# CVEs published 2020-01-24

65 CVEs were published on January 24, 2020: 0 critical, 6 high. Days are UTC.

- [CVE-2014-9625](https://cve.now/CVE-2014-9625.md): The GetUpdateFile function in misc/update.c in the Updater in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation fr (no CVSS)
- [CVE-2014-9626](https://cve.now/CVE-2014-9626.md): Integer underflow in the MP4\_ReadBox\_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote a (no CVSS)
- [CVE-2014-9627](https://cve.now/CVE-2014-9627.md): The MP4\_ReadBox\_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation (no CVSS)
- [CVE-2014-9628](https://cve.now/CVE-2014-9628.md): The MP4\_ReadBox\_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to trigger a (no CVSS)
- [CVE-2014-9629](https://cve.now/CVE-2014-9629.md): Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 all (no CVSS)
- [CVE-2014-9630](https://cve.now/CVE-2014-9630.md): The rtp\_packetize\_xiph\_config function in modules/stream\_out/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation appr (no CVSS)
- [CVE-2015-9541](https://cve.now/CVE-2015-9541.md): Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a relat (no CVSS)
- [CVE-2020-5226](https://cve.now/CVE-2020-5226.md): Cross-site scripting in SimpleSAMLphp (CVSS 4.4, SimpleSAMLphp · simplesamlphp/simplesamlphp)
- [CVE-2019-1348](https://cve.now/CVE-2019-1348.md): An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. (no CVSS, Microsoft Git)
- [CVE-2019-1353](https://cve.now/CVE-2019-1353.md): An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. (no CVSS, Microsoft Git)
- [CVE-2020-5225](https://cve.now/CVE-2020-5225.md): Log injection in SimpleSAMLphp (CVSS 4.4, SimpleSAMLphp · simplesamlphp/simplesamlphp)
- [CVE-2019-1460](https://cve.now/CVE-2019-1460.md): A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook f (no CVSS, Microsoft Outlook for Android)
- [CVE-2019-1414](https://cve.now/CVE-2019-1414.md): An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer, aka 'Vis (no CVSS, Microsoft Visual Studio Code)
- [CVE-2019-1454](https://cve.now/CVE-2019-1454.md): An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows Use (no CVSS, Microsoft Windows)
- [CVE-2019-1351](https://cve.now/CVE-2019-1351.md): A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vul (no CVSS, Microsoft Visual Studio)
- [CVE-2019-1352](https://cve.now/CVE-2019-1352.md): A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code E (no CVSS, Microsoft Visual Studio)
- [CVE-2019-1354](https://cve.now/CVE-2019-1354.md): A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code E (no CVSS, Microsoft Visual Studio)
- [CVE-2019-1349](https://cve.now/CVE-2019-1349.md): A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code E (no CVSS, Microsoft Visual Studio)
- [CVE-2019-1350](https://cve.now/CVE-2019-1350.md): A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code E (no CVSS, Microsoft Visual Studio)
- [CVE-2018-8654](https://cve.now/CVE-2018-8654.md): An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Server, aka 'Microsoft Dynamics 365 Elevation of Privilege Vulnerab (no CVSS, Microsoft Dynamics 365 (on-premises))
- [CVE-2020-5224](https://cve.now/CVE-2020-5224.md): Session key exposure through session list in Django User Sessions (CVSS 6.5, Jazzband django-user-sessions · django-user-sessions)
- [CVE-2020-7964](https://cve.now/CVE-2020-7964.md): An issue was discovered in Mirumee Saleor 2.x before 2.9.1. (no CVSS, saleor)
- [CVE-2020-7052](https://cve.now/CVE-2020-7052.md): CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of serv (no CVSS)
- [CVE-2013-1598](https://cve.now/CVE-2013-1598.md): A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary (no CVSS)
- [CVE-2014-4172](https://cve.now/CVE-2014-4172.md): A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client be (no CVSS, DotNetCasClient · org.jasig.cas:cas-client +1)
- [CVE-2013-1597](https://cve.now/CVE-2013-1597.md): A Directory Traversal vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via a specially crafted GET request, which could let (no CVSS)
- [CVE-2013-1596](https://cve.now/CVE-2013-1596.md): An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP packets to TCP port 554 (no CVSS)
- [CVE-2015-2688](https://cve.now/CVE-2015-2688.md): buf\_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layo (no CVSS, The Tor Project Tor)
- [CVE-2015-2689](https://cve.now/CVE-2015-2689.md): Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, (no CVSS, The Tor Project Tor)
- [CVE-2015-2929](https://cve.now/CVE-2015-2929.md): The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote serv (no CVSS, The Tor Project Tor)
- [CVE-2015-2928](https://cve.now/CVE-2015-2928.md): The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote atta (no CVSS, The Tor Project Tor)
- [CVE-2019-19363](https://cve.now/CVE-2019-19363.md): An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attackers local privilege es (no CVSS)
- [CVE-2015-1525](https://cve.now/CVE-2015-1525.md): audio/AudioPolicyManagerBase.cpp in Android before 5.1 allows attackers to cause a denial of service (audio\_policy application outage) via a (no CVSS)
- [CVE-2015-1530](https://cve.now/CVE-2015-1530.md): media/libmedia/IAudioPolicyService.cpp in Android before 5.1 allows attackers to execute arbitrary code with media\_server privileges or caus (no CVSS)
- [CVE-2013-1595](https://cve.now/CVE-2013-1595.md): A Buffer Overflow vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via a specially crafted packet in the Authorization heade (no CVSS)
- [CVE-2020-6966](https://cve.now/CVE-2020-6966.md): In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X (no CVSS, GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARE…)
- [CVE-2020-6965](https://cve.now/CVE-2020-6965.md): In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X (no CVSS, GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARE…)
- [CVE-2014-9720](https://cve.now/CVE-2014-9720.md): Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier (no CVSS, tornado)
- [CVE-2015-4042](https://cve.now/CVE-2015-4042.md): Integer overflow in the keycompare\_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of se (no CVSS)
- [CVE-2013-1594](https://cve.now/CVE-2013-1594.md): An Information Disclosure vulnerability exists via a GET request in Vivotek PT7135 IP Camera 0300a and 0400a due to wireless keys and 3rd pa (no CVSS)
- [CVE-2015-4041](https://cve.now/CVE-2015-4041.md): The keycompare\_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without consideri (no CVSS)
- [CVE-2014-1925](https://cve.now/CVE-2014-1925.md): SQL injection vulnerability in the MARC framework import/export function (admin/import\_export\_framework.pl) in Koha before 3.8.23, 3.10.x be (no CVSS)
- [CVE-2014-1924](https://cve.now/CVE-2014-1924.md): The MARC framework import/export function (admin/import\_export\_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.1 (no CVSS)
- [CVE-2014-1922](https://cve.now/CVE-2014-1922.md): Absolute path traversal vulnerability in tools/pdfViewer.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x (no CVSS)
- [CVE-2014-1923](https://cve.now/CVE-2014-1923.md): Multiple directory traversal vulnerabilities in the (1) staff interface help editor (edithelp.pl) or (2) member-picupload.pl in Koha before (no CVSS)
- [CVE-2020-6964](https://cve.now/CVE-2020-6964.md): In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X (no CVSS, GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARE…)
- [CVE-2020-6963](https://cve.now/CVE-2020-6963.md): In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X (no CVSS, GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARE…)
- [CVE-2020-6962](https://cve.now/CVE-2020-6962.md): In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X (no CVSS, GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARE…)
- [CVE-2020-6961](https://cve.now/CVE-2020-6961.md): In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X (no CVSS, GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARE…)
- [CVE-2020-5219](https://cve.now/CVE-2020-5219.md): Remote Code Execution in Angular Expressions (CVSS 8.7, peerigon angular-expressions · angular-expressions)
- [CVE-2019-19631](https://cve.now/CVE-2019-19631.md): An issue was discovered in Big Switch Big Monitoring Fabric 6.2 through 6.2.4, 6.3 through 6.3.9, 7.0 through 7.0.3, and 7.1 through 7.1.3; (no CVSS)
- [CVE-2019-18900](https://cve.now/CVE-2019-18900.md): libzypp stores cookies world readable (CVSS 4.0, SUSE CaaS Platform · SUSE Linux Enterprise Server)
- [CVE-2019-19632](https://cve.now/CVE-2019-19632.md): An issue was discovered in Big Switch Big Monitoring Fabric 6.2 through 6.2.4, 6.3 through 6.3.9, 7.0 through 7.0.3, and 7.1 through 7.1.3; (no CVSS)
- [CVE-2013-4333](https://cve.now/CVE-2013-4333.md): OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection Vulnerability (no CVSS, OpenPNE)
- [CVE-2013-3960](https://cve.now/CVE-2013-3960.md): Easytime Studio Easy File Manager 1.1 has a HTTP request security bypass (no CVSS)
- [CVE-2012-6451](https://cve.now/CVE-2012-6451.md): Lorex LNC116 and LNC104 IP Cameras have a Remote Authentication Bypass Vulnerability (no CVSS)
- [CVE-2020-7226](https://cve.now/CVE-2020-7226.md): CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocatio (no CVSS, org.cryptacular:cryptacular)
- [CVE-2012-6302](https://cve.now/CVE-2012-6302.md): Soapbox through 0.3.1: Sandbox bypass - runs a second instance of Soapbox within a sandboxed Soapbox. (no CVSS)
- [CVE-2019-3700](https://cve.now/CVE-2019-3700.md): yast: Fallback to DES without configuration in /etc/login.def (CVSS 2.9, openSUSE Factory)
- [CVE-2019-3699](https://cve.now/CVE-2019-3699.md): Local privilege escalation from user privoxy to root (CVSS 7.7, openSUSE Leap · openSUSE Factory)
- [CVE-2019-3697](https://cve.now/CVE-2019-3697.md): Local privilege escalation from user gnump3d to root (CVSS 7.7, openSUSE Leap)
- [CVE-2019-3694](https://cve.now/CVE-2019-3694.md): Local privilege escalation from munin to root in the packaging of munin (CVSS 7.7, openSUSE Factory · openSUSE Leap)
- [CVE-2019-3693](https://cve.now/CVE-2019-3693.md): Local privilege escalation from user wwwrun to root in the packaging of mailman (CVSS 7.7, SUSE Linux Enterprise Server · openSUSE Leap)
- [CVE-2019-3692](https://cve.now/CVE-2019-3692.md): Local privilege escalation from user news to root in the packaging of inn (CVSS 7.7, SUSE Linux Enterprise Server · openSUSE Factory +1)
- [CVE-2019-3687](https://cve.now/CVE-2019-3687.md): "easy" permission profile allows everyone execute dumpcap and read all network traffic (CVSS 4.0, SUSE Linux Enterprise Server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.