# CVEs published 2020-01-27

111 CVEs were published on January 27, 2020: 0 critical, 5 high. Days are UTC.

- [CVE-2019-20434](https://cve.now/CVE-2019-20434.md): An issue was discovered in WSO2 API Manager 2.6.0. (CVSS 4.8)
- [CVE-2019-20435](https://cve.now/CVE-2019-20435.md): An issue was discovered in WSO2 API Manager 2.6.0. (CVSS 3.5)
- [CVE-2019-20437](https://cve.now/CVE-2019-20437.md): An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. (CVSS 6.1)
- [CVE-2019-20438](https://cve.now/CVE-2019-20438.md): An issue was discovered in WSO2 API Manager 2.6.0. (CVSS 4.8)
- [CVE-2019-20439](https://cve.now/CVE-2019-20439.md): An issue was discovered in WSO2 API Manager 2.6.0. (CVSS 3.5)
- [CVE-2019-20440](https://cve.now/CVE-2019-20440.md): An issue was discovered in WSO2 API Manager 2.6.0. (CVSS 3.5)
- [CVE-2019-20441](https://cve.now/CVE-2019-20441.md): An issue was discovered in WSO2 API Manager 2.6.0. (CVSS 4.8)
- [CVE-2019-20442](https://cve.now/CVE-2019-20442.md): An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server (CVSS 3.5)
- [CVE-2019-20443](https://cve.now/CVE-2019-20443.md): An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server (CVSS 3.5)
- [CVE-2019-20436](https://cve.now/CVE-2019-20436.md): An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. (CVSS 6.1)
- [CVE-2019-7131](https://cve.now/CVE-2019-7131.md): Adobe Acrobat and Reader versions 2019.010.20064 and earlier, 2019.010.20064 and earlier, 2017.011.30110 and earlier version, and 2015.006.3 (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-8257](https://cve.now/CVE-2019-8257.md): Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and ear (no CVSS, Adobe Acrobat and Reader)
- [CVE-2019-13519](https://cve.now/CVE-2019-13519.md): A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earl (no CVSS, Rockwell Automation Arena Simulation Software)
- [CVE-2019-13521](https://cve.now/CVE-2019-13521.md): A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earl (no CVSS, Rockwell Automation Arena Simulation Software)
- [CVE-2013-2612](https://cve.now/CVE-2013-2612.md): Command-injection vulnerability in Huawei E587 3G Mobile Hotspot 11.203.27 allows remote attackers to execute arbitrary shell commands with (no CVSS)
- [CVE-2013-2499](https://cve.now/CVE-2013-2499.md): SimpleHRM 2.3 and earlier could allow remote attackers to bypass the authentication process in 'user\_manager.php' via spoofing a cookie. (no CVSS)
- [CVE-2020-8091](https://cve.now/CVE-2020-8091.md): svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting ( (CVSS 4.8, typo3/cms)
- [CVE-2013-2474](https://cve.now/CVE-2013-2474.md): Directory traversal vulnerability in AWS XMS 2.5 allows remote attackers to view arbitrary files via the 'what' parameter. (no CVSS)
- [CVE-2013-2267](https://cve.now/CVE-2013-2267.md): PHP Code Injection vulnerability in FUDforum Bulletin Board Software 3.0.4 could allow remote attackers to execute arbitrary code on the sys (no CVSS)
- [CVE-2020-8090](https://cve.now/CVE-2020-8090.md): The Username field in the Storage Service settings of A1 WLAN Box ADB VV2220v2 devices allows stored XSS (after a successful Administrator l (no CVSS)
- [CVE-2012-6448](https://cve.now/CVE-2012-6448.md): Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web script or HTML via unspec (no CVSS)
- [CVE-2020-5218](https://cve.now/CVE-2020-5218.md): Ability in Sylius to switch channels via GET parameter enabled in production environments (CVSS 4.4, Sylius · sylius/sylius +1)
- [CVE-2020-5220](https://cve.now/CVE-2020-5220.md): Ability to expose data in Sylius by using an unintended serialisation group (CVSS 4.4, SyliusResourceBundle · sylius/sylius +1)
- [CVE-2020-8088](https://cve.now/CVE-2020-8088.md): panel\_login.php in UseBB 1.0.12 allows type juggling for login bypass because != is used instead of !== for password hashes, which mishandle (no CVSS)
- [CVE-2020-8087](https://cve.now/CVE-2020-8087.md): SMC Networks D3G0804W D3GNV5M-3.5.1.6.10\_GA devices allow remote command execution by leveraging access to the Network Diagnostic Tools scre (no CVSS)
- [CVE-2020-5207](https://cve.now/CVE-2020-5207.md): Request smuggling is possible in Ktor when both chunked TE and content length specified (CVSS 5.4, Ktor.io Ktor · io.ktor:ktor-client-cio +1)
- [CVE-2019-11288](https://cve.now/CVE-2019-11288.md): tcServer JMX Socket Listener Registry Rebinding Local Privilege Escalation (CVSS 7.3, Pivotal tc Server 4.x · Pivotal tc Server 3.x)
- [CVE-2014-8563](https://cve.now/CVE-2014-8563.md): Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS. (no CVSS)
- [CVE-2019-8945](https://cve.now/CVE-2019-8945.md): Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS. (no CVSS)
- [CVE-2019-8946](https://cve.now/CVE-2019-8946.md): Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS. (no CVSS)
- [CVE-2019-8947](https://cve.now/CVE-2019-8947.md): Zimbra Collaboration 8.7.x - 8.8.11P2 contains non-persistent XSS. (no CVSS)
- [CVE-2018-19441](https://cve.now/CVE-2018-19441.md): An issue was discovered in Neato Botvac Connected 2.2.0. (no CVSS)
- [CVE-2015-2249](https://cve.now/CVE-2015-2249.md): Zimbra Collaboration before 8.6.0 patch5 has XSS. (no CVSS)
- [CVE-2014-5500](https://cve.now/CVE-2014-5500.md): Synacor Zimbra Collaboration before 8.0.8 has XSS. (no CVSS)
- [CVE-2019-11318](https://cve.now/CVE-2019-11318.md): Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS. (no CVSS)
- [CVE-2019-12427](https://cve.now/CVE-2019-12427.md): Zimbra Collaboration before 8.8.15 Patch 1 is vulnerable to a non-persistent XSS via the Admin Console. (no CVSS)
- [CVE-2019-15313](https://cve.now/CVE-2019-15313.md): In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability. (no CVSS)
- [CVE-2019-19143](https://cve.now/CVE-2019-19143.md): TP-LINK TL-WR849N 0.9.1 4.16 devices do not require authentication to replace the firmware via a POST request to the cgi/softup URI. (no CVSS)
- [CVE-2019-19539](https://cve.now/CVE-2019-19539.md): An issue was discovered in Idelji Web ViewPoint H01ABO-H01BY and L01ABP-L01ABZ, Web ViewPoint Plus H01AAG-H01AAQ and L01AAH-L01AAR, and Web (no CVSS)
- [CVE-2014-3979](https://cve.now/CVE-2014-3979.md): Bytemark Symbiosis allows remote attackers to cause a denial of service via a crafted username, which triggers the firewall to blacklist the (no CVSS)
- [CVE-2019-19822](https://cve.now/CVE-2019-19822.md): A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the co (no CVSS)
- [CVE-2019-19823](https://cve.now/CVE-2019-19823.md): A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords (no CVSS)
- [CVE-2013-4770](https://cve.now/CVE-2013-4770.md): Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.1 allows remote attackers to inject arbitra (no CVSS)
- [CVE-2013-7390](https://cve.now/CVE-2013-7390.md): Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remot (no CVSS)
- [CVE-2014-8741](https://cve.now/CVE-2014-8741.md): Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers (no CVSS)
- [CVE-2014-8742](https://cve.now/CVE-2014-8742.md): Directory traversal vulnerability in the ReportDownloadServlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers t (no CVSS)
- [CVE-2014-7303](https://cve.now/CVE-2014-7303.md): SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to obtain password hashes and pos (no CVSS)
- [CVE-2014-7302](https://cve.now/CVE-2014-7302.md): SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to change the permissions of arbi (no CVSS)
- [CVE-2014-7301](https://cve.now/CVE-2014-7301.md): SGI Tempo, as used on SGI ICE-X systems, uses weak permissions for certain files, which allows local users to obtain password hashes and pos (no CVSS)
- [CVE-2019-17099](https://cve.now/CVE-2019-17099.md): Untrusted Search Path vulnerability in EPSecurityService.exe (VA-3500) (CVSS 5.3, Bitdefender EPSecurityService.exe)
- [CVE-2019-17095](https://cve.now/CVE-2019-17095.md): Bitdefender BOX 2 bootstrap download\_image command injection vulnerability (CVSS 8.1, Bitdefender BOX)
- [CVE-2019-17094](https://cve.now/CVE-2019-17094.md): Stack-Based Overflow vulnerability in Belkin WeMo Insights Switch (CVSS 8.3, Belkin WeMo Insight Switch)
- [CVE-2019-19824](https://cve.now/CVE-2019-19824.md): On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the b (no CVSS)
- [CVE-2019-19825](https://cve.now/CVE-2019-19825.md): On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/ (no CVSS)
- [CVE-2020-7238](https://cve.now/CVE-2020-7238.md): Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a \[space\]Transfer-Encoding:chun (no CVSS, io.netty:netty-handler)
- [CVE-2020-7949](https://cve.now/CVE-2020-7949.md): schemasystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming se (no CVSS)
- [CVE-2020-7950](https://cve.now/CVE-2020-7950.md): meshsystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming serv (no CVSS)
- [CVE-2020-7951](https://cve.now/CVE-2020-7951.md): meshsystem.dll in Valve Dota 2 before 7.23e allows remote attackers to achieve code execution or denial of service by creating a gaming serv (no CVSS)
- [CVE-2020-7952](https://cve.now/CVE-2020-7952.md): rendersystemdx9.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming (no CVSS)
- [CVE-2013-4441](https://cve.now/CVE-2013-4441.md): The Phonemes mode in Pwgen 2.06 generates predictable passwords, which makes it easier for context-dependent attackers to guess the password (no CVSS, Pwgen)
- [CVE-2014-9481](https://cve.now/CVE-2014-9481.md): The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a cr (no CVSS, Scribunto)
- [CVE-2015-0241](https://cve.now/CVE-2015-0241.md): The to\_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow (no CVSS, PostgreSQL Global Development Group PostgreSQL)
- [CVE-2015-0242](https://cve.now/CVE-2015-0242.md): Stack-based buffer overflow in the \*printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9 (no CVSS, PostgreSQL Global Development Group PostgreSQL)
- [CVE-2015-0243](https://cve.now/CVE-2015-0243.md): Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and (no CVSS, PostgreSQL Global Development Group PostgreSQL)
- [CVE-2015-0244](https://cve.now/CVE-2015-0244.md): PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle erro (no CVSS, PostgreSQL Global Development Group PostgreSQL)
- [CVE-2014-8161](https://cve.now/CVE-2014-8161.md): PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated u (no CVSS, PostgreSQL Global Development Group PostgreSQL)
- [CVE-2019-17190](https://cve.now/CVE-2019-17190.md): A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. (no CVSS)
- [CVE-2015-0294](https://cve.now/CVE-2015-0294.md): GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate. (no CVSS, GnuTLS)
- [CVE-2015-3154](https://cve.now/CVE-2015-3154.md): CRLF injection vulnerability in Zend\\Mail (Zend\_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remo (no CVSS, Zend Technologies Zend Framework · zendframework/zend-ht… +2)
- [CVE-2006-7246](https://cve.now/CVE-2006-7246.md): NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used. (no CVSS)
- [CVE-2011-4558](https://cve.now/CVE-2011-4558.md): Tiki 8.2 and earlier allows remote administrators to execute arbitrary PHP code via crafted input to the regexres and regex parameters. (no CVSS)
- [CVE-2012-1495](https://cve.now/CVE-2012-1495.md): install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form\_single\_user\_login parameter. (no CVSS)
- [CVE-2013-3486](https://cve.now/CVE-2013-3486.md): IrfanView FlashPix Plugin 4.3.4 0 has an Integer Overflow Vulnerability (no CVSS, IrfanView FlashPix PlugIn)
- [CVE-2013-3493](https://cve.now/CVE-2013-3493.md): XnView 2.03 has an integer overflow vulnerability (no CVSS, XnView)
- [CVE-2012-1496](https://cve.now/CVE-2012-1496.md): Local file inclusion in WebCalendar before 1.2.5. (no CVSS)
- [CVE-2013-3492](https://cve.now/CVE-2013-3492.md): XnView 2.03 has a stack-based buffer overflow vulnerability (no CVSS, XnView)
- [CVE-2013-0286](https://cve.now/CVE-2013-0286.md): Pinboard 1.0.6 theme for Wordpress has XSS. (no CVSS, Pinboard theme authors Pinboard theme)
- [CVE-2013-5659](https://cve.now/CVE-2013-5659.md): Wiz 5.0.3 has a user mode write access violation (no CVSS)
- [CVE-2014-4156](https://cve.now/CVE-2014-4156.md): Proxmox VE prior to 3.2: 'AccessControl.pm' User Enumeration Vulnerability (no CVSS)
- [CVE-2019-17103](https://cve.now/CVE-2019-17103.md): Get-task-allow entitlement via BDLDaemon on macOS (CVSS 4.9, Bitdefender AV for Mac)
- [CVE-2013-4462](https://cve.now/CVE-2013-4462.md): WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability (no CVSS, Portable phpMyAdmin Plugin authors Portable phpMyAdmin Plug…)
- [CVE-2019-17102](https://cve.now/CVE-2019-17102.md): Bitdefender BOX v2 bootstrap update\_setup command execution vulnerability (VA-2226) (CVSS 8.3, Bitdefender BOX)
- [CVE-2019-20433](https://cve.now/CVE-2019-20433.md): libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\\0' byte, if the encoding is set to ucs-2 (no CVSS)
- [CVE-2013-6056](https://cve.now/CVE-2013-6056.md): OSSIM before 4.3.3.1 has tele\_compress.php path traversal vulnerability (no CVSS)
- [CVE-2019-17100](https://cve.now/CVE-2019-17100.md): Untrusted Search Path vulnerability in Bitdefender Total Security 2020 (VA-5895) (CVSS 5.2, Bitdefender bdserviceshost.exe)
- [CVE-2020-8009](https://cve.now/CVE-2020-8009.md): AVB MOTU devices through 2020-01-22 allow /.. (no CVSS)
- [CVE-2017-14807](https://cve.now/CVE-2017-14807.md): SQL injection in ui-server/app/models/diary\_entry.rb in SUSE Studio onsite (CVSS 8.1, SUSE Studio onsite)
- [CVE-2017-14806](https://cve.now/CVE-2017-14806.md): Insecure handling of repodata and packages in SUSE Studio onlite (CVSS 3.7, SUSE Studio onsite)
- [CVE-2020-5520](https://cve.now/CVE-2020-5520.md): The netprint App for iOS 3.2.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoo (no CVSS, Fuji Xerox Co. netprint App for iOS)
- [CVE-2020-5521](https://cve.now/CVE-2020-5521.md): The kantan netprint App for iOS 2.0.2 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers (no CVSS, Fuji Xerox Co. kantan netprint App for iOS)
- [CVE-2020-5522](https://cve.now/CVE-2020-5522.md): The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attack (no CVSS, Fuji Xerox Co. kantan netprint App for Android)
- [CVE-2019-6036](https://cve.now/CVE-2019-6036.md): Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary w (no CVSS, ThinkingReed F-RevoCRM)
- [CVE-2018-20105](https://cve.now/CVE-2018-20105.md): yast2-rmt exposes CA private key passhrase in log-file (CVSS 4.0, SUSE Linux Enterprise Server · openSUSE Leap)
- [CVE-2018-12476](https://cve.now/CVE-2018-12476.md): obs-service-extract\_file's outfilename parameter allows to write files outside of package directory (CVSS 4.3, SUSE Linux Enterprise Server · openSUSE Factory)
- [CVE-2019-20421](https://cve.now/CVE-2019-20421.md): In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumptio (no CVSS)
- [CVE-2019-20422](https://cve.now/CVE-2019-20422.md): In the Linux kernel before 5.3.4, fib6\_rule\_lookup in net/ipv6/ip6\_fib.c mishandles the RT6\_LOOKUP\_F\_DST\_NOREF flag in a reference-count dec (no CVSS)
- [CVE-2019-20423](https://cve.now/CVE-2019-20423.md): In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic due to the lack of validation for specific fields (no CVSS)
- [CVE-2019-20424](https://cve.now/CVE-2019-20424.md): In the Lustre file system before 2.12.3, mdt\_object\_remote in the mdt module has a NULL pointer dereference and panic due to the lack of val (no CVSS)
- [CVE-2019-20425](https://cve.now/CVE-2019-20425.md): In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of validation for specific (no CVSS)
- [CVE-2019-20426](https://cve.now/CVE-2019-20426.md): In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds access and panic due to the lack of validation for specific (no CVSS)
- [CVE-2019-20427](https://cve.now/CVE-2019-20427.md): In the Lustre file system before 2.12.3, the ptlrpc module has a buffer overflow and panic, and possibly remote code execution, due to the l (no CVSS)
- [CVE-2019-20428](https://cve.now/CVE-2019-20428.md): In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds read and panic due to the lack of validation for specific fi (no CVSS)
- [CVE-2019-20429](https://cve.now/CVE-2019-20429.md): In the Lustre file system before 2.12.3, the ptlrpc module has an out-of-bounds read and panic (via a modified lm\_bufcount field) due to the (no CVSS)
- [CVE-2019-20430](https://cve.now/CVE-2019-20430.md): In the Lustre file system before 2.12.3, the mdt module has an LBUG panic (via a large MDT Body eadatasize field) due to the lack of validat (no CVSS)
- [CVE-2019-20431](https://cve.now/CVE-2019-20431.md): In the Lustre file system before 2.12.3, the ptlrpc module has an osd\_map\_remote\_to\_local out-of-bounds access and panic due to the lack of (no CVSS)
- [CVE-2019-20432](https://cve.now/CVE-2019-20432.md): In the Lustre file system before 2.12.3, the mdt module has an out-of-bounds access and panic due to the lack of validation for specific fie (no CVSS)
- [CVE-2020-8000](https://cve.now/CVE-2020-8000.md): Intellian Aptus Web 1.24 has a hardcoded password of 12345678 for the intellian account. (no CVSS)
- [CVE-2020-8001](https://cve.now/CVE-2020-8001.md): The Intellian Aptus application 1.0.2 for Android has a hardcoded password of intellian for the masteruser FTP account. (no CVSS)
- [CVE-2020-7999](https://cve.now/CVE-2020-7999.md): The Intellian Aptus application 1.0.2 for Android has hardcoded values for DOWNLOAD\_API\_KEY and FILE\_DOWNLOAD\_API\_KEY. (no CVSS)
- [CVE-2020-8002](https://cve.now/CVE-2020-8002.md): A NULL pointer dereference in vrend\_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service via commands tha (no CVSS)
- [CVE-2020-8003](https://cve.now/CVE-2020-8003.md): A double-free vulnerability in vrend\_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service by triggering t (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.