CVEs published January 30, 2020
56 CVEs were published on January 30, 2020: 0 critical, 8 high.
- Published
- 56
- Critical
- 0
- High
- 8
- Medium
- 7
- Low
- 0
- Unrated
- 41
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- opencast · org.opencastproject:opencast-kernel
- 3
- Apache Software Foundation Apache SpamAssassin
- 2
- Chamilo
- 2
- @ensdomains/ens
- 1
- Bitdefender Total Security
- 1
- com.puppycrawl.tools:checkstyle
- 1
- Dell Latitude E6430 · HP EliteBook 850 G1
- 1
- ERDAS ER Viewer
- 1
- Flippy
- 1
- Gemalto Tokend
- 1
High 8
- CVE-2020-5232Ethereum Name Service - Malicious takeover of previously owned ENS names@ensdomains/ens
- CVE-2020-5206Authentication Bypass For Endpoints With Anonymous Access in OpenCastopencast · org.opencastproject:opencast-kernel
- CVE-2020-8494In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an atta
- CVE-2020-8495In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an atta
- CVE-2020-5230Opencast uses unsafe identifiersopencast · org.opencastproject:base
- CVE-2015-8851node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impactnode-uuid
- CVE-2020-5229Opencast stores passwords using outdated MD5 hash algorithmopencast · org.opencastproject:opencast-common-jpa-impl
- CVE-2020-5228Opencast allows unauthorized public access via OAI-PMHopencast · org.opencastproject:opencast-oaipmh-api
Medium, low and unrated 48
- CVE-2020-8498XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id paramet
- CVE-2019-10782All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix fcom.puppycrawl.tools:checkstyle
- CVE-2020-8493A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fiel
- CVE-2020-8496In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Applic
- CVE-2020-5231Opencast users with ROLE_COURSE_ADMIN can create new usersopencast · org.opencastproject:opencast-kernel
- CVE-2019-20358Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious filTrend Micro Anti-Threat Toolkit
- CVE-2020-8095Bitdefender Total Security Link Resolution Denial-of-Service VulnerabilityBitdefender Total Security
- CVE-2020-5222Hard-Coded Key Used For Remember-me Token in OpenCastopencast · org.opencastproject:opencast-kernel
- CVE-2015-0949The System Management Mode (SMM) implementation in Dell Latitude E6430 BIOS Revision A09, HP EliteBook 850 G1 BIOS revision L71 Ver.Dell Latitude E6430 · HP EliteBook 850 G1
- CVE-2013-4187The Flippy module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to nodes, which allows remote authenticated users withFlippy
- CVE-2013-2198The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows attackers to bypass intended restrictions via Login Security
- CVE-2013-2294Multiple cross-site scripting (XSS) vulnerabilities in ViewGit before 0.0.7 allow remote repository users to inject arbitrary web script or
- CVE-2013-4241Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to injHitMyServer HMS Testimonials
- CVE-2012-6133Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML vRoundup
- CVE-2014-3719Multiple SQL injection vulnerabilities in cgi-bin/review_m.cgi in Ex Libris ALEPH 500 (Integrated library management system) 18.1 and 20 all
- CVE-2014-3718Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/tag_m.cgi in Ex Libris ALEPH 500 (Integrated library management system) 18.1
- CVE-2019-17273E-Series SANtricity OS Controller Software version 11.60.0 is susceptible to a vulnerability which allows an attacker to cause a Denial of SNetApp E-Series SANtricity OS Controller Software
- CVE-2020-5233Open Redirect in OAuth2 Proxypusher OAuth2 Proxy · github.com/oauth2-proxy/oauth2-proxy
- CVE-2020-1930A command execution issue was found in Apache SpamAssassin prior to 3.4.3.Apache Software Foundation Apache SpamAssassin
- CVE-2020-1931A command execution issue was found in Apache SpamAssassin prior to 3.4.3.Apache Software Foundation Apache SpamAssassin
- CVE-2020-7913JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description.
- CVE-2020-7912In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.
- CVE-2020-7911In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS.
- CVE-2020-7910JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.
- CVE-2020-7909In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI.
- CVE-2020-7908In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages.
- CVE-2020-7906In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer.
- CVE-2020-7905Ports listened to by JetBrains IntelliJ IDEA before 2019.3 were exposed to the network.
- CVE-2020-7904In JetBrains IntelliJ IDEA before 2019.3, some Maven repositories were accessed via HTTP instead of HTTPS.
- CVE-2019-20050Pandora FMS ≤ 7.42 suffers from a remote code execution vulnerability.
- CVE-2013-0739Chamilo 1.9.4 has XSS due to improper validation of user-supplied input by the chat.php script.Chamilo
- CVE-2013-0738Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php.Chamilo
- CVE-2013-1631Verax NMS prior to 2.1.0 leaks connection details when any user executes a Repair Table action
- CVE-2013-1352Verax NMS prior to 2.1.0 uses an encryption key that is hardcoded in a JAR archive.
- CVE-2013-1351Verax NMS prior to 2.10 allows authentication via the encrypted password without knowing the cleartext password.
- CVE-2013-1350Verax NMS prior to 2.1.0 has multiple security bypass vulnerabilities
- CVE-2013-1867Gemalto Tokend 2013 has an Arbitrary File Creation/Overwrite VulnerabilityGemalto Tokend
- CVE-2013-1866OpenSC OpenSC.tokend has an Arbitrary File Creation/Overwrite VulnerabilityOpenSC.tokend
- CVE-2013-0725ERDAS ER Viewer 13.0 has dwmapi.dll and irml.dll libraries arbitrary code execution vulnerabilitiesERDAS ER Viewer
- CVE-2013-0291NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure VulnerabilityNextGEN Gallery Plugin authors NextGEN Gallery Plugin
- CVE-2020-8442In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a heap-based buffer ov
- CVE-2020-8443In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to an off-by-one heap-bas
- CVE-2020-8444In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a use-after-free durin
- CVE-2020-8445In OSSEC-HIDS 2.7 through 3.5.0, the OS_CleanMSG function in ossec-analysisd doesn't remove or encode terminal control characters or newline
- CVE-2020-8446In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to path traversal (with w
- CVE-2020-8447In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a use-after-free durin
- CVE-2020-8448In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a denial of service (N
- CVE-2020-8492Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct libpython · python +1