# CVEs published 2020-02-03

36 CVEs were published on February 3, 2020: 1 critical, 5 high. Days are UTC.

- [CVE-2020-8597](https://cve.now/CVE-2020-8597.md): eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap\_request and eap\_response functions. (CVSS 9.8)
- [CVE-2019-9502](https://cve.now/CVE-2019-9502.md): Broadcom wl driver is vulnerable to heap buffer overflow (CVSS 7.9, Broadcom WiFi drivers)
- [CVE-2019-9501](https://cve.now/CVE-2019-9501.md): Broadcom wl driver is vulnerable to heap buffer overflow (CVSS 7.9, Broadcom WiFi drivers)
- [CVE-2020-8591](https://cve.now/CVE-2020-8591.md): eG Manager 7.1.2 allows authentication bypass via a com.egurkha.EgLoginServlet?uname=admin&upass=&accessKey=eGm0n1t0r request. (no CVSS)
- [CVE-2020-8592](https://cve.now/CVE-2020-8592.md): eG Manager 7.1.2 allows SQL Injection via the user parameter to com.eg.LoginHelperServlet (aka the Forgot Password feature). (no CVSS)
- [CVE-2019-18567](https://cve.now/CVE-2019-18567.md): Bromium client - out of bound read results in race condition causing Kernel memory leaks or denial of service (CVSS 6.1, Bromium client)
- [CVE-2013-2674](https://cve.now/CVE-2013-2674.md): Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view sensitive (no CVSS)
- [CVE-2019-20174](https://cve.now/CVE-2019-20174.md): Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder. (no CVSS, auth0-lock)
- [CVE-2016-4676](https://cve.now/CVE-2016-4676.md): A Cross-origin vulnerability exists in WebKit in Apple Safari before 10.0.1 when processing location attributes, which could let a remote ma (no CVSS, Apple Safari)
- [CVE-2013-2673](https://cve.now/CVE-2013-2673.md): Brother MFC-9970CDW 1.10 firmware L devices contain a security bypass vulnerability which allows physically proximate attackers to gain unau (no CVSS)
- [CVE-2020-5182](https://cve.now/CVE-2020-5182.md): The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing. (no CVSS)
- [CVE-2020-4224](https://cve.now/CVE-2020-4224.md): IBM StoredIQ 7.6.0.17 through 7.6.0.20 could disclose sensitive information to a local user due to data in certain directories not being enc (CVSS 2.9, IBM StoredIQ)
- [CVE-2019-4732](https://cve.now/CVE-2019-4732.md): IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a loca (CVSS 7.2, IBM Java)
- [CVE-2020-8549](https://cve.now/CVE-2020-8549.md): Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stea (no CVSS)
- [CVE-2013-2672](https://cve.now/CVE-2013-2672.md): Brother MFC-9970CDW devices with firmware 0D allow cleartext submission of passwords. (no CVSS)
- [CVE-2013-2646](https://cve.now/CVE-2013-2646.md): TP-LINK TL-WR1043ND V1\_120405 devices contain an unspecified denial of service vulnerability. (no CVSS)
- [CVE-2020-8548](https://cve.now/CVE-2020-8548.md): massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences (no CVSS)
- [CVE-2019-16893](https://cve.now/CVE-2019-16893.md): The Web Management of TP-Link TP-SG105E V4 1.0.0 Build 20181120 devices allows an unauthenticated attacker to reboot the device via a reboot (no CVSS)
- [CVE-2020-8547](https://cve.now/CVE-2020-8547.md): phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes tha (no CVSS)
- [CVE-2019-11251](https://cve.now/CVE-2019-11251.md): kubectl cp allows symlink directory traversal (CVSS 4.8, Kubernetes · k8s.io/kubernetes)
- [CVE-2020-8545](https://cve.now/CVE-2020-8545.md): Global.py in AIL framework 2.8 allows path traversal. (no CVSS)
- [CVE-2020-8510](https://cve.now/CVE-2020-8510.md): An issue was discovered in phpABook 0.9 Intermediate. (no CVSS)
- [CVE-2019-19119](https://cve.now/CVE-2019-19119.md): An issue was discovered in PRTG 7.x through 19.4.53. (no CVSS)
- [CVE-2013-2631](https://cve.now/CVE-2013-2631.md): TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive infor (no CVSS)
- [CVE-2013-2624](https://cve.now/CVE-2013-2624.md): Telean before 1.3.1 contains a full path disclosure vulnerability which could allow remote attackers to obtain sensitive information through (no CVSS)
- [CVE-2013-2623](https://cve.now/CVE-2013-2623.md): Cross-site Scripting (XSS) in Telaen before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the "f\_email" parameter (no CVSS)
- [CVE-2013-2622](https://cve.now/CVE-2013-2622.md): Cross-site Scripting (XSS) in UebiMiau 2.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the "selected\_t (no CVSS)
- [CVE-2020-7993](https://cve.now/CVE-2020-7993.md): Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID fiel (no CVSS)
- [CVE-2013-2621](https://cve.now/CVE-2013-2621.md): Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websi (no CVSS)
- [CVE-2014-8328](https://cve.now/CVE-2014-8328.md): The default configuration in the Dynamic Content Elements (dce) extension before 0.11.5 for TYPO3 allows remote attackers to obtain sensitiv (no CVSS, t3/dce)
- [CVE-2019-18193](https://cve.now/CVE-2019-18193.md): In Unisys Stealth (core) 3.4.108.0, 3.4.209.x, 4.0.027.x and 4.0.114, key material inadvertently logged under certain conditions. (no CVSS)
- [CVE-2020-7471](https://cve.now/CVE-2020-7471.md): Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (no CVSS, django)
- [CVE-2020-3927](https://cve.now/CVE-2020-3927.md): ServiSign Windows Versions- Arbitrary File Deletion (CVSS 8.3, CHANGING ServiSign Windows versions)
- [CVE-2020-3926](https://cve.now/CVE-2020-3926.md): ServiSign Windows Versions- Arbitrary File Access (CVSS 6.1, CHANGING ServiSign Windows versions)
- [CVE-2020-3925](https://cve.now/CVE-2020-3925.md): ServiSign Windows Versions- Remote Code Execution via LoadLibrary (CVSS 8.3, CHANGING ServiSign Windows versions)
- [CVE-2020-8508](https://cve.now/CVE-2020-8508.md): nsak64.sys in Norman Malware Cleaner 2.08.08 allows users to call arbitrary kernel functions because the passing of function pointers betwee (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-02-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.