# CVEs published 2020-01-20

9 CVEs were published on January 20, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2019-20384](https://cve.now/CVE-2019-20384.md): Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging acc (no CVSS)
- [CVE-2020-7242](https://cve.now/CVE-2020-7242.md): Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Diagn (no CVSS)
- [CVE-2020-7243](https://cve.now/CVE-2020-7243.md): Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Fetch (no CVSS)
- [CVE-2020-7244](https://cve.now/CVE-2020-7244.md): Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Poll (no CVSS)
- [CVE-2020-7241](https://cve.now/CVE-2020-7241.md): The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. (no CVSS)
- [CVE-2020-7240](https://cve.now/CVE-2020-7240.md): Meinberg Lantime M300 and M1000 devices allow attackers (with privileges to configure a device) to execute arbitrary OS commands by editing (no CVSS)
- [CVE-2020-7215](https://cve.now/CVE-2020-7215.md): An issue was discovered in Gallagher Command Centre 7.x before 7.90.991(MR5), 8.00 before 8.00.1161(MR5), and 8.10 before 8.10.1134(MR4). (no CVSS)
- [CVE-2019-20381](https://cve.now/CVE-2019-20381.md): TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. (no CVSS)
- [CVE-2020-7237](https://cve.now/CVE-2020-7237.md): Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller\_a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.