CVEs published January 21, 2020
76 CVEs were published on January 21, 2020: 0 critical, 3 high. 1 is now in CISA KEV.
- Published
- 76
- Critical
- 0
- High
- 3
- Medium
- 5
- Low
- 0
- Unrated
- 68
- Now in CISA KEV
- 1
- Fix available
- 4
Most affected products
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 18
- Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- 5
- CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…
- 2
- Jara
- 2
- Mozilla Firefox
- 2
- Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…
- 2
- Red Hat samba
- 2
- [UNKNOWN] samba
- 1
- Facebook WhatsApp Desktop
- 1
- grin
- 1
High 3
- CVE-2020-7595xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.nokogiri
- CVE-2019-20388xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
- CVE-2019-18426A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-sFacebook WhatsApp Desktop
Medium, low and unrated 73
- CVE-2019-19414There is an integer overflow vulnerability in LDAP server of some Huawei products.CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…
- CVE-2019-19413There is an integer overflow vulnerability in LDAP client of some Huawei products.CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…
- CVE-2019-20387repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the l
- CVE-2020-1788Honor V30 smartphones with versions earlier than 10.0.1.135(C00E130R4P1) have an improper authentication vulnerability.Honor
- CVE-2019-19886Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to
- CVE-2020-7594MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitrary OS commands by na
- CVE-2020-7040storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to p
- CVE-2020-6638Grin through 2.1.1 has Insufficient Validation.grin
- CVE-2019-17584The Meinberg SyncBox/PTP/PTPv2 devices have default SSH keys which allow attackers to get root access to the devices.
- CVE-2019-17357Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when
- CVE-2020-6849The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS.
- CVE-2019-19592Jama Connect 8.44.0 is vulnerable to stored Cross-Site Scripting
- CVE-2016-11018An issue was discovered in the Huge-IT gallery-images plugin before 1.9.0 for WordPress.
- CVE-2014-2680The update process in Xmind 3.4.1 and earlier allow remote attackers to execute arbitrary code via a man-in-the-middle attack.
- CVE-2020-1840HUAWEI Mate 20 smart phones with versions earlier than 10.0.0.175(C00E70R3P8) have an insufficient authentication vulnerability.HUAWEI Mate
- CVE-2019-19411USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 haUSG9500
- CVE-2020-5202apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port.
- CVE-2019-18932log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation.
- CVE-2015-2784The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input.papercrop
- CVE-2019-19392The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new users with
- CVE-2020-6857CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key.
- CVE-2020-7213Parallels 13 uses cleartext HTTP as part of the update process, allowing man-in-the-middle attacks.
- CVE-2020-7229An issue was discovered in Simplejobscript.com SJS before 1.65.
- CVE-2020-7211tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows.
- CVE-2019-3864A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameteRed Hat quay
- CVE-2019-14768An Arbitrary File Upload issue in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to deploy a new W
- CVE-2019-14767In DIMO YellowBox CRM before 6.3.4, Path Traversal in images/Apparence (dossier=../) and servletrecuperefichier (document=../) allows an una
- CVE-2019-14766Path Traversal in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to browse the server filesystem.
- CVE-2019-14765Incorrect Access Control in AfficheExplorateurParam() in DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to use adminis
- CVE-2012-5190Prizm Content Connect 5.1 has an Arbitrary File Upload Vulnerability
- CVE-2011-5282mIRC prior to 7.22 has a message leak because chopping of outbound messages is mishandled.mIRC
- CVE-2011-4322websitebaker prior to and including 2.8.1 has an authentication error in backup module.websitebaker
- CVE-2011-4095Jara 1.6 has an XSS vulnerabilityJara
- CVE-2011-4094Jara 1.6 has a SQL injection vulnerability.Jara
- CVE-2011-2669Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates.Mozilla Firefox
- CVE-2011-2668Mozilla Firefox through 1.5.0.3 has a vulnerability in processing the content-length headerMozilla Firefox
- CVE-2020-7470Sonoff TH 10 and 16 devices with firmware 6.6.0.21 allows XSS via the Friendly Name 1 field (after a successful login with the Web Admin Pas
- CVE-2020-7246A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier.
- CVE-2019-14036Possible buffer overflow issue in error processing due to improper validation of array index value in Snapdragon Auto, Snapdragon Consumer EQualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…
- CVE-2019-2267Locked regions may be modified through other interfaces in secure boot loader image due to improper access control.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14024Possible stack-use-after-scope issue in NFC usecase for card emulation in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile in MQualcomm Snapdragon Auto, Snapdragon Industrial IOT, Snapdr…
- CVE-2019-14034Use after free while processing eeprom query as there is a chance to not unlock mutex after error occurs in Snapdragon Auto, Snapdragon CompQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14017Heap buffer overflow can occur while parsing invalid MKV clip which is not standard and have invalid vorbis codec data in Snapdragon Auto, SQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14023String format issue will occur while processing HLOS data as there is no user input validation to ensure inputs are properly NULL terminatedQualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- CVE-2019-14013While parsing invalid super index table, elements within super index table may exceed total chunk size and invalid data is read into the tabQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14014Possible buffer overflow when byte array receives incorrect input from reading source as array is not null terminated in Snapdragon ConsumerQualcomm Snapdragon Consumer IOT, Snapdragon Industrial IOT…
- CVE-2019-14016Integer overflow occurs while playing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapdraQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14008Possible null pointer dereference issue in location assistance data processing due to missing null check on resources before using it in SnaQualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- CVE-2019-14010The device may enter into error state when some tool or application gets failure at 1st buffer map all and performs 2nd buffer map which hapQualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- CVE-2019-14005Buffer overflow occur while playing the clip which is nonstandard due to lack of check of size duration in Snapdragon Auto, Snapdragon CompuQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14006Buffer overflow occur while playing the clip which is nonstandard due to lack of offset length check in Snapdragon Auto, Snapdragon Compute,Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14003Null pointer exception can happen while parsing invalid MKV clip where cue information is parsed before segment information in Snapdragon AuQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14004Buffer overflow occurs while processing invalid MKV clip, which has invalid EBML size in Snapdragon Auto, Snapdragon Compute, Snapdragon ConQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10606Out-of-bound access will occur in USB driver due to lack of check to validate the frame size passed by user in Snapdragon Auto, Snapdragon CQualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…
- CVE-2019-10611Buffer overflow can occur while processing clip due to lack of check of object size before parsing in Snapdragon Auto, Snapdragon Compute, SQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10583Use after free issue occurs when camera access sensors data through direct report mode in Snapdragon Auto, Snapdragon Compute, Snapdragon CoQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10585Possible integer overflow happens when mmap find function will increment refcount every time when it invokes and can lead to use after free Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10602Potential use-after-free heap error during Validate/Present calls on display HW composer in Snapdragon Auto, Snapdragon Compute, Snapdragon Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10581NULL is assigned to local instance of audio device pointer after free instead of global static pointer and can lead to use after free issue Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- CVE-2019-10582Use after free issue due to using of invalidated iterator to delete an object in sensors HAL in Snapdragon Auto, Snapdragon Consumer IOT, SnQualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- CVE-2019-10578Null pointer dereference can occur while parsing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectiviQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10579Buffer over-read can occur while playing the video clip which is not standard in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectivitQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10558While transferring data from APPS to DSP, Out of bound in FastRPC HLOS Driver due to the data buffer which can be controlled by DSP in SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10561Improper initialization of local variables which are parameters to sfs api may cause invalid pointer dereference and leads to denial of servQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10532Null-pointer dereference issue can occur while calculating string length when source string length is zero in Snapdragon Auto, Snapdragon CoQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- CVE-2019-10548While trying to obtain datad ipc handle during DPL initialization, Heap use-after-free issue can occur if modem SSR occurs at same time in SQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-20386An issue was discovered in button_open in login/logind-button.c in systemd before 243.
- CVE-2020-7239The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing
- CVE-2019-20385The CSV upload feature in /supervisor/procesa_carga.php on Logaritmo Aware CallManager 2012 devices allows upload of .php files with a text/
- CVE-2020-7249SMC D3G0804W 3.5.2.5-LAT_GA devices allow XSS via the SSID field on the WiFi Network Configuration page (after a successful login to the adm
- CVE-2019-14902There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4[UNKNOWN] samba
- CVE-2019-14907All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3"Red Hat samba
- CVE-2019-19344There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x verRed Hat samba