CVEs published January 22, 2020
53 CVEs were published on January 22, 2020: 0 critical, 1 high.
- Published
- 53
- Critical
- 0
- High
- 1
- Medium
- 3
- Low
- 0
- Unrated
- 49
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Honeywell Maxpro VMS & NVR
- 2
- UseBB
- 2
- Vanilla Forums
- 2
- Advanced Electron Forums
- 1
- BibTeX-ruby
- 1
- FluxBB
- 1
- Forcepoint Web Security
- 1
- Gallery Plugin authors Gallery
- 1
- ImpressPages CMS · impresspages/impresspages
- 1
- Joomla!
- 1
High 1
Medium, low and unrated 52
- CVE-2019-20399A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak libsecp256k1-rs
- CVE-2020-7915An issue was discovered on Eaton 5P 850 devices.
- CVE-2019-19840A stack-based buffer overflow in zap_parse_args in zap.c in zap in Ruckus Unleashed through 200.7.10.102.64 allows remote code execution via
- CVE-2019-19842emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribu
- CVE-2019-19841emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribu
- CVE-2011-3622A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18.Phorum
- CVE-2016-4761WebKitGTK+ before 2.14.0: A use-after-free vulnerability can allow remote attackers to cause a DoSWebKitGTK+
- CVE-2020-5221Directory Traversal (Chroot Escape) vulnerability in uftpdtroglobit uftpd
- CVE-2019-19843Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an una
- CVE-2019-19836AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote code execution via a POST request that uses
- CVE-2019-19834Directory Traversal in ruckus_cli2 in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote attacker to jailbreak the CLI via en
- CVE-2012-4919Gallery Plugin1.4 for WordPress has a Remote File Include VulnerabilityGallery Plugin authors Gallery
- CVE-2019-5647Rapid7 AppSpider Chrome Plugin Insufficient Session ExpirationRapid7 AppSpider
- CVE-2011-3621A reverse proxy issue exists in FluxBB before 1.4.7 when FORUM_BEHIND_REVERSE_PROXY is enabled.FluxBB
- CVE-2011-3614An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9.Vanilla Forums
- CVE-2011-3613An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.Vanilla Forums
- CVE-2011-3612Cross-Site Request Forgery (CSRF) vulnerability exists in panel.php in UseBB before 1.0.12.UseBB
- CVE-2019-6146It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host header injection.Forcepoint Web Security
- CVE-2020-7109The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template.
- CVE-2011-3611A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12.UseBB
- CVE-2011-3610A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud parameter to plugins/serendiserendipity freetag plugin
- CVE-2011-3595Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and auJoomla!
- CVE-2011-3582A Cross-site Request Forgery (CSRF) vulnerability exists in Advanced Electron Forums (AEF) through 1.0.9 due to inadequate confirmation for Advanced Electron Forums
- CVE-2020-6960The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMHoneywell Maxpro VMS & NVR
- CVE-2020-6959The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VMHoneywell Maxpro VMS & NVR
- CVE-2020-7228The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms.
- CVE-2019-6858A CWE-427:Uncontrolled Search Path Element vulnerability exists in MSX Configurator (Software Version prior to V1.0.8.1), which could cause MSX Configurator
- CVE-2019-10781In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used witSnyk schema-inspector · schema-inspector
- CVE-2019-10780BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.openBibTeX-ruby
- CVE-2018-16272The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to
- CVE-2018-16271The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulat
- CVE-2018-16270Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction.
- CVE-2018-16269The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notification message data, d
- CVE-2018-16268The SoundServer/FocusServer system services in Tizen allow an unprivileged process to perform media-related system actions, due to improper
- CVE-2018-16267The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to improper D-Bus secur
- CVE-2018-16265The bt/bt_core system service in Tizen allows an unprivileged process to create a system user interface and control the Bluetooth pairing pr
- CVE-2018-16264The BlueZ system service in Tizen allows an unprivileged process to partially control Bluetooth or acquire sensitive information, due to imp
- CVE-2018-16263The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to improper D-Bus security poli
- CVE-2018-16262The pkgmgr system service in Tizen allows an unprivileged process to perform package management actions, due to improper D-Bus security poli
- CVE-2018-16266The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to improper D-Bus security
- CVE-2011-4943ImpressPages CMS v1.0.12 has Unspecified Remote Code Execution (fixed in v1.0.13)ImpressPages CMS · impresspages/impresspages
- CVE-2019-12490An issue was discovered in Simple Machines Forum (SMF) before 2.0.16.
- CVE-2019-16791downgrade of effective Strict Transport Security (STS) policy in postfix-mta-sts-resolverSnawoot postfix-mta-sts-resolver · postfix-mta-sts-resolver
- CVE-2018-17981Lifesize Express ls ex2_4.7.10 2000 (14) devices allow XSS via the interface/interface.php brand parameter.
- CVE-2019-20391An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is u
- CVE-2019-20392An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is u
- CVE-2019-20393A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used.
- CVE-2019-20394A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement.
- CVE-2019-20395A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs.
- CVE-2019-20396A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys_parse_path parsin
- CVE-2019-20397A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated.
- CVE-2019-20398A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a copy of unresolved e