CVEs published January 16, 2020
31 CVEs were published on January 16, 2020: 2 critical, 8 high.
- Published
- 31
- Critical
- 2
- High
- 8
- Medium
- 0
- Low
- 0
- Unrated
- 21
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Foxit
- 4
- Apache CXF · org.apache.cxf:apache-cxf +1
- 2
- Broadcom brcmfmac WiFi driver
- 2
- Cisco Unified Personal Communicator
- 1
- GE PACSystems RX3i
- 1
- HPE enhanced Internet Usage Manager
- 1
- HPE Superdome Flex Server
- 1
- Siemens AG SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR…
- 1
- Siemens AG SINEMA Server
- 1
- Siemens APOGEE MEC/MBC/PXC · Siemens APOGEE PXC Compact +22
- 1
Critical 2
- CVE-2020-7047The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability
- CVE-2020-7048The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the databas
High 8
- CVE-2020-5398RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux ApplicationSpring Framework · org.springframework:spring-webmvc +1
- CVE-2019-5145An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435.Foxit
- CVE-2019-5130An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.7.0.29435.Foxit
- CVE-2019-5126An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435.Foxit
- CVE-2019-5131An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.7.0.29435.Foxit
- CVE-2019-9500Broadcom brcmfmac driver is vulnerable to a heap buffer overflowBroadcom brcmfmac WiFi driver
- CVE-2019-9503Broadcom brcmfmac driver is vulnerable to a frame validation bypassBroadcom brcmfmac WiFi driver
- CVE-2019-13939A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions < V2.8.2), APOGEE PXC Compact (BACnet) (All versions < V3.5.3),Siemens APOGEE MEC/MBC/PXC · Siemens APOGEE PXC Compact +22
Medium, low and unrated 21
- CVE-2019-15742A local privilege-escalation vulnerability exists in the Poly Plantronics Hub before 3.14 for Windows client application.
- CVE-2020-7039tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC.
- CVE-2019-3997Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.0-1.3 allows a local, unauthenticated attacker to pairSimpliSafe SS3
- CVE-2019-11998HPE Superdome Flex Server is vulnerable to multiple remote vulnerabilities via improper input validation of administrator commands.HPE Superdome Flex Server
- CVE-2019-11997A potential security vulnerability has been identified in HPE enhanced Internet Usage Manager (eIUM) versions 8.3 and 9.0.HPE enhanced Internet Usage Manager
- CVE-2019-13524GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versions(End GE PACSystems RX3i
- CVE-2019-17573By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses.Apache CXF · org.apache.cxf:apache-cxf +1
- CVE-2019-12423Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be usApache CXF · org.apache.cxf:apache-cxf +1
- CVE-2010-3048Cisco Unified Personal Communicator 7.0 (1.13056) does not free allocated memory for received data and does not perform validation if memoryCisco Unified Personal Communicator
- CVE-2019-10934A vulnerability has been identified in TIA Portal V14 (All versions), TIA Portal V15 (All versions < V15.1 Update 7), TIA Portal V16 (All veSiemens TIA Portal
- CVE-2019-10940A vulnerability has been identified in SINEMA Server (All versions < V14.0 SP2 Update 1).Siemens AG SINEMA Server
- CVE-2019-19278A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR32..-.....-....Siemens AG SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR…
- CVE-2019-18282The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f.
- CVE-2019-20327Insecure permissions in cwrapper_perl in Centreon Infrastructure Monitoring Software through 19.10 allow local attackers to gain privileges.
- CVE-2020-7108The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.
- CVE-2020-7107The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.
- CVE-2020-7106Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.ph
- CVE-2020-7105async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked.
- CVE-2020-7045In Wireshark 3.0.x before 3.0.8, the BT ATT dissector could crash.
- CVE-2020-7044In Wireshark 3.2.x before 3.2.1, the WASSP dissector could crash.
- CVE-2019-13933A vulnerability has been identified in SCALANCE X204RNA (HSR), SCALANCE X204RNA (PRP), SCALANCE X204RNA EEC (HSR), SCALANCE X204RNA EEC (PRPSiemens SCALANCE X204RNA · Siemens SCALANCE X302-7 EEC +19