CVEs published February 3, 2020
36 CVEs were published on February 3, 2020: 1 critical, 5 high.
- Published
- 36
- Critical
- 1
- High
- 5
- Medium
- 3
- Low
- 1
- Unrated
- 26
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- CHANGING ServiSign Windows versions
- 3
- Broadcom WiFi drivers
- 2
- Apple Safari
- 1
- auth0-lock
- 1
- Bromium client
- 1
- django
- 1
- IBM Java
- 1
- IBM StoredIQ
- 1
- Kubernetes · k8s.io/kubernetes
- 1
- t3/dce
- 1
Critical 1
High 5
- CVE-2019-9502Broadcom wl driver is vulnerable to heap buffer overflowBroadcom WiFi drivers
- CVE-2019-9501Broadcom wl driver is vulnerable to heap buffer overflowBroadcom WiFi drivers
- CVE-2019-4732IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a locaIBM Java
- CVE-2020-3927ServiSign Windows Versions- Arbitrary File DeletionCHANGING ServiSign Windows versions
- CVE-2020-3925ServiSign Windows Versions- Remote Code Execution via LoadLibraryCHANGING ServiSign Windows versions
Medium, low and unrated 30
- CVE-2020-8591eG Manager 7.1.2 allows authentication bypass via a com.egurkha.EgLoginServlet?uname=admin&upass=&accessKey=eGm0n1t0r request.
- CVE-2020-8592eG Manager 7.1.2 allows SQL Injection via the user parameter to com.eg.LoginHelperServlet (aka the Forgot Password feature).
- CVE-2019-18567Bromium client - out of bound read results in race condition causing Kernel memory leaks or denial of serviceBromium client
- CVE-2013-2674Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view sensitive
- CVE-2019-20174Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder.auth0-lock
- CVE-2016-4676A Cross-origin vulnerability exists in WebKit in Apple Safari before 10.0.1 when processing location attributes, which could let a remote maApple Safari
- CVE-2013-2673Brother MFC-9970CDW 1.10 firmware L devices contain a security bypass vulnerability which allows physically proximate attackers to gain unau
- CVE-2020-5182The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing.
- CVE-2020-4224IBM StoredIQ 7.6.0.17 through 7.6.0.20 could disclose sensitive information to a local user due to data in certain directories not being encIBM StoredIQ
- CVE-2020-8549Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stea
- CVE-2013-2672Brother MFC-9970CDW devices with firmware 0D allow cleartext submission of passwords.
- CVE-2013-2646TP-LINK TL-WR1043ND V1_120405 devices contain an unspecified denial of service vulnerability.
- CVE-2020-8548massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences
- CVE-2019-16893The Web Management of TP-Link TP-SG105E V4 1.0.0 Build 20181120 devices allows an unauthenticated attacker to reboot the device via a reboot
- CVE-2020-8547phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes tha
- CVE-2019-11251kubectl cp allows symlink directory traversalKubernetes · k8s.io/kubernetes
- CVE-2020-8545Global.py in AIL framework 2.8 allows path traversal.
- CVE-2020-8510An issue was discovered in phpABook 0.9 Intermediate.
- CVE-2019-19119An issue was discovered in PRTG 7.x through 19.4.53.
- CVE-2013-2631TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive infor
- CVE-2013-2624Telean before 1.3.1 contains a full path disclosure vulnerability which could allow remote attackers to obtain sensitive information through
- CVE-2013-2623Cross-site Scripting (XSS) in Telaen before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the "f_email" parameter
- CVE-2013-2622Cross-site Scripting (XSS) in UebiMiau 2.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the "selected_t
- CVE-2020-7993Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID fiel
- CVE-2013-2621Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websi
- CVE-2014-8328The default configuration in the Dynamic Content Elements (dce) extension before 0.11.5 for TYPO3 allows remote attackers to obtain sensitivt3/dce
- CVE-2019-18193In Unisys Stealth (core) 3.4.108.0, 3.4.209.x, 4.0.027.x and 4.0.114, key material inadvertently logged under certain conditions.
- CVE-2020-7471Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter django
- CVE-2020-3926ServiSign Windows Versions- Arbitrary File AccessCHANGING ServiSign Windows versions
- CVE-2020-8508nsak64.sys in Norman Malware Cleaner 2.08.08 allows users to call arbitrary kernel functions because the passing of function pointers betwee