CVEs published January 29, 2020
54 CVEs were published on January 29, 2020: 1 critical, 1 high. 1 is now in CISA KEV.
- Published
- 54
- Critical
- 1
- High
- 1
- Medium
- 1
- Low
- 1
- Unrated
- 50
- Now in CISA KEV
- 1
- Fix available
- 22
Most affected products
- Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- 7
- Adobe Illustrator CC
- 5
- Adobe Magento · magento/community-edition +1
- 4
- Adobe Magento · magento/community-edition
- 2
- Bitdefender Antivirus for Mac
- 2
- Cisco Small Business 300 Series Managed Switches
- 1
- contao · contao/core
- 1
- Havalite CMS
- 1
- io.netty:netty-codec-http · org.jboss.netty:netty +1
- 1
- io.netty:netty-handler · org.jboss.netty:netty +1
- 1
Critical 1
High 1
Medium, low and unrated 52
- CVE-2020-8438Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hidden /forms/nslookupH
- CVE-2013-3321NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially crafted requests to the
- CVE-2013-3320Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject arbitrary web scrip
- CVE-2013-3317Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass via the NtgrBak key.
- CVE-2013-3316Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass due to the server skipping checks for URLs containing a ".
- CVE-2019-10783All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection.lsof
- CVE-2019-20444HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header withio.netty:netty-codec-http · org.jboss.netty:netty +1
- CVE-2019-20445HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Trio.netty:netty-handler · org.jboss.netty:netty +1
- CVE-2020-3758Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulAdobe Magento · magento/community-edition +1
- CVE-2020-3719Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability.Adobe Magento · magento/community-edition +1
- CVE-2020-3718Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a security bypass vulnerability.Adobe Magento · magento/community-edition +1
- CVE-2020-3717Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability.Adobe Magento · magento/community-edition
- CVE-2020-3716Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted daAdobe Magento · magento/community-edition
- CVE-2020-3715Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulAdobe Magento · magento/community-edition +1
- CVE-2020-3714Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability.Adobe Illustrator CC
- CVE-2020-3713Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability.Adobe Illustrator CC
- CVE-2020-3712Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability.Adobe Illustrator CC
- CVE-2020-3711Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability.Adobe Illustrator CC
- CVE-2020-3710Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability.Adobe Illustrator CC
- CVE-2013-2574An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /log/ directories, whic
- CVE-2020-8432In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function.
- CVE-2013-2573A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Cameras TL-SC 3130, TL-
- CVE-2013-2572A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 due to default hard-c
- CVE-2013-2570A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 function
- CVE-2019-18634In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo proc
- CVE-2013-3215vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession
- CVE-2013-2569A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is disabled by default, wh
- CVE-2013-2568A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless_mft.cgi, which coul
- CVE-2013-2567An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded admin account found
- CVE-2020-8416IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to the PASV mode port.
- CVE-2020-8093Code Injection into Bitdefender AV for MacBitdefender Antivirus for Mac
- CVE-2020-8092Privilege escalation in Bitdefender AV for MacBitdefender Antivirus for Mac
- CVE-2019-7655Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the (1) customList%5B0%5D.value field in engine
- CVE-2019-7656A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges t
- CVE-2019-7654Wowza Streaming Engine 4.8.0 and earlier suffers from multiple CSRF vulnerabilities.
- CVE-2020-2107Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where theJenkins project Jenkins Fortify Plugin · org.jenkins-ci.plu…
- CVE-2020-2108Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a useJenkins project Jenkins WebSphere Deployer Plugin · org.jen…
- CVE-2020-2105REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2020-2106Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a storJenkins project Jenkins Code Coverage API Plugin · io.jenki…
- CVE-2020-2103Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2020-2104Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2020-2100Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848.Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2020-2101Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2020-2102Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2020-2099Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowingJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2013-0161Havalite CMS 1.1.7 has a stored XSS vulnerabilityHavalite CMS
- CVE-2012-5776Dokeos 2.1.1 has multiple XSS issues involving "extra_" parameters in main/auth/profile.php.
- CVE-2012-4383contao prior to 2.11.4 has a sql injection vulnerabilitycontao · contao/core
- CVE-2020-7965flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input.webargs
- CVE-2019-20217D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method i
- CVE-2019-20216D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method i
- CVE-2019-20215D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in