# CVEs published 2020-01-31

51 CVEs were published on January 31, 2020: 0 critical, 1 high. Days are UTC.

- [CVE-2020-8512](https://cve.now/CVE-2020-8512.md): In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter. (no CVSS)
- [CVE-2014-2025](https://cve.now/CVE-2014-2025.md): Unrestricted file upload vulnerability in an unspecified third party tool in United Planet Intrexx Professional before 5.2 Online Update 090 (no CVSS)
- [CVE-2014-8141](https://cve.now/CVE-2014-8141.md): Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code (no CVSS, Info-ZIP UnZip)
- [CVE-2014-8140](https://cve.now/CVE-2014-8140.md): Heap-based buffer overflow in the test\_compr\_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code (no CVSS, Info-ZIP UnZip)
- [CVE-2014-8139](https://cve.now/CVE-2014-8139.md): Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via (no CVSS, Info-ZIP UnZip)
- [CVE-2014-3809](https://cve.now/CVE-2014-3809.md): Cross-site scripting (XSS) vulnerability in the management interface in Alcatel-Lucent 1830 Photonic Service Switch (PSS) 6.0 and earlier al (no CVSS)
- [CVE-2014-5039](https://cve.now/CVE-2014-5039.md): Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.2 allows remote attackers to inject arbitra (no CVSS)
- [CVE-2014-8338](https://cve.now/CVE-2014-8338.md): Cross-site scripting (XSS) vulnerability in vwrooms/js/jsor-jcarousel/examples/special\_textscroller.php in the VideoWhisper Webcam plugins f (no CVSS)
- [CVE-2013-3565](https://cve.now/CVE-2013-3565.md): Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers t (no CVSS)
- [CVE-2014-8126](https://cve.now/CVE-2014-8126.md): The scheduler in HTCondor before 8.2.6 allows remote authenticated users to execute arbitrary code. (no CVSS, HTCondor)
- [CVE-2015-6815](https://cve.now/CVE-2015-6815.md): The process\_tx\_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a netw (no CVSS, QEMU)
- [CVE-2020-8504](https://cve.now/CVE-2020-8504.md): School Management Software PHP/mySQL through 2019-03-14 allows office\_admin/?action=addadmin CSRF to add an administrative user. (no CVSS)
- [CVE-2020-8505](https://cve.now/CVE-2020-8505.md): School Management Software PHP/mySQL through 2019-03-14 allows office\_admin/?action=deleteadmin CSRF to delete a user. (no CVSS)
- [CVE-2014-8322](https://cve.now/CVE-2014-8322.md): Stack-based buffer overflow in the tcp\_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbi (no CVSS)
- [CVE-2014-8321](https://cve.now/CVE-2014-8321.md): Stack-based buffer overflow in the gps\_tracker function in airodump-ng.c in Aircrack-ng before 1.2 RC 1 allows local users to execute arbitr (no CVSS)
- [CVE-2014-5236](https://cve.now/CVE-2014-5236.md): Multiple absolute path traversal vulnerabilities in documentconverter in Open-Xchange (OX) AppSuite before 7.4.2-rev10 and 7.6.x before 7.6. (no CVSS)
- [CVE-2014-3868](https://cve.now/CVE-2014-3868.md): Multiple SQL injection vulnerabilities in ZeusCart 4.x. (no CVSS)
- [CVE-2014-3119](https://cve.now/CVE-2014-3119.md): Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via (no CVSS)
- [CVE-2020-8503](https://cve.now/CVE-2020-8503.md): Biscom Secure File Transfer (SFT) 5.0.1050 through 5.1.1067 and 6.0.1000 through 6.0.1003 allows Insecure Direct Object Reference (IDOR) by (no CVSS)
- [CVE-2016-2032](https://cve.now/CVE-2016-2032.md): A vulnerability exists in the Aruba AirWave Management Platform 8.x prior to 8.2 in the management interface of an underlying system compone (no CVSS)
- [CVE-2019-3016](https://cve.now/CVE-2019-3016.md): In a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in the (CVSS 6.2, linux\_kernel)
- [CVE-2019-13000](https://cve.now/CVE-2019-13000.md): Eclair through 0.3 allows attackers to trigger loss of funds because of Incorrect Access Control. (no CVSS)
- [CVE-2019-12999](https://cve.now/CVE-2019-12999.md): Lightning Network Daemon (lnd) before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control. (no CVSS, github.com/lightningnetwork/lnd)
- [CVE-2019-12998](https://cve.now/CVE-2019-12998.md): c-lightning before 0.7.1 allows attackers to trigger loss of funds because of Incorrect Access Control. (no CVSS)
- [CVE-2016-2031](https://cve.now/CVE-2016-2031.md): Multiple vulnerabilities exists in Aruba Instate before 4.1.3.0 and 4.2.3.1 due to insufficient validation of user-supplied input and insuff (no CVSS)
- [CVE-2014-2843](https://cve.now/CVE-2014-2843.md): Cross-site scripting (XSS) vulnerability in infoware MapSuite MapAPI 1.0.x before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to (no CVSS)
- [CVE-2020-5234](https://cve.now/CVE-2020-5234.md): Untrusted data can lead to DoS attack in MessagePack for C# and Unity (CVSS 4.8, neuecc MessagePack · neuecc MessagePack.ImmutableCollect… +7)
- [CVE-2013-3489](https://cve.now/CVE-2013-3489.md): Buffer overflow in Media Player Classic - Home Cinema (MPC-HC) before 1.7.0 allows remote attackers to execute arbitrary code via a crafted (no CVSS, Media Player Classic - Home Cinema)
- [CVE-2013-3488](https://cve.now/CVE-2013-3488.md): Stack-based buffer overflow in Media Player Classic - Home Cinema (MPC-HC) before 1.7.0.7858 allows remote attackers to execute arbitrary co (no CVSS, Media Player Classic - Home Cinema)
- [CVE-2011-4115](https://cve.now/CVE-2011-4115.md): Parallel::ForkManager module before 1.0.0 for Perl does not properly handle temporary files. (no CVSS, Parallel::ForkManager)
- [CVE-2011-4116](https://cve.now/CVE-2011-4116.md): \_is\_safe in the File::Temp module for Perl does not properly handle symlinks. (no CVSS, File::Temp)
- [CVE-2011-4117](https://cve.now/CVE-2011-4117.md): The Batch::BatchRun module 1.03 for Perl does not properly handle temporary files. (no CVSS, Batch::BatchRun)
- [CVE-2011-4088](https://cve.now/CVE-2011-4088.md): ABRT might allow attackers to obtain sensitive information from crash reports. (no CVSS, ABRT)
- [CVE-2019-4720](https://cve.now/CVE-2019-4720.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. (CVSS 7.5, IBM WebSphere Application Server)
- [CVE-2020-8422](https://cve.now/CVE-2020-8422.md): An authorization issue was discovered in the Credential Manager feature in Zoho ManageEngine Remote Access Plus before 10.0.450. (CVSS 4.3)
- [CVE-2014-4859](https://cve.now/CVE-2014-4859.md): Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows phys (no CVSS, Phoenix Technologies SCT3 · American Megatrends Incorporate…)
- [CVE-2014-4860](https://cve.now/CVE-2014-4860.md): Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 a (no CVSS, Phoenix Technologies SCT3 · American Megatrends Incorporate…)
- [CVE-2013-5116](https://cve.now/CVE-2013-5116.md): Evernote prior to 5.5.1 has insecure password change (no CVSS)
- [CVE-2013-5113](https://cve.now/CVE-2013-5113.md): LastPass prior to 2.5.1 has an insecure PIN implementation. (no CVSS)
- [CVE-2013-5114](https://cve.now/CVE-2013-5114.md): LastPass prior to 2.5.1 allows secure wipe bypass. (no CVSS)
- [CVE-2013-5112](https://cve.now/CVE-2013-5112.md): Evernote before 5.5.1 has insecure PIN storage (no CVSS)
- [CVE-2019-19550](https://cve.now/CVE-2019-19550.md): Remote Authentication Bypass in Senior Rubiweb 6.2.34.28 and 6.2.34.37 allows admin access to sensitive information of affected users using (no CVSS)
- [CVE-2020-8440](https://cve.now/CVE-2020-8440.md): controllers/page\_apply.php in Simplejobscript.com SJS through 1.66 is prone to unauthenticated Remote Code Execution by uploading a PHP scri (no CVSS)
- [CVE-2013-3322](https://cve.now/CVE-2013-3322.md): NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to inject arbitrary commands in the Halt/Reboot interface. (no CVSS)
- [CVE-2020-7956](https://cve.now/CVE-2020-7956.md): HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and (no CVSS, github.com/hashicorp/nomad)
- [CVE-2020-7219](https://cve.now/CVE-2020-7219.md): HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticat (no CVSS, github.com/hashicorp/consul)
- [CVE-2020-7218](https://cve.now/CVE-2020-7218.md): HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticate (no CVSS, github.com/hashicorp/nomad)
- [CVE-2020-7955](https://cve.now/CVE-2020-7955.md): HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential u (no CVSS, github.com/hashicorp/consul)
- [CVE-2020-7914](https://cve.now/CVE-2020-7914.md): In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file read operations over the network. (no CVSS)
- [CVE-2020-5526](https://cve.now/CVE-2020-5526.md): The AWMS Mobile App for Android 2.0.0 to 2.0.5 and for iOS 2.0.0 to 2.0.8 does not verify X.509 certificates from servers, which allows man- (no CVSS, Fuji Xerox Co. AWMS Mobile App)
- [CVE-2019-18913](https://cve.now/CVE-2019-18913.md): A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks. (no CVSS, HP Intel-based Business PCs that support Microsoft Windows…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.