CVEs published January 27, 2020
111 CVEs were published on January 27, 2020: 0 critical, 5 high.
- Published
- 111
- Critical
- 0
- High
- 5
- Medium
- 14
- Low
- 6
- Unrated
- 86
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- PostgreSQL Global Development Group PostgreSQL
- 5
- Adobe Acrobat and Reader
- 2
- Bitdefender BOX
- 2
- Rockwell Automation Arena Simulation Software
- 2
- SUSE Studio onsite
- 2
- XnView
- 2
- Belkin WeMo Insight Switch
- 1
- Bitdefender AV for Mac
- 1
- Bitdefender bdserviceshost.exe
- 1
- Bitdefender EPSecurityService.exe
- 1
High 5
- CVE-2019-11288tcServer JMX Socket Listener Registry Rebinding Local Privilege EscalationPivotal tc Server 4.x · Pivotal tc Server 3.x
- CVE-2019-17095Bitdefender BOX 2 bootstrap download_image command injection vulnerabilityBitdefender BOX
- CVE-2019-17094Stack-Based Overflow vulnerability in Belkin WeMo Insights SwitchBelkin WeMo Insight Switch
- CVE-2019-17102Bitdefender BOX v2 bootstrap update_setup command execution vulnerability (VA-2226)Bitdefender BOX
- CVE-2017-14807SQL injection in ui-server/app/models/diary_entry.rb in SUSE Studio onsiteSUSE Studio onsite
Medium, low and unrated 106
- CVE-2019-20434An issue was discovered in WSO2 API Manager 2.6.0.
- CVE-2019-20435An issue was discovered in WSO2 API Manager 2.6.0.
- CVE-2019-20437An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0.
- CVE-2019-20438An issue was discovered in WSO2 API Manager 2.6.0.
- CVE-2019-20439An issue was discovered in WSO2 API Manager 2.6.0.
- CVE-2019-20440An issue was discovered in WSO2 API Manager 2.6.0.
- CVE-2019-20441An issue was discovered in WSO2 API Manager 2.6.0.
- CVE-2019-20442An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server
- CVE-2019-20443An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server
- CVE-2019-20436An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0.
- CVE-2019-7131Adobe Acrobat and Reader versions 2019.010.20064 and earlier, 2019.010.20064 and earlier, 2017.011.30110 and earlier version, and 2015.006.3Adobe Acrobat and Reader
- CVE-2019-8257Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earAdobe Acrobat and Reader
- CVE-2019-13519A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlRockwell Automation Arena Simulation Software
- CVE-2019-13521A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlRockwell Automation Arena Simulation Software
- CVE-2013-2612Command-injection vulnerability in Huawei E587 3G Mobile Hotspot 11.203.27 allows remote attackers to execute arbitrary shell commands with
- CVE-2013-2499SimpleHRM 2.3 and earlier could allow remote attackers to bypass the authentication process in 'user_manager.php' via spoofing a cookie.
- CVE-2020-8091svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (typo3/cms
- CVE-2013-2474Directory traversal vulnerability in AWS XMS 2.5 allows remote attackers to view arbitrary files via the 'what' parameter.
- CVE-2013-2267PHP Code Injection vulnerability in FUDforum Bulletin Board Software 3.0.4 could allow remote attackers to execute arbitrary code on the sys
- CVE-2020-8090The Username field in the Storage Service settings of A1 WLAN Box ADB VV2220v2 devices allows stored XSS (after a successful Administrator l
- CVE-2012-6448Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web script or HTML via unspec
- CVE-2020-5218Ability in Sylius to switch channels via GET parameter enabled in production environmentsSylius · sylius/sylius +1
- CVE-2020-5220Ability to expose data in Sylius by using an unintended serialisation groupSyliusResourceBundle · sylius/sylius +1
- CVE-2020-8088panel_login.php in UseBB 1.0.12 allows type juggling for login bypass because != is used instead of !== for password hashes, which mishandle
- CVE-2020-8087SMC Networks D3G0804W D3GNV5M-3.5.1.6.10_GA devices allow remote command execution by leveraging access to the Network Diagnostic Tools scre
- CVE-2020-5207Request smuggling is possible in Ktor when both chunked TE and content length specifiedKtor.io Ktor · io.ktor:ktor-client-cio +1
- CVE-2014-8563Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS.
- CVE-2019-8945Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS.
- CVE-2019-8946Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS.
- CVE-2019-8947Zimbra Collaboration 8.7.x - 8.8.11P2 contains non-persistent XSS.
- CVE-2018-19441An issue was discovered in Neato Botvac Connected 2.2.0.
- CVE-2015-2249Zimbra Collaboration before 8.6.0 patch5 has XSS.
- CVE-2014-5500Synacor Zimbra Collaboration before 8.0.8 has XSS.
- CVE-2019-11318Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS.
- CVE-2019-12427Zimbra Collaboration before 8.8.15 Patch 1 is vulnerable to a non-persistent XSS via the Admin Console.
- CVE-2019-15313In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability.
- CVE-2019-19143TP-LINK TL-WR849N 0.9.1 4.16 devices do not require authentication to replace the firmware via a POST request to the cgi/softup URI.
- CVE-2019-19539An issue was discovered in Idelji Web ViewPoint H01ABO-H01BY and L01ABP-L01ABZ, Web ViewPoint Plus H01AAG-H01AAQ and L01AAH-L01AAR, and Web
- CVE-2014-3979Bytemark Symbiosis allows remote attackers to cause a denial of service via a crafted username, which triggers the firewall to blacklist the
- CVE-2019-19822A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the co
- CVE-2019-19823A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords
- CVE-2013-4770Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.1 allows remote attackers to inject arbitra
- CVE-2013-7390Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remot
- CVE-2014-8741Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers
- CVE-2014-8742Directory traversal vulnerability in the ReportDownloadServlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers t
- CVE-2014-7303SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to obtain password hashes and pos
- CVE-2014-7302SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to change the permissions of arbi
- CVE-2014-7301SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to obtain password hashes and pos
- CVE-2019-17099Untrusted Search Path vulnerability in EPSecurityService.exe (VA-3500)Bitdefender EPSecurityService.exe
- CVE-2019-19824On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the b
- CVE-2019-19825On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/
- CVE-2020-7238Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunio.netty:netty-handler
- CVE-2020-7949schemasystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming se
- CVE-2020-7950meshsystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming serv
- CVE-2020-7951meshsystem.dll in Valve Dota 2 before 7.23e allows remote attackers to achieve code execution or denial of service by creating a gaming serv
- CVE-2020-7952rendersystemdx9.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming
- CVE-2013-4441The Phonemes mode in Pwgen 2.06 generates predictable passwords, which makes it easier for context-dependent attackers to guess the passwordPwgen
- CVE-2014-9481The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crScribunto
- CVE-2015-0241The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allowPostgreSQL Global Development Group PostgreSQL
- CVE-2015-0242Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9PostgreSQL Global Development Group PostgreSQL
- CVE-2015-0243Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, andPostgreSQL Global Development Group PostgreSQL
- CVE-2015-0244PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle erroPostgreSQL Global Development Group PostgreSQL
- CVE-2014-8161PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated uPostgreSQL Global Development Group PostgreSQL
- CVE-2019-17190A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101.
- CVE-2015-0294GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.GnuTLS
- CVE-2015-3154CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remoZend Technologies Zend Framework · zendframework/zend-ht… +2
- CVE-2006-7246NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used.
- CVE-2011-4558Tiki 8.2 and earlier allows remote administrators to execute arbitrary PHP code via crafted input to the regexres and regex parameters.
- CVE-2012-1495install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.
- CVE-2013-3486IrfanView FlashPix Plugin 4.3.4 0 has an Integer Overflow VulnerabilityIrfanView FlashPix PlugIn
- CVE-2013-3493XnView 2.03 has an integer overflow vulnerabilityXnView
- CVE-2012-1496Local file inclusion in WebCalendar before 1.2.5.
- CVE-2013-3492XnView 2.03 has a stack-based buffer overflow vulnerabilityXnView
- CVE-2013-0286Pinboard 1.0.6 theme for Wordpress has XSS.Pinboard theme authors Pinboard theme
- CVE-2013-5659Wiz 5.0.3 has a user mode write access violation
- CVE-2014-4156Proxmox VE prior to 3.2: 'AccessControl.pm' User Enumeration Vulnerability
- CVE-2019-17103Get-task-allow entitlement via BDLDaemon on macOSBitdefender AV for Mac
- CVE-2013-4462WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerabilityPortable phpMyAdmin Plugin authors Portable phpMyAdmin Plug…
- CVE-2019-20433libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2
- CVE-2013-6056OSSIM before 4.3.3.1 has tele_compress.php path traversal vulnerability
- CVE-2019-17100Untrusted Search Path vulnerability in Bitdefender Total Security 2020 (VA-5895)Bitdefender bdserviceshost.exe
- CVE-2020-8009AVB MOTU devices through 2020-01-22 allow /..
- CVE-2017-14806Insecure handling of repodata and packages in SUSE Studio onliteSUSE Studio onsite
- CVE-2020-5520The netprint App for iOS 3.2.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spooFuji Xerox Co. netprint App for iOS
- CVE-2020-5521The kantan netprint App for iOS 2.0.2 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers Fuji Xerox Co. kantan netprint App for iOS
- CVE-2020-5522The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackFuji Xerox Co. kantan netprint App for Android
- CVE-2019-6036Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary wThinkingReed F-RevoCRM
- CVE-2018-20105yast2-rmt exposes CA private key passhrase in log-fileSUSE Linux Enterprise Server · openSUSE Leap
- CVE-2018-12476obs-service-extract_file's outfilename parameter allows to write files outside of package directorySUSE Linux Enterprise Server · openSUSE Factory
- CVE-2019-20421In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumptio
- CVE-2019-20422In the Linux kernel before 5.3.4, fib6_rule_lookup in net/ipv6/ip6_fib.c mishandles the RT6_LOOKUP_F_DST_NOREF flag in a reference-count dec
- CVE-2019-20423In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic due to the lack of validation for specific fields
- CVE-2019-20424In the Lustre file system before 2.12.3, mdt_object_remote in the mdt module has a NULL pointer dereference and panic due to the lack of val
- CVE-2019-20425In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of validation for specific
- CVE-2019-20426In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of validation for specific
- CVE-2019-20427In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic, and possibly remote code execution, due to the l
- CVE-2019-20428In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds read and panic due to the lack of validation for specific fi
- CVE-2019-20429In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds read and panic (via a modified lm_bufcount field) due to the
- CVE-2019-20430In the Lustre file system before 2.12.3, the mdt module has an LBUG panic (via a large MDT Body eadatasize field) due to the lack of validat
- CVE-2019-20431In the Lustre file system before 2.12.3, the ptlrpc module has an osd_map_remote_to_local out-of-bounds access and panic due to the lack of
- CVE-2019-20432In the Lustre file system before 2.12.3, the mdt module has an out-of-bounds access and panic due to the lack of validation for specific fie
- CVE-2020-8000Intellian Aptus Web 1.24 has a hardcoded password of 12345678 for the intellian account.
- CVE-2020-8001The Intellian Aptus application 1.0.2 for Android has a hardcoded password of intellian for the masteruser FTP account.
- CVE-2020-7999The Intellian Aptus application 1.0.2 for Android has hardcoded values for DOWNLOAD_API_KEY and FILE_DOWNLOAD_API_KEY.
- CVE-2020-8002A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service via commands tha
- CVE-2020-8003A double-free vulnerability in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service by triggering t