CVEs published January 24, 2020
65 CVEs were published on January 24, 2020: 0 critical, 6 high.
- Published
- 65
- Critical
- 0
- High
- 6
- Medium
- 5
- Low
- 1
- Unrated
- 53
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARE…
- 6
- Microsoft Visual Studio
- 5
- The Tor Project Tor
- 4
- Microsoft Git
- 2
- SimpleSAMLphp · simplesamlphp/simplesamlphp
- 2
- DotNetCasClient · org.jasig.cas:cas-client +1
- 1
- Jazzband django-user-sessions · django-user-sessions
- 1
- Microsoft Dynamics 365 (on-premises)
- 1
- Microsoft Outlook for Android
- 1
- Microsoft Visual Studio Code
- 1
High 6
- CVE-2020-5219Remote Code Execution in Angular Expressionspeerigon angular-expressions · angular-expressions
- CVE-2019-3699Local privilege escalation from user privoxy to rootopenSUSE Leap · openSUSE Factory
- CVE-2019-3697Local privilege escalation from user gnump3d to rootopenSUSE Leap
- CVE-2019-3694Local privilege escalation from munin to root in the packaging of muninopenSUSE Factory · openSUSE Leap
- CVE-2019-3693Local privilege escalation from user wwwrun to root in the packaging of mailmanSUSE Linux Enterprise Server · openSUSE Leap
- CVE-2019-3692Local privilege escalation from user news to root in the packaging of innSUSE Linux Enterprise Server · openSUSE Factory +1
Medium, low and unrated 59
- CVE-2014-9625The GetUpdateFile function in misc/update.c in the Updater in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation fr
- CVE-2014-9626Integer underflow in the MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote a
- CVE-2014-9627The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation
- CVE-2014-9628The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to trigger a
- CVE-2014-9629Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 all
- CVE-2014-9630The rtp_packetize_xiph_config function in modules/stream_out/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation appr
- CVE-2015-9541Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a relat
- CVE-2020-5226Cross-site scripting in SimpleSAMLphpSimpleSAMLphp · simplesamlphp/simplesamlphp
- CVE-2019-1348An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6.Microsoft Git
- CVE-2019-1353An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6.Microsoft Git
- CVE-2020-5225Log injection in SimpleSAMLphpSimpleSAMLphp · simplesamlphp/simplesamlphp
- CVE-2019-1460A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook fMicrosoft Outlook for Android
- CVE-2019-1414An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer, aka 'VisMicrosoft Visual Studio Code
- CVE-2019-1454An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows UseMicrosoft Windows
- CVE-2019-1351A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering VulMicrosoft Visual Studio
- CVE-2019-1352A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code EMicrosoft Visual Studio
- CVE-2019-1354A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code EMicrosoft Visual Studio
- CVE-2019-1349A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code EMicrosoft Visual Studio
- CVE-2019-1350A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code EMicrosoft Visual Studio
- CVE-2018-8654An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Server, aka 'Microsoft Dynamics 365 Elevation of Privilege VulnerabMicrosoft Dynamics 365 (on-premises)
- CVE-2020-5224Session key exposure through session list in Django User SessionsJazzband django-user-sessions · django-user-sessions
- CVE-2020-7964An issue was discovered in Mirumee Saleor 2.x before 2.9.1.saleor
- CVE-2020-7052CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of serv
- CVE-2013-1598A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary
- CVE-2014-4172A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client beDotNetCasClient · org.jasig.cas:cas-client +1
- CVE-2013-1597A Directory Traversal vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via a specially crafted GET request, which could let
- CVE-2013-1596An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP packets to TCP port 554
- CVE-2015-2688buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layoThe Tor Project Tor
- CVE-2015-2689Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, The Tor Project Tor
- CVE-2015-2929The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servThe Tor Project Tor
- CVE-2015-2928The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attaThe Tor Project Tor
- CVE-2019-19363An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attackers local privilege es
- CVE-2015-1525audio/AudioPolicyManagerBase.cpp in Android before 5.1 allows attackers to cause a denial of service (audio_policy application outage) via a
- CVE-2015-1530media/libmedia/IAudioPolicyService.cpp in Android before 5.1 allows attackers to execute arbitrary code with media_server privileges or caus
- CVE-2013-1595A Buffer Overflow vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via a specially crafted packet in the Authorization heade
- CVE-2020-6966In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARE…
- CVE-2020-6965In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARE…
- CVE-2014-9720Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier tornado
- CVE-2015-4042Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of se
- CVE-2013-1594An Information Disclosure vulnerability exists via a GET request in Vivotek PT7135 IP Camera 0300a and 0400a due to wireless keys and 3rd pa
- CVE-2015-4041The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without consideri
- CVE-2014-1925SQL injection vulnerability in the MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x be
- CVE-2014-1924The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.1
- CVE-2014-1922Absolute path traversal vulnerability in tools/pdfViewer.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x
- CVE-2014-1923Multiple directory traversal vulnerabilities in the (1) staff interface help editor (edithelp.pl) or (2) member-picupload.pl in Koha before
- CVE-2020-6964In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARE…
- CVE-2020-6963In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARE…
- CVE-2020-6962In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.XGE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARE…
- CVE-2020-6961In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.XGE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARE…
- CVE-2019-19631An issue was discovered in Big Switch Big Monitoring Fabric 6.2 through 6.2.4, 6.3 through 6.3.9, 7.0 through 7.0.3, and 7.1 through 7.1.3;
- CVE-2019-18900libzypp stores cookies world readableSUSE CaaS Platform · SUSE Linux Enterprise Server
- CVE-2019-19632An issue was discovered in Big Switch Big Monitoring Fabric 6.2 through 6.2.4, 6.3 through 6.3.9, 7.0 through 7.0.3, and 7.1 through 7.1.3;
- CVE-2013-4333OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection VulnerabilityOpenPNE
- CVE-2013-3960Easytime Studio Easy File Manager 1.1 has a HTTP request security bypass
- CVE-2012-6451Lorex LNC116 and LNC104 IP Cameras have a Remote Authentication Bypass Vulnerability
- CVE-2020-7226CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocatioorg.cryptacular:cryptacular
- CVE-2012-6302Soapbox through 0.3.1: Sandbox bypass - runs a second instance of Soapbox within a sandboxed Soapbox.
- CVE-2019-3700yast: Fallback to DES without configuration in /etc/login.defopenSUSE Factory
- CVE-2019-3687"easy" permission profile allows everyone execute dumpcap and read all network trafficSUSE Linux Enterprise Server