CVEs published January 31, 2020
51 CVEs were published on January 31, 2020: 0 critical, 1 high.
- Published
- 51
- Critical
- 0
- High
- 1
- Medium
- 3
- Low
- 0
- Unrated
- 47
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Info-ZIP UnZip
- 3
- github.com/hashicorp/consul
- 2
- github.com/hashicorp/nomad
- 2
- Media Player Classic - Home Cinema
- 2
- Phoenix Technologies SCT3 · American Megatrends Incorporate…
- 2
- ABRT
- 1
- Batch::BatchRun
- 1
- File::Temp
- 1
- Fuji Xerox Co. AWMS Mobile App
- 1
- github.com/lightningnetwork/lnd
- 1
High 1
Medium, low and unrated 50
- CVE-2020-8512In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.
- CVE-2014-2025Unrestricted file upload vulnerability in an unspecified third party tool in United Planet Intrexx Professional before 5.2 Online Update 090
- CVE-2014-8141Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code Info-ZIP UnZip
- CVE-2014-8140Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary codeInfo-ZIP UnZip
- CVE-2014-8139Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code viaInfo-ZIP UnZip
- CVE-2014-3809Cross-site scripting (XSS) vulnerability in the management interface in Alcatel-Lucent 1830 Photonic Service Switch (PSS) 6.0 and earlier al
- CVE-2014-5039Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.2 allows remote attackers to inject arbitra
- CVE-2014-8338Cross-site scripting (XSS) vulnerability in vwrooms/js/jsor-jcarousel/examples/special_textscroller.php in the VideoWhisper Webcam plugins f
- CVE-2013-3565Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers t
- CVE-2014-8126The scheduler in HTCondor before 8.2.6 allows remote authenticated users to execute arbitrary code.HTCondor
- CVE-2015-6815The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a netwQEMU
- CVE-2020-8504School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user.
- CVE-2020-8505School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user.
- CVE-2014-8322Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbi
- CVE-2014-8321Stack-based buffer overflow in the gps_tracker function in airodump-ng.c in Aircrack-ng before 1.2 RC 1 allows local users to execute arbitr
- CVE-2014-5236Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6.
- CVE-2014-3868Multiple SQL injection vulnerabilities in ZeusCart 4.x.
- CVE-2014-3119Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via
- CVE-2020-8503Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 and 6.0.1000 through 6.0.1003 allows Insecure Direct Object Reference (IDOR) by
- CVE-2016-2032A vulnerability exists in the Aruba AirWave Management Platform 8.x prior to 8.2 in the management interface of an underlying system compone
- CVE-2019-3016In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in thelinux_kernel
- CVE-2019-13000Eclair through 0.3 allows attackers to trigger loss of funds because of Incorrect Access Control.
- CVE-2019-12999Lightning Network Daemon (lnd) before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control.github.com/lightningnetwork/lnd
- CVE-2019-12998c-lightning before 0.7.1 allows attackers to trigger loss of funds because of Incorrect Access Control.
- CVE-2016-2031Multiple vulnerabilities exists in Aruba Instate before 4.1.3.0 and 4.2.3.1 due to insufficient validation of user-supplied input and insuff
- CVE-2014-2843Cross-site scripting (XSS) vulnerability in infoware MapSuite MapAPI 1.0.x before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to
- CVE-2020-5234Untrusted data can lead to DoS attack in MessagePack for C# and Unityneuecc MessagePack · neuecc MessagePack.ImmutableCollect… +7
- CVE-2013-3489Buffer overflow in Media Player Classic - Home Cinema (MPC-HC) before 1.7.0 allows remote attackers to execute arbitrary code via a crafted Media Player Classic - Home Cinema
- CVE-2013-3488Stack-based buffer overflow in Media Player Classic - Home Cinema (MPC-HC) before 1.7.0.7858 allows remote attackers to execute arbitrary coMedia Player Classic - Home Cinema
- CVE-2011-4115Parallel::ForkManager module before 1.0.0 for Perl does not properly handle temporary files.Parallel::ForkManager
- CVE-2011-4116_is_safe in the File::Temp module for Perl does not properly handle symlinks.File::Temp
- CVE-2011-4117The Batch::BatchRun module 1.03 for Perl does not properly handle temporary files.Batch::BatchRun
- CVE-2011-4088ABRT might allow attackers to obtain sensitive information from crash reports.ABRT
- CVE-2020-8422An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450.
- CVE-2014-4859Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physPhoenix Technologies SCT3 · American Megatrends Incorporate…
- CVE-2014-4860Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 aPhoenix Technologies SCT3 · American Megatrends Incorporate…
- CVE-2013-5116Evernote prior to 5.5.1 has insecure password change
- CVE-2013-5113LastPass prior to 2.5.1 has an insecure PIN implementation.
- CVE-2013-5114LastPass prior to 2.5.1 allows secure wipe bypass.
- CVE-2013-5112Evernote before 5.5.1 has insecure PIN storage
- CVE-2019-19550Remote Authentication Bypass in Senior Rubiweb 6.2.34.28 and 6.2.34.37 allows admin access to sensitive information of affected users using
- CVE-2020-8440controllers/page_apply.php in Simplejobscript.com SJS through 1.66 is prone to unauthenticated Remote Code Execution by uploading a PHP scri
- CVE-2013-3322NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to inject arbitrary commands in the Halt/Reboot interface.
- CVE-2020-7956HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and github.com/hashicorp/nomad
- CVE-2020-7219HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticatgithub.com/hashicorp/consul
- CVE-2020-7218HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticategithub.com/hashicorp/nomad
- CVE-2020-7955HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential ugithub.com/hashicorp/consul
- CVE-2020-7914In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file read operations over the network.
- CVE-2020-5526The AWMS Mobile App for Android 2.0.0 to 2.0.5 and for iOS 2.0.0 to 2.0.8 does not verify X.509 certificates from servers, which allows man-Fuji Xerox Co. AWMS Mobile App
- CVE-2019-18913A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks.HP Intel-based Business PCs that support Microsoft Windows…