CVEs published February 4, 2020
74 CVEs were published on February 4, 2020: 1 critical, 4 high.
- Published
- 74
- Critical
- 1
- High
- 4
- Medium
- 12
- Low
- 1
- Unrated
- 56
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Nextcloud Server
- 14
- IBM Security Directory Server
- 6
- CHANGING Syuan-Gu-Da-Shih
- 3
- IBM Security Identity Manager
- 3
- Mini-SNMPD
- 3
- Joomla!
- 2
- Nextcloud Android
- 2
- dot-prop
- 1
- https://github.com/revive-adserver/revive-adserver
- 1
- IBM WebSphere Application Server
- 1
Critical 1
High 4
- CVE-2020-6058An exploitable out-of-bounds read vulnerability exists in the way MiniSNMPD version 1.4 parses incoming SNMP packets.Mini-SNMPD
- CVE-2020-6059An exploitable out of bounds read vulnerability exists in the way MiniSNMPD version 1.4 parses incoming SNMP packets.Mini-SNMPD
- CVE-2020-6060A stack buffer overflow vulnerability exists in the way MiniSNMPD version 1.4 handles multiple connections.Mini-SNMPD
- CVE-2020-3937SysJust Syuan-Gu-Da-Shih-SQL injectionCHANGING Syuan-Gu-Da-Shih
Medium, low and unrated 69
- CVE-2019-10786network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument.network-manager
- CVE-2019-10787im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument.im-resize
- CVE-2015-2802An Information Disclosure vulnerability exists in HP SiteScope 11.2 and 11.3 on Windows, Linux and Solaris, HP Asset Manager 9.30 through 9.
- CVE-2019-12528An issue was discovered in Squid before 4.10.
- CVE-2019-10788im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument.im-metadata
- CVE-2020-8517An issue was discovered in Squid before 4.10.
- CVE-2020-8450An issue was discovered in Squid before 4.10.
- CVE-2020-8449An issue was discovered in Squid before 4.10.
- CVE-2015-3613A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page
- CVE-2015-3612A Cross-site Scripting (XSS) vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspecified parameter in t
- CVE-2015-3611A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors, whic
- CVE-2019-15610Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle.Nextcloud Circles
- CVE-2019-15611Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when searNextcloud iOS
- CVE-2019-15612A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset.Nextcloud Server
- CVE-2019-15613A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.Nextcloud Server
- CVE-2019-15614Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files.Nextcloud iOS App
- CVE-2019-15615A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to thNextcloud Android
- CVE-2019-15616Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.Nextcloud Server
- CVE-2019-15617A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.Nextcloud Server
- CVE-2019-15618Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.Nextcloud Server
- CVE-2019-15619Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud DecNextcloud Server
- CVE-2019-15620Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another sharedNextcloud Talk
- CVE-2019-15621Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the moNextcloud Server
- CVE-2019-15622Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables wheNextcloud Android
- CVE-2019-15623Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup ServerNextcloud Server
- CVE-2019-15624Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.Nextcloud Server
- CVE-2020-8115A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Thttps://github.com/revive-adserver/revive-adserver
- CVE-2020-8116Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbidot-prop
- CVE-2020-8117Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event.Nextcloud Server
- CVE-2020-8118An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscrNextcloud Server
- CVE-2020-8119Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the galleryNextcloud Server
- CVE-2020-8120A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation.Nextcloud Server
- CVE-2020-8121A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer.Nextcloud Server
- CVE-2020-8122A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received.Nextcloud server
- CVE-2020-8123A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbStrapi · strapi-admin
- CVE-2020-8124Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypasurl-parse
- CVE-2020-8125Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code klona npm module · klona
- CVE-2020-8615A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and
- CVE-2019-10784phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application.phppgadmin
- CVE-2020-7221mysql_install_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root because chown and chmod a
- CVE-2020-4163IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated user to create a malicioIBM WebSphere Application Server
- CVE-2019-4675IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inboIBM Security Identity Manager
- CVE-2019-4674IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system.IBM Security Identity Manager
- CVE-2019-4562IBM Security Directory Server 6.4.0 stores sensitive information in URLs.IBM Security Directory Server
- CVE-2019-4551IBM Security Directory Server 6.4.0 does not perform an authentication check for a critical resource or functionality allowing anonymous useIBM Security Directory Server
- CVE-2019-4550IBM Security Directory Server 6.4.0 is deployed with active debugging code that can create unintended entry points.IBM Security Directory Server
- CVE-2019-4548IBM Security Directory Server 6.4.0 could allow a remote attacker to hijack the clicking action of the victim.IBM Security Directory Server
- CVE-2019-4541IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls IBM Security Directory Server
- CVE-2019-4540IBM Security Directory Server 6.4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitIBM Security Directory Server
- CVE-2019-4451IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting.IBM Security Identity Manager
- CVE-2019-19273On Samsung mobile devices with O(8.0) and P(9.0) software and an Exynos 8895 chipset, RKP (aka the Samsung Hypervisor EL2 implementation) al
- CVE-2013-2678Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attackers to obtain sensitive
- CVE-2019-19968PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Builder components.
- CVE-2019-9674Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.
- CVE-2013-2676Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view private IP
- CVE-2013-7055D-Link DIR-100 4.03B07 has PPTP and poe information disclosure
- CVE-2013-7054D-Link DIR-100 4.03B07: cli.cgi XSS
- CVE-2013-7053D-Link DIR-100 4.03B07: cli.cgi CSRF
- CVE-2013-7052D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script
- CVE-2013-7051D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters
- CVE-2013-1422webcalendar before 1.2.7 shows the reason for a failed login (e.g., "no such user").
- CVE-2012-5686ZPanel 10.0.1 has insufficient entropy for its password reset process.
- CVE-2011-4912Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.Joomla!
- CVE-2012-5618Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens.Ushahidi
- CVE-2011-3629Joomla! core 1.7.1 allows information disclosure due to weak encryptionJoomla! core
- CVE-2011-4937Joomla! 1.7.1 has core information disclosure due to inadequate error checking.Joomla!
- CVE-2020-3939SysJust Syuan-Gu-Da-Shih -Cross-Site Scripting(XSS)CHANGING Syuan-Gu-Da-Shih
- CVE-2020-5236Catastrophic backtracking in regex allows Denial of Service in WaitressPylons Waitress · waitress
- CVE-2020-5235Out-of-memory condition in Nanopb is potentially exploitableNanopb