can facilitate Arbitrary Code Execution (no CVSS)
- [CVE-2019-0219](https://cve.now/CVE-2019-0219.md): A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specia (no CVSS, Apache Cordova · cordova-plugin-inappbrowser)
- [CVE-2014-9211](https://cve.now/CVE-2014-9211.md): ClickDesk version 4.3 and below has persistent cross site scripting (no CVSS)
- [CVE-2020-5194](https://cve.now/CVE-2020-5194.md): The zip API endpoint in Cerberus FTP Server 8 allows an authenticated attacker without zip permission to use the zip functionality via an un (no CVSS)
- [CVE-2020-5196](https://cve.now/CVE-2020-5196.md): Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 allows an authenticated attacker to create files, display hidden (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.