# CVEs published 2020-01-29

54 CVEs were published on January 29, 2020: 1 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-3147](https://cve.now/CVE-2020-3147.md): Cisco Small Business Switches Denial of Service Vulnerability (CVSS 8.6, Cisco Small Business 300 Series Managed Switches)
- [CVE-2020-8438](https://cve.now/CVE-2020-8438.md): Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hidden /forms/nslookupH (no CVSS)
- [CVE-2013-3321](https://cve.now/CVE-2013-3321.md): NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially crafted requests to the (no CVSS)
- [CVE-2013-3320](https://cve.now/CVE-2013-3320.md): Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2013-3317](https://cve.now/CVE-2013-3317.md): Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass via the NtgrBak key. (no CVSS)
- [CVE-2013-3316](https://cve.now/CVE-2013-3316.md): Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass due to the server skipping checks for URLs containing a ". (no CVSS)
- [CVE-2019-10783](https://cve.now/CVE-2019-10783.md): All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. (no CVSS, lsof)
- [CVE-2019-20444](https://cve.now/CVE-2019-20444.md): HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with (no CVSS, io.netty:netty-codec-http · org.jboss.netty:netty +1)
- [CVE-2019-20445](https://cve.now/CVE-2019-20445.md): HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Tr (no CVSS, io.netty:netty-handler · org.jboss.netty:netty +1)
- [CVE-2020-3758](https://cve.now/CVE-2020-3758.md): Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vul (no CVSS, Adobe Magento · magento/community-edition +1)
- [CVE-2020-3719](https://cve.now/CVE-2020-3719.md): Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability. (no CVSS, Adobe Magento · magento/community-edition +1)
- [CVE-2020-3718](https://cve.now/CVE-2020-3718.md): Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a security bypass vulnerability. (no CVSS, Adobe Magento · magento/community-edition +1)
- [CVE-2020-3717](https://cve.now/CVE-2020-3717.md): Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a path traversal vulnerability. (no CVSS, Adobe Magento · magento/community-edition)
- [CVE-2020-3716](https://cve.now/CVE-2020-3716.md): Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted da (no CVSS, Adobe Magento · magento/community-edition)
- [CVE-2020-3715](https://cve.now/CVE-2020-3715.md): Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vul (no CVSS, Adobe Magento · magento/community-edition +1)
- [CVE-2020-3714](https://cve.now/CVE-2020-3714.md): Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. (no CVSS, Adobe Illustrator CC)
- [CVE-2020-3713](https://cve.now/CVE-2020-3713.md): Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. (no CVSS, Adobe Illustrator CC)
- [CVE-2020-3712](https://cve.now/CVE-2020-3712.md): Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. (no CVSS, Adobe Illustrator CC)
- [CVE-2020-3711](https://cve.now/CVE-2020-3711.md): Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. (no CVSS, Adobe Illustrator CC)
- [CVE-2020-3710](https://cve.now/CVE-2020-3710.md): Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. (no CVSS, Adobe Illustrator CC)
- [CVE-2013-2574](https://cve.now/CVE-2013-2574.md): An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /log/ directories, whic (no CVSS)
- [CVE-2020-8432](https://cve.now/CVE-2020-8432.md): In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do\_rename\_gpt\_parts() function. (no CVSS)
- [CVE-2013-2573](https://cve.now/CVE-2013-2573.md): A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless\_mft.cgi file in TP-Link IP Cameras TL-SC 3130, TL- (no CVSS)
- [CVE-2013-2572](https://cve.now/CVE-2013-2572.md): A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 due to default hard-c (no CVSS)
- [CVE-2013-2570](https://cve.now/CVE-2013-2570.md): A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub\_C8C8 function (no CVSS)
- [CVE-2019-18634](https://cve.now/CVE-2019-18634.md): In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo proc (no CVSS)
- [CVE-2013-3215](https://cve.now/CVE-2013-3215.md): vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession (no CVSS)
- [CVE-2013-2569](https://cve.now/CVE-2013-2569.md): A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is disabled by default, wh (no CVSS)
- [CVE-2013-2568](https://cve.now/CVE-2013-2568.md): A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless\_mft.cgi, which coul (no CVSS)
- [CVE-2013-2567](https://cve.now/CVE-2013-2567.md): An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded admin account found (no CVSS)
- [CVE-2020-8416](https://cve.now/CVE-2020-8416.md): IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to the PASV mode port. (no CVSS)
- [CVE-2020-8093](https://cve.now/CVE-2020-8093.md): Code Injection into Bitdefender AV for Mac (CVSS 5.3, Bitdefender Antivirus for Mac)
- [CVE-2020-8092](https://cve.now/CVE-2020-8092.md): Privilege escalation in Bitdefender AV for Mac (CVSS 1.6, Bitdefender Antivirus for Mac)
- [CVE-2020-7247](https://cve.now/CVE-2020-7247.md): smtp\_mailaddr in smtp\_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary co (CVSS 9.8, KEV)
- [CVE-2019-7655](https://cve.now/CVE-2019-7655.md): Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the (1) customList%5B0%5D.value field in engine (no CVSS)
- [CVE-2019-7656](https://cve.now/CVE-2019-7656.md): A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges t (no CVSS)
- [CVE-2019-7654](https://cve.now/CVE-2019-7654.md): Wowza Streaming Engine 4.8.0 and earlier suffers from multiple CSRF vulnerabilities. (no CVSS)
- [CVE-2020-2107](https://cve.now/CVE-2020-2107.md): Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where the (no CVSS, Jenkins project Jenkins Fortify Plugin · org.jenkins-ci.plu…)
- [CVE-2020-2108](https://cve.now/CVE-2020-2108.md): Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a use (no CVSS, Jenkins project Jenkins WebSphere Deployer Plugin · org.jen…)
- [CVE-2020-2105](https://cve.now/CVE-2020-2105.md): REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks. (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-2106](https://cve.now/CVE-2020-2106.md): Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stor (no CVSS, Jenkins project Jenkins Code Coverage API Plugin · io.jenki…)
- [CVE-2020-2103](https://cve.now/CVE-2020-2103.md): Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page. (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-2104](https://cve.now/CVE-2020-2104.md): Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart. (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-2100](https://cve.now/CVE-2020-2100.md): Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848. (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-2101](https://cve.now/CVE-2020-2101.md): Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-2102](https://cve.now/CVE-2020-2102.md): Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC. (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-2099](https://cve.now/CVE-2020-2099.md): Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2013-0161](https://cve.now/CVE-2013-0161.md): Havalite CMS 1.1.7 has a stored XSS vulnerability (no CVSS, Havalite CMS)
- [CVE-2012-5776](https://cve.now/CVE-2012-5776.md): Dokeos 2.1.1 has multiple XSS issues involving "extra\_" parameters in main/auth/profile.php. (no CVSS)
- [CVE-2012-4383](https://cve.now/CVE-2012-4383.md): contao prior to 2.11.4 has a sql injection vulnerability (no CVSS, contao · contao/core)
- [CVE-2020-7965](https://cve.now/CVE-2020-7965.md): flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. (no CVSS, webargs)
- [CVE-2019-20217](https://cve.now/CVE-2019-20217.md): D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method i (no CVSS)
- [CVE-2019-20216](https://cve.now/CVE-2019-20216.md): D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method i (no CVSS)
- [CVE-2019-20215](https://cve.now/CVE-2019-20215.md): D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.