# CVEs published 2020-01-21

76 CVEs were published on January 21, 2020: 0 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-19414](https://cve.now/CVE-2019-19414.md): There is an integer overflow vulnerability in LDAP server of some Huawei products. (no CVSS, CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…)
- [CVE-2019-19413](https://cve.now/CVE-2019-19413.md): There is an integer overflow vulnerability in LDAP client of some Huawei products. (no CVSS, CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…)
- [CVE-2020-7595](https://cve.now/CVE-2020-7595.md): xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. (CVSS 7.5, nokogiri)
- [CVE-2019-20387](https://cve.now/CVE-2019-20387.md): repodata\_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the l (no CVSS)
- [CVE-2019-20388](https://cve.now/CVE-2019-20388.md): xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak. (CVSS 7.5)
- [CVE-2020-1788](https://cve.now/CVE-2020-1788.md): Honor V30 smartphones with versions earlier than 10.0.1.135(C00E130R4P1) have an improper authentication vulnerability. (no CVSS, Honor)
- [CVE-2019-19886](https://cve.now/CVE-2019-19886.md): Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to (no CVSS)
- [CVE-2020-7594](https://cve.now/CVE-2020-7594.md): MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitrary OS commands by na (no CVSS)
- [CVE-2019-18426](https://cve.now/CVE-2019-18426.md): A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-s (CVSS 8.2, KEV, Facebook WhatsApp Desktop)
- [CVE-2020-7040](https://cve.now/CVE-2020-7040.md): storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to p (no CVSS)
- [CVE-2020-6638](https://cve.now/CVE-2020-6638.md): Grin through 2.1.1 has Insufficient Validation. (no CVSS, grin)
- [CVE-2019-17584](https://cve.now/CVE-2019-17584.md): The Meinberg SyncBox/PTP/PTPv2 devices have default SSH keys which allow attackers to get root access to the devices. (no CVSS)
- [CVE-2019-17357](https://cve.now/CVE-2019-17357.md): Cacti through 1.2.7 is affected by a graphs.php?template\_id= SQL injection vulnerability affecting how template identifiers are handled when (no CVSS)
- [CVE-2020-6849](https://cve.now/CVE-2020-6849.md): The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo\_fat CSRF with resultant XSS. (no CVSS)
- [CVE-2019-19592](https://cve.now/CVE-2019-19592.md): Jama Connect 8.44.0 is vulnerable to stored Cross-Site Scripting (no CVSS)
- [CVE-2016-11018](https://cve.now/CVE-2016-11018.md): An issue was discovered in the Huge-IT gallery-images plugin before 1.9.0 for WordPress. (no CVSS)
- [CVE-2014-2680](https://cve.now/CVE-2014-2680.md): The update process in Xmind 3.4.1 and earlier allow remote attackers to execute arbitrary code via a man-in-the-middle attack. (no CVSS)
- [CVE-2020-1840](https://cve.now/CVE-2020-1840.md): HUAWEI Mate 20 smart phones with versions earlier than 10.0.0.175(C00E70R3P8) have an insufficient authentication vulnerability. (no CVSS, HUAWEI Mate)
- [CVE-2019-19411](https://cve.now/CVE-2019-19411.md): USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 ha (no CVSS, USG9500)
- [CVE-2020-5202](https://cve.now/CVE-2020-5202.md): apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port. (no CVSS)
- [CVE-2019-18932](https://cve.now/CVE-2019-18932.md): log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. (no CVSS)
- [CVE-2015-2784](https://cve.now/CVE-2015-2784.md): The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input. (no CVSS, papercrop)
- [CVE-2019-19392](https://cve.now/CVE-2019-19392.md): The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new users with (no CVSS)
- [CVE-2020-6857](https://cve.now/CVE-2020-6857.md): CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. (no CVSS)
- [CVE-2020-7213](https://cve.now/CVE-2020-7213.md): Parallels 13 uses cleartext HTTP as part of the update process, allowing man-in-the-middle attacks. (no CVSS)
- [CVE-2020-7229](https://cve.now/CVE-2020-7229.md): An issue was discovered in Simplejobscript.com SJS before 1.65. (no CVSS)
- [CVE-2020-7211](https://cve.now/CVE-2020-7211.md): tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\\ directory traversal on Windows. (no CVSS)
- [CVE-2019-3864](https://cve.now/CVE-2019-3864.md): A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific paramete (CVSS 5.4, Red Hat quay)
- [CVE-2019-14768](https://cve.now/CVE-2019-14768.md): An Arbitrary File Upload issue in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to deploy a new W (no CVSS)
- [CVE-2019-14767](https://cve.now/CVE-2019-14767.md): In DIMO YellowBox CRM before 6.3.4, Path Traversal in images/Apparence (dossier=../) and servletrecuperefichier (document=../) allows an una (no CVSS)
- [CVE-2019-14766](https://cve.now/CVE-2019-14766.md): Path Traversal in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to browse the server filesystem. (no CVSS)
- [CVE-2019-14765](https://cve.now/CVE-2019-14765.md): Incorrect Access Control in AfficheExplorateurParam() in DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to use adminis (no CVSS)
- [CVE-2012-5190](https://cve.now/CVE-2012-5190.md): Prizm Content Connect 5.1 has an Arbitrary File Upload Vulnerability (no CVSS)
- [CVE-2011-5282](https://cve.now/CVE-2011-5282.md): mIRC prior to 7.22 has a message leak because chopping of outbound messages is mishandled. (no CVSS, mIRC)
- [CVE-2011-4322](https://cve.now/CVE-2011-4322.md): websitebaker prior to and including 2.8.1 has an authentication error in backup module. (no CVSS, websitebaker)
- [CVE-2011-4095](https://cve.now/CVE-2011-4095.md): Jara 1.6 has an XSS vulnerability (no CVSS, Jara)
- [CVE-2011-4094](https://cve.now/CVE-2011-4094.md): Jara 1.6 has a SQL injection vulnerability. (no CVSS, Jara)
- [CVE-2011-2669](https://cve.now/CVE-2011-2669.md): Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates. (no CVSS, Mozilla Firefox)
- [CVE-2011-2668](https://cve.now/CVE-2011-2668.md): Mozilla Firefox through 1.5.0.3 has a vulnerability in processing the content-length header (no CVSS, Mozilla Firefox)
- [CVE-2020-7470](https://cve.now/CVE-2020-7470.md): Sonoff TH 10 and 16 devices with firmware 6.6.0.21 allows XSS via the Friendly Name 1 field (after a successful login with the Web Admin Pas (no CVSS)
- [CVE-2020-7246](https://cve.now/CVE-2020-7246.md): A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. (no CVSS)
- [CVE-2019-14036](https://cve.now/CVE-2019-14036.md): Possible buffer overflow issue in error processing due to improper validation of array index value in Snapdragon Auto, Snapdragon Consumer E (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-2267](https://cve.now/CVE-2019-2267.md): Locked regions may be modified through other interfaces in secure boot loader image due to improper access control. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14024](https://cve.now/CVE-2019-14024.md): Possible stack-use-after-scope issue in NFC usecase for card emulation in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile in M (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Industrial IOT, Snapdr…)
- [CVE-2019-14034](https://cve.now/CVE-2019-14034.md): Use after free while processing eeprom query as there is a chance to not unlock mutex after error occurs in Snapdragon Auto, Snapdragon Comp (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14017](https://cve.now/CVE-2019-14017.md): Heap buffer overflow can occur while parsing invalid MKV clip which is not standard and have invalid vorbis codec data in Snapdragon Auto, S (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14023](https://cve.now/CVE-2019-14023.md): String format issue will occur while processing HLOS data as there is no user input validation to ensure inputs are properly NULL terminated (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-14013](https://cve.now/CVE-2019-14013.md): While parsing invalid super index table, elements within super index table may exceed total chunk size and invalid data is read into the tab (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14014](https://cve.now/CVE-2019-14014.md): Possible buffer overflow when byte array receives incorrect input from reading source as array is not null terminated in Snapdragon Consumer (no CVSS, Qualcomm Snapdragon Consumer IOT, Snapdragon Industrial IOT…)
- [CVE-2019-14016](https://cve.now/CVE-2019-14016.md): Integer overflow occurs while playing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdra (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14008](https://cve.now/CVE-2019-14008.md): Possible null pointer dereference issue in location assistance data processing due to missing null check on resources before using it in Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-14010](https://cve.now/CVE-2019-14010.md): The device may enter into error state when some tool or application gets failure at 1st buffer map all and performs 2nd buffer map which hap (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-14005](https://cve.now/CVE-2019-14005.md): Buffer overflow occur while playing the clip which is nonstandard due to lack of check of size duration in Snapdragon Auto, Snapdragon Compu (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14006](https://cve.now/CVE-2019-14006.md): Buffer overflow occur while playing the clip which is nonstandard due to lack of offset length check in Snapdragon Auto, Snapdragon Compute, (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14003](https://cve.now/CVE-2019-14003.md): Null pointer exception can happen while parsing invalid MKV clip where cue information is parsed before segment information in Snapdragon Au (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14004](https://cve.now/CVE-2019-14004.md): Buffer overflow occurs while processing invalid MKV clip, which has invalid EBML size in Snapdragon Auto, Snapdragon Compute, Snapdragon Con (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10606](https://cve.now/CVE-2019-10606.md): Out-of-bound access will occur in USB driver due to lack of check to validate the frame size passed by user in Snapdragon Auto, Snapdragon C (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-10611](https://cve.now/CVE-2019-10611.md): Buffer overflow can occur while processing clip due to lack of check of object size before parsing in Snapdragon Auto, Snapdragon Compute, S (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10583](https://cve.now/CVE-2019-10583.md): Use after free issue occurs when camera access sensors data through direct report mode in Snapdragon Auto, Snapdragon Compute, Snapdragon Co (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10585](https://cve.now/CVE-2019-10585.md): Possible integer overflow happens when mmap find function will increment refcount every time when it invokes and can lead to use after free (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10602](https://cve.now/CVE-2019-10602.md): Potential use-after-free heap error during Validate/Present calls on display HW composer in Snapdragon Auto, Snapdragon Compute, Snapdragon (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10581](https://cve.now/CVE-2019-10581.md): NULL is assigned to local instance of audio device pointer after free instead of global static pointer and can lead to use after free issue (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-10582](https://cve.now/CVE-2019-10582.md): Use after free issue due to using of invalidated iterator to delete an object in sensors HAL in Snapdragon Auto, Snapdragon Consumer IOT, Sn (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-10578](https://cve.now/CVE-2019-10578.md): Null pointer dereference can occur while parsing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivi (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10579](https://cve.now/CVE-2019-10579.md): Buffer over-read can occur while playing the video clip which is not standard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivit (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10558](https://cve.now/CVE-2019-10558.md): While transferring data from APPS to DSP, Out of bound in FastRPC HLOS Driver due to the data buffer which can be controlled by DSP in Snapd (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10561](https://cve.now/CVE-2019-10561.md): Improper initialization of local variables which are parameters to sfs api may cause invalid pointer dereference and leads to denial of serv (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10532](https://cve.now/CVE-2019-10532.md): Null-pointer dereference issue can occur while calculating string length when source string length is zero in Snapdragon Auto, Snapdragon Co (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2019-10548](https://cve.now/CVE-2019-10548.md): While trying to obtain datad ipc handle during DPL initialization, Heap use-after-free issue can occur if modem SSR occurs at same time in S (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-20386](https://cve.now/CVE-2019-20386.md): An issue was discovered in button\_open in login/logind-button.c in systemd before 243. (CVSS 5.1)
- [CVE-2020-7239](https://cve.now/CVE-2020-7239.md): The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing (no CVSS)
- [CVE-2019-20385](https://cve.now/CVE-2019-20385.md): The CSV upload feature in /supervisor/procesa\_carga.php on Logaritmo Aware CallManager 2012 devices allows upload of .php files with a text/ (no CVSS)
- [CVE-2020-7249](https://cve.now/CVE-2020-7249.md): SMC D3G0804W 3.5.2.5-LAT\_GA devices allow XSS via the SSID field on the WiFi Network Configuration page (after a successful login to the adm (no CVSS)
- [CVE-2019-14902](https://cve.now/CVE-2019-14902.md): There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4 (CVSS 5.4, \[UNKNOWN\] samba)
- [CVE-2019-14907](https://cve.now/CVE-2019-14907.md): All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (CVSS 6.5, Red Hat samba)
- [CVE-2019-19344](https://cve.now/CVE-2019-19344.md): There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x ver (CVSS 6.5, Red Hat samba)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.