# CVEs published 2020-01-28

110 CVEs were published on January 28, 2020: 2 critical, 5 high. Days are UTC.

- [CVE-2020-8428](https://cve.now/CVE-2020-8428.md): fs/namei.c in the Linux kernel before 5.5 has a may\_create\_in\_sticky use-after-free, which allows local users to cause a denial of service ( (no CVSS)
- [CVE-2020-5227](https://cve.now/CVE-2020-5227.md): Feedgen Vulnerable to XML Denial of Service Attacks (CVSS 4.4, lkiesow python-feedgen · feedgen)
- [CVE-2020-8426](https://cve.now/CVE-2020-8426.md): The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. (no CVSS)
- [CVE-2020-8424](https://cve.now/CVE-2020-8424.md): Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account takeover via passwordmychange.php. (no CVSS)
- [CVE-2020-8425](https://cve.now/CVE-2020-8425.md): Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php. (no CVSS)
- [CVE-2013-1603](https://cve.now/CVE-2013-1603.md): An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05\_TESCO, TESCO DCS-2102 1.05\_TESCO, DCS-7510 1.00, DCS-741 (no CVSS)
- [CVE-2020-5215](https://cve.now/CVE-2020-5215.md): Segmentation faultin TensorFlow when converting a Python string to tf.float16 (CVSS 5.0, TensorFlow · tensorflow-cpu +1)
- [CVE-2013-1602](https://cve.now/CVE-2013-1602.md): An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5 (no CVSS)
- [CVE-2020-8419](https://cve.now/CVE-2020-8419.md): An issue was discovered in Joomla! before 3.9.15. (no CVSS)
- [CVE-2020-8421](https://cve.now/CVE-2020-8421.md): An issue was discovered in Joomla! before 3.9.15. (no CVSS)
- [CVE-2020-8420](https://cve.now/CVE-2020-8420.md): An issue was discovered in Joomla! before 3.9.15. (no CVSS)
- [CVE-2013-1601](https://cve.now/CVE-2013-1601.md): An Information Disclosure vulnerability exists due to a failure to restrict access on the lums.cgi script when processing a live video strea (no CVSS)
- [CVE-2013-3214](https://cve.now/CVE-2013-3214.md): vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'. (no CVSS)
- [CVE-2013-3212](https://cve.now/CVE-2013-3212.md): vtiger CRM 5.4.0 and earlier contain local file-include vulnerabilities in 'customerportal.php' which allows remote attackers to view files (no CVSS)
- [CVE-2020-8417](https://cve.now/CVE-2020-8417.md): The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu. (CVSS 8.8)
- [CVE-2013-1600](https://cve.now/CVE-2013-1600.md): An Authentication Bypass vulnerability exists in upnp/asf-mp4.asf when streaming live video in D-Link TESCO DCS-2121 1.05\_TESCO, TESCO DCS-2 (no CVSS)
- [CVE-2013-3093](https://cve.now/CVE-2013-3093.md): ASUS RT-N56U devices allow CSRF. (no CVSS)
- [CVE-2013-3074](https://cve.now/CVE-2013-3074.md): NetGear WNDR4700 Media Server devices with firmware 1.0.0.34 allow remote attackers to cause a denial of service (device crash). (no CVSS)
- [CVE-2013-3071](https://cve.now/CVE-2013-3071.md): NETGEAR Centria WNDR4700 devices with firmware 1.0.0.34 allow authentication bypass. (no CVSS)
- [CVE-2013-2764](https://cve.now/CVE-2013-2764.md): Secure Entry Server before 4.7.0 contains a URI Redirection vulnerability which could allow remote attackers to conduct phishing attacks due (no CVSS)
- [CVE-2013-1599](https://cve.now/CVE-2013-1599.md): A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/ (no CVSS)
- [CVE-2013-2748](https://cve.now/CVE-2013-2748.md): Belkin Wemo Switch before WeMo\_US\_2.00.2176.PVT could allow remote attackers to upload arbitrary files onto the system. (no CVSS)
- [CVE-2013-2714](https://cve.now/CVE-2013-2714.md): Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web script or html via th (no CVSS)
- [CVE-2014-8490](https://cve.now/CVE-2014-8490.md): Cross-site scripting (XSS) vulnerability in TennisConnect COMPONENTS 9.927 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2015-5483](https://cve.now/CVE-2015-5483.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack t (no CVSS)
- [CVE-2020-8315](https://cve.now/CVE-2020-8315.md): In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may r (no CVSS, libpython · python +1)
- [CVE-2020-4207](https://cve.now/CVE-2020-4207.md): IBM Watson IoT Message Gateway 2.0.0.x, 5.0.0.0, 5.0.0.1, and 5.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking (CVSS 9.8, IBM WIoTP MessageGateway · IBM IoT MessageSight)
- [CVE-2019-4707](https://cve.now/CVE-2019-4707.md): IBM Security Access Manager Appliance 9.0.7.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (CVSS 7.1, IBM Security Access Manager Appliance)
- [CVE-2019-4679](https://cve.now/CVE-2019-4679.md): IBM Content Navigator 3.0CD could allow an authenticated user to gain information about the hosting operating system and version that could (CVSS 4.3, IBM Content Navigator)
- [CVE-2019-4639](https://cve.now/CVE-2019-4639.md): IBM Security Secret Server 10.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive (CVSS 5.9, IBM Security Secret Server)
- [CVE-2019-4638](https://cve.now/CVE-2019-4638.md): IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. (CVSS 3.7, IBM Security Secret Server)
- [CVE-2019-4637](https://cve.now/CVE-2019-4637.md): IBM Security Secret Server 10.7 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resu (CVSS 4.3, IBM Security Secret Server)
- [CVE-2019-4636](https://cve.now/CVE-2019-4636.md): IBM Security Secret Server 10.7 could disclose sensitive information to an authenticated user from generated error messages. (CVSS 2.7, IBM Security Secret Server)
- [CVE-2019-4635](https://cve.now/CVE-2019-4635.md): IBM Security Secret Server 10.7 could allow a privileged user to perform unauthorized command injection due to imporoper input neutralizatio (CVSS 2.7, IBM Security Secret Server)
- [CVE-2019-4633](https://cve.now/CVE-2019-4633.md): IBM Security Secret Server 10.7 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. (CVSS 3.1, IBM Security Secret Server)
- [CVE-2019-4632](https://cve.now/CVE-2019-4632.md): IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Security Secret Server)
- [CVE-2019-4631](https://cve.now/CVE-2019-4631.md): IBM Security Secret Server 10.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (CVSS 7.4, IBM Security Secret Server)
- [CVE-2019-4620](https://cve.now/CVE-2019-4620.md): IBM MQ Appliance 8.0 and 9.0 LTS could allow a local attacker to bypass security restrictions caused by improper validation of environment v (CVSS 8.4, IBM MQ Appliance)
- [CVE-2019-4614](https://cve.now/CVE-2019-4614.md): IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS client connecting to a Queue Manager could cause a SIGSEGV denial of service caused by convertin (CVSS 5.3, IBM MQ)
- [CVE-2019-4568](https://cve.now/CVE-2019-4568.md): IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS could allow a remote attacker with intimate knowledge of the server to cause a denial of service (CVSS 5.9, IBM MQ)
- [CVE-2015-8011](https://cve.now/CVE-2015-8011.md): Buffer overflow in the lldp\_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2015-8012](https://cve.now/CVE-2015-8012.md): lldpd before 0.8.0 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via a malformed packet. (no CVSS)
- [CVE-2019-17338](https://cve.now/CVE-2019-17338.md): TIBCO Patterns - Search Exposes Cross Site Scripting Vulnerabilities (CVSS 7.3, TIBCO Software TIBCO Patterns - Search)
- [CVE-2020-5211](https://cve.now/CVE-2020-5211.md): NetHack AUTOCOMPLETE configuration file option is subject to a buffer overflow (CVSS 5.0, NetHack)
- [CVE-2020-5212](https://cve.now/CVE-2020-5212.md): NetHack MENUCOLOR configuration file option is subject to a buffer overflow (CVSS 5.0, NetHack)
- [CVE-2020-5213](https://cve.now/CVE-2020-5213.md): NetHack SYMBOL configuration file option is subject to a buffer overflow (CVSS 5.0, NetHack)
- [CVE-2020-5214](https://cve.now/CVE-2020-5214.md): NetHack error recovery after syntax error in configuration file is subject to a buffer overflow (CVSS 5.0, NetHack)
- [CVE-2020-5209](https://cve.now/CVE-2020-5209.md): NetHack command line parsing of options starting with -de and -i is subject to a buffer overflow (CVSS 5.0, NetHack)
- [CVE-2020-5210](https://cve.now/CVE-2020-5210.md): NetHack command line -w option parsing is subject to a buffer overflow (CVSS 5.0, NetHack)
- [CVE-2020-8112](https://cve.now/CVE-2020-8112.md): opj\_t1\_clbl\_decode\_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case, a (no CVSS)
- [CVE-2020-1940](https://cve.now/CVE-2020-1940.md): The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensit (no CVSS, Apache Software Foundation Apache Jackrabbit Oak · org.apac…)
- [CVE-2015-7851](https://cve.now/CVE-2015-7851.md): Directory traversal vulnerability in the save\_config function in ntpd in ntp\_control.c in NTP before 4.2.8p4, when used on systems that do n (no CVSS)
- [CVE-2012-6609](https://cve.now/CVE-2012-6609.md): Directory traversal vulnerability in a\_getlog.cgi in Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote attac (no CVSS)
- [CVE-2012-6610](https://cve.now/CVE-2012-6610.md): Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demon (no CVSS)
- [CVE-2020-8086](https://cve.now/CVE-2020-8086.md): The mod\_auth\_ldap and mod\_auth\_ldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the is\_ (no CVSS)
- [CVE-2013-4861](https://cve.now/CVE-2013-4861.md): Directory traversal vulnerability in cgi-bin/cmh/get\_file.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote authenticated users (no CVSS)
- [CVE-2013-4862](https://cve.now/CVE-2013-4862.md): MiCasaVerde VeraLite with firmware 1.5.408 does not properly restrict access, which allows remote authenticated users to (1) update the firm (no CVSS)
- [CVE-2013-4863](https://cve.now/CVE-2013-4863.md): The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows (1) remote attackers to execute arbitrary Lua code vi (no CVSS)
- [CVE-2013-4864](https://cve.now/CVE-2013-4864.md): MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to send HTTP requests to intranet servers via the url parameter to cgi-bi (no CVSS)
- [CVE-2013-4865](https://cve.now/CVE-2013-4865.md): Cross-site request forgery (CSRF) vulnerability in upgrade\_step2.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote attackers to (no CVSS)
- [CVE-2013-2060](https://cve.now/CVE-2013-2060.md): The download\_from\_url function in OpenShift Origin allows remote attackers to execute arbitrary commands via shell metacharacters in the URL (no CVSS, Red Hat OpenShift Origin)
- [CVE-2013-0294](https://cve.now/CVE-2013-0294.md): packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remot (no CVSS, pyrad)
- [CVE-2014-2898](https://cve.now/CVE-2014-2898.md): wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSL\_read function which triggers (no CVSS)
- [CVE-2014-2897](https://cve.now/CVE-2014-2897.md): The SSL 3 HMAC functionality in wolfSSL CyaSSL 2.5.0 before 2.9.4 does not check the padding length when verification fails, which allows re (no CVSS)
- [CVE-2014-2896](https://cve.now/CVE-2014-2896.md): The DoAlert function in the (1) TLS and (2) DTLS implementations in wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified (no CVSS)
- [CVE-2014-2906](https://cve.now/CVE-2014-2906.md): The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute (no CVSS)
- [CVE-2014-3856](https://cve.now/CVE-2014-3856.md): The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain (no CVSS)
- [CVE-2014-2914](https://cve.now/CVE-2014-2914.md): fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish\_config), which allows remote attack (no CVSS)
- [CVE-2013-4582](https://cve.now/CVE-2013-4582.md): The (1) create\_branch, (2) create\_tag, (3) import\_project, and (4) fork\_project functions in lib/gitlab\_projects.rb in GitLab 5.0 before 5.4 (no CVSS, GitLab · gitlab-shell)
- [CVE-2013-4583](https://cve.now/CVE-2013-4583.md): The parse\_cmd function in lib/gitlab\_shell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2. (no CVSS, GitLab · gitlab-shell)
- [CVE-2014-3230](https://cve.now/CVE-2014-3230.md): The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers (no CVSS, libwww-perl LWP::Protocol::https)
- [CVE-2013-6451](https://cve.now/CVE-2013-6451.md): Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote atta (no CVSS, Wikimedia Foundation MediaWiki)
- [CVE-2013-6455](https://cve.now/CVE-2013-6455.md): The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usern (no CVSS, Wikimedia Foundation MediaWiki)
- [CVE-2013-2571](https://cve.now/CVE-2013-2571.md): Iris 3.8 before build 1548, as used in Xpient point of sale (POS) systems, allows remote attackers to execute arbitrary commands via a craft (no CVSS)
- [CVE-2012-6114](https://cve.now/CVE-2012-6114.md): The git-changelog utility in git-extras 1.7.0 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/changelog or (no CVSS, git-extras)
- [CVE-2013-1895](https://cve.now/CVE-2013-1895.md): The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authenticatio (no CVSS, py-bcrypt)
- [CVE-2013-1437](https://cve.now/CVE-2013-1437.md): Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code v (no CVSS, Perl Toolchain Gang Module-Metadata)
- [CVE-2014-2581](https://cve.now/CVE-2014-2581.md): Smb4K before 1.1.1 allows remote attackers to obtain credentials via vectors related to the cuid option in the "Additional options" line edi (no CVSS)
- [CVE-2014-3445](https://cve.now/CVE-2014-3445.md): backup.php in HandsomeWeb SOS Webpages before 1.1.12 does not require knowledge of the cleartext password, which allows remote attackers to (no CVSS)
- [CVE-2019-17096](https://cve.now/CVE-2019-17096.md): Bitdefender BOX 2 bootstrap get\_image\_size command injection vulnerability (CVSS 9.0, Bitdefender BOX)
- [CVE-2020-7934](https://cve.now/CVE-2020-7934.md): In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are al (no CVSS, com.liferay.portal:release.portal.bom)
- [CVE-2020-7799](https://cve.now/CVE-2020-7799.md): An issue was discovered in FusionAuth before 1.11.0. (no CVSS)
- [CVE-2020-5523](https://cve.now/CVE-2020-5523.md): Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and (no CVSS, NTT Data 'MyPallete' and some of the Android banking applic…)
- [CVE-2020-7998](https://cve.now/CVE-2020-7998.md): An arbitrary file upload vulnerability has been discovered in the Super File Explorer app 1.0.1 for iOS. (no CVSS)
- [CVE-2020-7997](https://cve.now/CVE-2020-7997.md): ASUS WRT-AC66U 3 RT 3.0.0.4.372\_67 devices allow XSS via the Client Name field to the Parental Control feature. (no CVSS)
- [CVE-2019-5472](https://cve.now/CVE-2019-5472.md): An authorization issue was discovered in Gitlab versions \< 12.1.2, \< 12.0.4, and \< 11.11.6 that prevented owners and maintainer to delete ep (no CVSS, GitLab)
- [CVE-2019-5470](https://cve.now/CVE-2019-5470.md): An information disclosure issue was discovered GitLab versions \< 12.1.2, \< 12.0.4, and \< 11.11.6 in the security dashboard which could resul (no CVSS, GitLab)
- [CVE-2019-15578](https://cve.now/CVE-2019-15578.md): An information disclosure exists in \< 12.3.2, \< 12.2.6, and \< 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). (no CVSS, GitLab CE/EE)
- [CVE-2019-15579](https://cve.now/CVE-2019-15579.md): An information disclosure exists in \< 12.3.2, \< 12.2.6, and \< 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) where th (no CVSS, GitLab CE/EE)
- [CVE-2019-5468](https://cve.now/CVE-2019-5468.md): An privilege escalation issue was discovered in Gitlab versions \< 12.1.2, \< 12.0.4, and \< 11.11.6 when Mattermost slash commands are used wi (no CVSS, GiltLab GitLab)
- [CVE-2019-15581](https://cve.now/CVE-2019-15581.md): An IDOR exists in \< 12.3.2, \< 12.2.6, and \< 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a project own (no CVSS, GitLab EE)
- [CVE-2019-5466](https://cve.now/CVE-2019-5466.md): An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names. (no CVSS, GitLab CE/EE)
- [CVE-2019-15582](https://cve.now/CVE-2019-15582.md): An IDOR was discovered in \< 12.3.2, \< 12.2.6, and \< 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowed a mai (no CVSS, GitLab EE)
- [CVE-2019-15590](https://cve.now/CVE-2019-15590.md): An access control issue exists in \< 12.3.5, \< 12.2.8, and \< 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where priv (no CVSS, GitLab EE)
- [CVE-2019-5474](https://cve.now/CVE-2019-5474.md): An authorization issue was discovered in GitLab EE \< 12.1.2, \< 12.0.4, and \< 11.11.6 allowing the merge request approval rules to be overrid (no CVSS, GitLab EE)
- [CVE-2019-5465](https://cve.now/CVE-2019-5465.md): An information disclosure issue was discovered in GitLab CE/EE 8.14 and later, by using the move issue feature which could result in disclos (no CVSS, GitLab CE/EE)
- [CVE-2019-15583](https://cve.now/CVE-2019-15583.md): An information disclosure exists in \< 12.3.2, \< 12.2.6, and \< 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). (no CVSS, GitLab CE/EE)
- [CVE-2019-5464](https://cve.now/CVE-2019-5464.md): A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the \`url\_blocker.rb\` which could result in SSRF whe (no CVSS, GitLab CE/EE)
- [CVE-2019-15585](https://cve.now/CVE-2019-15585.md): Improper authentication exists in \< 12.3.2, \< 12.2.6, and \< 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the Git (no CVSS, Gitlab CE/EE)
- [CVE-2019-5462](https://cve.now/CVE-2019-5462.md): A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has cha (no CVSS, GitLab Community Edition and GitLab Enterprise Edition)
- [CVE-2019-15586](https://cve.now/CVE-2019-15586.md): A XSS exists in Gitlab CE/EE \< 12.1.10 in the Mermaid plugin. (no CVSS, Gitlab CE/EE)
- [CVE-2019-15607](https://cve.now/CVE-2019-15607.md): A stored XSS vulnerability is present within node-red (version: \<= 0.20.7) npm package, which is a visual tool for wiring the Internet of Th (no CVSS, node-red)
- [CVE-2019-17651](https://cve.now/CVE-2019-17651.md): An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM vers (no CVSS, Fortinet FortiSIEM)
- [CVE-2020-1932](https://cve.now/CVE-2020-1932.md): An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. (no CVSS, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2020-1933](https://cve.now/CVE-2020-1933.md): A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. (no CVSS, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2020-1928](https://cve.now/CVE-2020-1928.md): An information disclosure vulnerability was found in Apache NiFi 1.10.0. (no CVSS, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2019-10770](https://cve.now/CVE-2019-10770.md): All versions of io.ratpack:ratpack-core from 0.9.10 inclusive and before 1.7.6 are vulnerable to Cross-site Scripting (XSS). (no CVSS, io.ratpack:ratpack-core)
- [CVE-2019-10779](https://cve.now/CVE-2019-10779.md): All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cross-site Scripting. (no CVSS, stroom:stroom-app)
- [CVE-2020-0549](https://cve.now/CVE-2020-0549.md): Cleanup errors in some data cache evictions for some Intel(R) Processors may allow an authenticated user to potentially enable information d (no CVSS, Intel(R) Processors)
- [CVE-2020-0548](https://cve.now/CVE-2020-0548.md): Cleanup errors in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. (no CVSS, Intel(R) Processors)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.