# CVEs published 2020-01-30

56 CVEs were published on January 30, 2020: 0 critical, 8 high. Days are UTC.

- [CVE-2020-5232](https://cve.now/CVE-2020-5232.md): Ethereum Name Service - Malicious takeover of previously owned ENS names (CVSS 8.7, @ensdomains/ens)
- [CVE-2020-8498](https://cve.now/CVE-2020-8498.md): XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id paramet (no CVSS)
- [CVE-2019-10782](https://cve.now/CVE-2019-10782.md): All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix f (no CVSS, com.puppycrawl.tools:checkstyle)
- [CVE-2020-5206](https://cve.now/CVE-2020-5206.md): Authentication Bypass For Endpoints With Anonymous Access in OpenCast (CVSS 8.7, opencast · org.opencastproject:opencast-kernel)
- [CVE-2020-8493](https://cve.now/CVE-2020-8493.md): A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fiel (CVSS 6.9)
- [CVE-2020-8494](https://cve.now/CVE-2020-8494.md): In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an atta (CVSS 7.5)
- [CVE-2020-8495](https://cve.now/CVE-2020-8495.md): In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an atta (CVSS 7.5)
- [CVE-2020-8496](https://cve.now/CVE-2020-8496.md): In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Applic (CVSS 6.9)
- [CVE-2020-5231](https://cve.now/CVE-2020-5231.md): Opencast users with ROLE\_COURSE\_ADMIN can create new users (CVSS 4.8, opencast · org.opencastproject:opencast-kernel)
- [CVE-2019-20358](https://cve.now/CVE-2019-20358.md): Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious fil (no CVSS, Trend Micro Anti-Threat Toolkit)
- [CVE-2020-8095](https://cve.now/CVE-2020-8095.md): Bitdefender Total Security Link Resolution Denial-of-Service Vulnerability (CVSS 4.9, Bitdefender Total Security)
- [CVE-2020-5230](https://cve.now/CVE-2020-5230.md): Opencast uses unsafe identifiers (CVSS 7.7, opencast · org.opencastproject:base)
- [CVE-2020-5222](https://cve.now/CVE-2020-5222.md): Hard-Coded Key Used For Remember-me Token in OpenCast (CVSS 6.8, opencast · org.opencastproject:opencast-kernel)
- [CVE-2015-0949](https://cve.now/CVE-2015-0949.md): The System Management Mode (SMM) implementation in Dell Latitude E6430 BIOS Revision A09, HP EliteBook 850 G1 BIOS revision L71 Ver. (no CVSS, Dell Latitude E6430 · HP EliteBook 850 G1)
- [CVE-2015-8851](https://cve.now/CVE-2015-8851.md): node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact (CVSS 7.5, node-uuid)
- [CVE-2013-4187](https://cve.now/CVE-2013-4187.md): The Flippy module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to nodes, which allows remote authenticated users with (no CVSS, Flippy)
- [CVE-2013-2198](https://cve.now/CVE-2013-2198.md): The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows attackers to bypass intended restrictions via (no CVSS, Login Security)
- [CVE-2013-2294](https://cve.now/CVE-2013-2294.md): Multiple cross-site scripting (XSS) vulnerabilities in ViewGit before 0.0.7 allow remote repository users to inject arbitrary web script or (no CVSS)
- [CVE-2013-4241](https://cve.now/CVE-2013-4241.md): Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inj (no CVSS, HitMyServer HMS Testimonials)
- [CVE-2012-6133](https://cve.now/CVE-2012-6133.md): Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML v (no CVSS, Roundup)
- [CVE-2020-5229](https://cve.now/CVE-2020-5229.md): Opencast stores passwords using outdated MD5 hash algorithm (CVSS 7.7, opencast · org.opencastproject:opencast-common-jpa-impl)
- [CVE-2020-5228](https://cve.now/CVE-2020-5228.md): Opencast allows unauthorized public access via OAI-PMH (CVSS 7.6, opencast · org.opencastproject:opencast-oaipmh-api)
- [CVE-2014-3719](https://cve.now/CVE-2014-3719.md): Multiple SQL injection vulnerabilities in cgi-bin/review\_m.cgi in Ex Libris ALEPH 500 (Integrated library management system) 18.1 and 20 all (no CVSS)
- [CVE-2014-3718](https://cve.now/CVE-2014-3718.md): Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/tag\_m.cgi in Ex Libris ALEPH 500 (Integrated library management system) 18.1 (no CVSS)
- [CVE-2019-17273](https://cve.now/CVE-2019-17273.md): E-Series SANtricity OS Controller Software version 11.60.0 is susceptible to a vulnerability which allows an attacker to cause a Denial of S (no CVSS, NetApp E-Series SANtricity OS Controller Software)
- [CVE-2020-5233](https://cve.now/CVE-2020-5233.md): Open Redirect in OAuth2 Proxy (CVSS 5.9, pusher OAuth2 Proxy · github.com/oauth2-proxy/oauth2-proxy)
- [CVE-2020-1930](https://cve.now/CVE-2020-1930.md): A command execution issue was found in Apache SpamAssassin prior to 3.4.3. (no CVSS, Apache Software Foundation Apache SpamAssassin)
- [CVE-2020-1931](https://cve.now/CVE-2020-1931.md): A command execution issue was found in Apache SpamAssassin prior to 3.4.3. (no CVSS, Apache Software Foundation Apache SpamAssassin)
- [CVE-2020-7913](https://cve.now/CVE-2020-7913.md): JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description. (no CVSS)
- [CVE-2020-7912](https://cve.now/CVE-2020-7912.md): In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups. (no CVSS)
- [CVE-2020-7911](https://cve.now/CVE-2020-7911.md): In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS. (no CVSS)
- [CVE-2020-7910](https://cve.now/CVE-2020-7910.md): JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role. (no CVSS)
- [CVE-2020-7909](https://cve.now/CVE-2020-7909.md): In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI. (no CVSS)
- [CVE-2020-7908](https://cve.now/CVE-2020-7908.md): In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages. (no CVSS)
- [CVE-2020-7906](https://cve.now/CVE-2020-7906.md): In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer. (no CVSS)
- [CVE-2020-7905](https://cve.now/CVE-2020-7905.md): Ports listened to by JetBrains IntelliJ IDEA before 2019.3 were exposed to the network. (no CVSS)
- [CVE-2020-7904](https://cve.now/CVE-2020-7904.md): In JetBrains IntelliJ IDEA before 2019.3, some Maven repositories were accessed via HTTP instead of HTTPS. (no CVSS)
- [CVE-2019-20050](https://cve.now/CVE-2019-20050.md): Pandora FMS ≤ 7.42 suffers from a remote code execution vulnerability. (no CVSS)
- [CVE-2013-0739](https://cve.now/CVE-2013-0739.md): Chamilo 1.9.4 has XSS due to improper validation of user-supplied input by the chat.php script. (no CVSS, Chamilo)
- [CVE-2013-0738](https://cve.now/CVE-2013-0738.md): Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php. (no CVSS, Chamilo)
- [CVE-2013-1631](https://cve.now/CVE-2013-1631.md): Verax NMS prior to 2.1.0 leaks connection details when any user executes a Repair Table action (no CVSS)
- [CVE-2013-1352](https://cve.now/CVE-2013-1352.md): Verax NMS prior to 2.1.0 uses an encryption key that is hardcoded in a JAR archive. (no CVSS)
- [CVE-2013-1351](https://cve.now/CVE-2013-1351.md): Verax NMS prior to 2.10 allows authentication via the encrypted password without knowing the cleartext password. (no CVSS)
- [CVE-2013-1350](https://cve.now/CVE-2013-1350.md): Verax NMS prior to 2.1.0 has multiple security bypass vulnerabilities (no CVSS)
- [CVE-2013-1867](https://cve.now/CVE-2013-1867.md): Gemalto Tokend 2013 has an Arbitrary File Creation/Overwrite Vulnerability (no CVSS, Gemalto Tokend)
- [CVE-2013-1866](https://cve.now/CVE-2013-1866.md): OpenSC OpenSC.tokend has an Arbitrary File Creation/Overwrite Vulnerability (no CVSS, OpenSC.tokend)
- [CVE-2013-0725](https://cve.now/CVE-2013-0725.md): ERDAS ER Viewer 13.0 has dwmapi.dll and irml.dll libraries arbitrary code execution vulnerabilities (no CVSS, ERDAS ER Viewer)
- [CVE-2013-0291](https://cve.now/CVE-2013-0291.md): NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability (no CVSS, NextGEN Gallery Plugin authors NextGEN Gallery Plugin)
- [CVE-2020-8442](https://cve.now/CVE-2020-8442.md): In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a heap-based buffer ov (no CVSS)
- [CVE-2020-8443](https://cve.now/CVE-2020-8443.md): In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to an off-by-one heap-bas (no CVSS)
- [CVE-2020-8444](https://cve.now/CVE-2020-8444.md): In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a use-after-free durin (no CVSS)
- [CVE-2020-8445](https://cve.now/CVE-2020-8445.md): In OSSEC-HIDS 2.7 through 3.5.0, the OS\_CleanMSG function in ossec-analysisd doesn't remove or encode terminal control characters or newline (no CVSS)
- [CVE-2020-8446](https://cve.now/CVE-2020-8446.md): In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to path traversal (with w (no CVSS)
- [CVE-2020-8447](https://cve.now/CVE-2020-8447.md): In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a use-after-free durin (no CVSS)
- [CVE-2020-8448](https://cve.now/CVE-2020-8448.md): In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a denial of service (N (no CVSS)
- [CVE-2020-8492](https://cve.now/CVE-2020-8492.md): Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct (CVSS 6.5, libpython · python +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.