# CVEs published 2020-01-22

53 CVEs were published on January 22, 2020: 0 critical, 1 high. Days are UTC.

- [CVE-2019-20399](https://cve.now/CVE-2019-20399.md): A timing vulnerability in the Scalar::check\_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak (no CVSS, libsecp256k1-rs)
- [CVE-2020-7915](https://cve.now/CVE-2020-7915.md): An issue was discovered on Eaton 5P 850 devices. (no CVSS)
- [CVE-2019-19840](https://cve.now/CVE-2019-19840.md): A stack-based buffer overflow in zap\_parse\_args in zap.c in zap in Ruckus Unleashed through 200.7.10.102.64 allows remote code execution via (no CVSS)
- [CVE-2019-19842](https://cve.now/CVE-2019-19842.md): emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribu (no CVSS)
- [CVE-2019-19841](https://cve.now/CVE-2019-19841.md): emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribu (no CVSS)
- [CVE-2011-3622](https://cve.now/CVE-2011-3622.md): A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18. (no CVSS, Phorum)
- [CVE-2016-4761](https://cve.now/CVE-2016-4761.md): WebKitGTK+ before 2.14.0: A use-after-free vulnerability can allow remote attackers to cause a DoS (no CVSS, WebKitGTK+)
- [CVE-2020-5221](https://cve.now/CVE-2020-5221.md): Directory Traversal (Chroot Escape) vulnerability in uftpd (CVSS 6.5, troglobit uftpd)
- [CVE-2019-19843](https://cve.now/CVE-2019-19843.md): Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an una (no CVSS)
- [CVE-2019-16792](https://cve.now/CVE-2019-16792.md): HTTP Request Smuggling: Content-Length Sent Twice in Waitress (CVSS 7.1, Pylons Waitress · waitress)
- [CVE-2019-19836](https://cve.now/CVE-2019-19836.md): AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote code execution via a POST request that uses (no CVSS)
- [CVE-2019-19834](https://cve.now/CVE-2019-19834.md): Directory Traversal in ruckus\_cli2 in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote attacker to jailbreak the CLI via en (no CVSS)
- [CVE-2012-4919](https://cve.now/CVE-2012-4919.md): Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability (no CVSS, Gallery Plugin authors Gallery)
- [CVE-2019-5647](https://cve.now/CVE-2019-5647.md): Rapid7 AppSpider Chrome Plugin Insufficient Session Expiration (CVSS 4.4, Rapid7 AppSpider)
- [CVE-2011-3621](https://cve.now/CVE-2011-3621.md): A reverse proxy issue exists in FluxBB before 1.4.7 when FORUM\_BEHIND\_REVERSE\_PROXY is enabled. (no CVSS, FluxBB)
- [CVE-2011-3614](https://cve.now/CVE-2011-3614.md): An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9. (no CVSS, Vanilla Forums)
- [CVE-2011-3613](https://cve.now/CVE-2011-3613.md): An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled. (no CVSS, Vanilla Forums)
- [CVE-2011-3612](https://cve.now/CVE-2011-3612.md): Cross-Site Request Forgery (CSRF) vulnerability exists in panel.php in UseBB before 1.0.12. (no CVSS, UseBB)
- [CVE-2019-6146](https://cve.now/CVE-2019-6146.md): It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host header injection. (no CVSS, Forcepoint Web Security)
- [CVE-2020-7109](https://cve.now/CVE-2020-7109.md): The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template. (no CVSS)
- [CVE-2011-3611](https://cve.now/CVE-2011-3611.md): A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12. (no CVSS, UseBB)
- [CVE-2011-3610](https://cve.now/CVE-2011-3610.md): A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud parameter to plugins/serendi (no CVSS, serendipity freetag plugin)
- [CVE-2011-3595](https://cve.now/CVE-2011-3595.md): Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and au (no CVSS, Joomla!)
- [CVE-2011-3582](https://cve.now/CVE-2011-3582.md): A Cross-site Request Forgery (CSRF) vulnerability exists in Advanced Electron Forums (AEF) through 1.0.9 due to inadequate confirmation for (no CVSS, Advanced Electron Forums)
- [CVE-2020-6960](https://cve.now/CVE-2020-6960.md): The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VM (no CVSS, Honeywell Maxpro VMS & NVR)
- [CVE-2020-6959](https://cve.now/CVE-2020-6959.md): The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT prior to Version VM (no CVSS, Honeywell Maxpro VMS & NVR)
- [CVE-2020-7228](https://cve.now/CVE-2020-7228.md): The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. (no CVSS)
- [CVE-2019-6858](https://cve.now/CVE-2019-6858.md): A CWE-427:Uncontrolled Search Path Element vulnerability exists in MSX Configurator (Software Version prior to V1.0.8.1), which could cause (no CVSS, MSX Configurator)
- [CVE-2019-10781](https://cve.now/CVE-2019-10781.md): In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the \`sanitize()\` and the \`validate()\` function used wit (no CVSS, Snyk schema-inspector · schema-inspector)
- [CVE-2019-10780](https://cve.now/CVE-2019-10780.md): BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open (no CVSS, BibTeX-ruby)
- [CVE-2018-16272](https://cve.now/CVE-2018-16272.md): The wpa\_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to (no CVSS)
- [CVE-2018-16271](https://cve.now/CVE-2018-16271.md): The wemail\_consumer\_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulat (no CVSS)
- [CVE-2018-16270](https://cve.now/CVE-2018-16270.md): Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. (no CVSS)
- [CVE-2018-16269](https://cve.now/CVE-2018-16269.md): The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notification message data, d (no CVSS)
- [CVE-2018-16268](https://cve.now/CVE-2018-16268.md): The SoundServer/FocusServer system services in Tizen allow an unprivileged process to perform media-related system actions, due to improper (no CVSS)
- [CVE-2018-16267](https://cve.now/CVE-2018-16267.md): The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to improper D-Bus secur (no CVSS)
- [CVE-2018-16265](https://cve.now/CVE-2018-16265.md): The bt/bt\_core system service in Tizen allows an unprivileged process to create a system user interface and control the Bluetooth pairing pr (no CVSS)
- [CVE-2018-16264](https://cve.now/CVE-2018-16264.md): The BlueZ system service in Tizen allows an unprivileged process to partially control Bluetooth or acquire sensitive information, due to imp (no CVSS)
- [CVE-2018-16263](https://cve.now/CVE-2018-16263.md): The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to improper D-Bus security poli (no CVSS)
- [CVE-2018-16262](https://cve.now/CVE-2018-16262.md): The pkgmgr system service in Tizen allows an unprivileged process to perform package management actions, due to improper D-Bus security poli (no CVSS)
- [CVE-2018-16266](https://cve.now/CVE-2018-16266.md): The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to improper D-Bus security (no CVSS)
- [CVE-2011-4943](https://cve.now/CVE-2011-4943.md): ImpressPages CMS v1.0.12 has Unspecified Remote Code Execution (fixed in v1.0.13) (no CVSS, ImpressPages CMS · impresspages/impresspages)
- [CVE-2019-12490](https://cve.now/CVE-2019-12490.md): An issue was discovered in Simple Machines Forum (SMF) before 2.0.16. (no CVSS)
- [CVE-2019-16791](https://cve.now/CVE-2019-16791.md): downgrade of effective Strict Transport Security (STS) policy in postfix-mta-sts-resolver (CVSS 6.9, Snawoot postfix-mta-sts-resolver · postfix-mta-sts-resolver)
- [CVE-2018-17981](https://cve.now/CVE-2018-17981.md): Lifesize Express ls ex2\_4.7.10 2000 (14) devices allow XSS via the interface/interface.php brand parameter. (no CVSS)
- [CVE-2019-20391](https://cve.now/CVE-2019-20391.md): An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve\_feature\_value() when an if-feature statement is u (no CVSS)
- [CVE-2019-20392](https://cve.now/CVE-2019-20392.md): An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve\_feature\_value() when an if-feature statement is u (no CVSS)
- [CVE-2019-20393](https://cve.now/CVE-2019-20393.md): A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. (no CVSS)
- [CVE-2019-20394](https://cve.now/CVE-2019-20394.md): A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. (no CVSS)
- [CVE-2019-20395](https://cve.now/CVE-2019-20395.md): A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. (no CVSS)
- [CVE-2019-20396](https://cve.now/CVE-2019-20396.md): A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during lys\_parse\_path parsin (no CVSS)
- [CVE-2019-20397](https://cve.now/CVE-2019-20397.md): A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminated. (no CVSS)
- [CVE-2019-20398](https://cve.now/CVE-2019-20398.md): A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys\_extension\_instances\_free() due to a copy of unresolved e (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.