# CVEs published 2020-02-04

74 CVEs were published on February 4, 2020: 1 critical, 4 high. Days are UTC.

- [CVE-2019-10786](https://cve.now/CVE-2019-10786.md): network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument. (no CVSS, network-manager)
- [CVE-2019-10787](https://cve.now/CVE-2019-10787.md): im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. (no CVSS, im-resize)
- [CVE-2015-2802](https://cve.now/CVE-2015-2802.md): An Information Disclosure vulnerability exists in HP SiteScope 11.2 and 11.3 on Windows, Linux and Solaris, HP Asset Manager 9.30 through 9. (no CVSS)
- [CVE-2019-12528](https://cve.now/CVE-2019-12528.md): An issue was discovered in Squid before 4.10. (no CVSS)
- [CVE-2019-10788](https://cve.now/CVE-2019-10788.md): im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. (no CVSS, im-metadata)
- [CVE-2020-8517](https://cve.now/CVE-2020-8517.md): An issue was discovered in Squid before 4.10. (no CVSS)
- [CVE-2020-8450](https://cve.now/CVE-2020-8450.md): An issue was discovered in Squid before 4.10. (no CVSS)
- [CVE-2020-8449](https://cve.now/CVE-2020-8449.md): An issue was discovered in Squid before 4.10. (no CVSS)
- [CVE-2015-3613](https://cve.now/CVE-2015-3613.md): A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page (no CVSS)
- [CVE-2015-3612](https://cve.now/CVE-2015-3612.md): A Cross-site Scripting (XSS) vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspecified parameter in t (no CVSS)
- [CVE-2020-6058](https://cve.now/CVE-2020-6058.md): An exploitable out-of-bounds read vulnerability exists in the way MiniSNMPD version 1.4 parses incoming SNMP packets. (CVSS 8.2, Mini-SNMPD)
- [CVE-2020-6059](https://cve.now/CVE-2020-6059.md): An exploitable out of bounds read vulnerability exists in the way MiniSNMPD version 1.4 parses incoming SNMP packets. (CVSS 8.2, Mini-SNMPD)
- [CVE-2020-6060](https://cve.now/CVE-2020-6060.md): A stack buffer overflow vulnerability exists in the way MiniSNMPD version 1.4 handles multiple connections. (CVSS 7.5, Mini-SNMPD)
- [CVE-2015-3611](https://cve.now/CVE-2015-3611.md): A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors, whic (no CVSS)
- [CVE-2019-15610](https://cve.now/CVE-2019-15610.md): Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle. (no CVSS, Nextcloud Circles)
- [CVE-2019-15611](https://cve.now/CVE-2019-15611.md): Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when sear (no CVSS, Nextcloud iOS)
- [CVE-2019-15612](https://cve.now/CVE-2019-15612.md): A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset. (no CVSS, Nextcloud Server)
- [CVE-2019-15613](https://cve.now/CVE-2019-15613.md): A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes. (no CVSS, Nextcloud Server)
- [CVE-2019-15614](https://cve.now/CVE-2019-15614.md): Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files. (no CVSS, Nextcloud iOS App)
- [CVE-2019-15615](https://cve.now/CVE-2019-15615.md): A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to th (no CVSS, Nextcloud Android)
- [CVE-2019-15616](https://cve.now/CVE-2019-15616.md): Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long. (no CVSS, Nextcloud Server)
- [CVE-2019-15617](https://cve.now/CVE-2019-15617.md): A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login. (no CVSS, Nextcloud Server)
- [CVE-2019-15618](https://cve.now/CVE-2019-15618.md): Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location. (no CVSS, Nextcloud Server)
- [CVE-2019-15619](https://cve.now/CVE-2019-15619.md): Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Dec (no CVSS, Nextcloud Server)
- [CVE-2019-15620](https://cve.now/CVE-2019-15620.md): Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared (no CVSS, Nextcloud Talk)
- [CVE-2019-15621](https://cve.now/CVE-2019-15621.md): Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mo (no CVSS, Nextcloud Server)
- [CVE-2019-15622](https://cve.now/CVE-2019-15622.md): Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables whe (no CVSS, Nextcloud Android)
- [CVE-2019-15623](https://cve.now/CVE-2019-15623.md): Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server (no CVSS, Nextcloud Server)
- [CVE-2019-15624](https://cve.now/CVE-2019-15624.md): Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders. (no CVSS, Nextcloud Server)
- [CVE-2020-8115](https://cve.now/CVE-2020-8115.md): A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver \<= 5.0.3 by Jacopo T (no CVSS, https://github.com/revive-adserver/revive-adserver)
- [CVE-2020-8116](https://cve.now/CVE-2020-8116.md): Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbi (no CVSS, dot-prop)
- [CVE-2020-8117](https://cve.now/CVE-2020-8117.md): Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event. (no CVSS, Nextcloud Server)
- [CVE-2020-8118](https://cve.now/CVE-2020-8118.md): An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscr (no CVSS, Nextcloud Server)
- [CVE-2020-8119](https://cve.now/CVE-2020-8119.md): Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery (no CVSS, Nextcloud Server)
- [CVE-2020-8120](https://cve.now/CVE-2020-8120.md): A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation. (no CVSS, Nextcloud Server)
- [CVE-2020-8121](https://cve.now/CVE-2020-8121.md): A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer. (no CVSS, Nextcloud Server)
- [CVE-2020-8122](https://cve.now/CVE-2020-8122.md): A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received. (no CVSS, Nextcloud server)
- [CVE-2020-8123](https://cve.now/CVE-2020-8123.md): A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arb (no CVSS, Strapi · strapi-admin)
- [CVE-2020-8124](https://cve.now/CVE-2020-8124.md): Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypas (no CVSS, url-parse)
- [CVE-2020-8125](https://cve.now/CVE-2020-8125.md): Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code (no CVSS, klona npm module · klona)
- [CVE-2020-8615](https://cve.now/CVE-2020-8615.md): A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and (no CVSS)
- [CVE-2019-10784](https://cve.now/CVE-2019-10784.md): phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. (no CVSS, phppgadmin)
- [CVE-2020-7221](https://cve.now/CVE-2020-7221.md): mysql\_install\_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root because chown and chmod a (no CVSS)
- [CVE-2020-4163](https://cve.now/CVE-2020-4163.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated user to create a malicio (CVSS 6.6, IBM WebSphere Application Server)
- [CVE-2019-4675](https://cve.now/CVE-2019-4675.md): IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbo (CVSS 6.8, IBM Security Identity Manager)
- [CVE-2019-4674](https://cve.now/CVE-2019-4674.md): IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. (CVSS 6.8, IBM Security Identity Manager)
- [CVE-2019-4562](https://cve.now/CVE-2019-4562.md): IBM Security Directory Server 6.4.0 stores sensitive information in URLs. (CVSS 3.7, IBM Security Directory Server)
- [CVE-2019-4551](https://cve.now/CVE-2019-4551.md): IBM Security Directory Server 6.4.0 does not perform an authentication check for a critical resource or functionality allowing anonymous use (CVSS 5.3, IBM Security Directory Server)
- [CVE-2019-4550](https://cve.now/CVE-2019-4550.md): IBM Security Directory Server 6.4.0 is deployed with active debugging code that can create unintended entry points. (CVSS 5.3, IBM Security Directory Server)
- [CVE-2019-4548](https://cve.now/CVE-2019-4548.md): IBM Security Directory Server 6.4.0 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 6.1, IBM Security Directory Server)
- [CVE-2019-4541](https://cve.now/CVE-2019-4541.md): IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls (CVSS 6.5, IBM Security Directory Server)
- [CVE-2019-4540](https://cve.now/CVE-2019-4540.md): IBM Security Directory Server 6.4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensit (CVSS 5.9, IBM Security Directory Server)
- [CVE-2019-4451](https://cve.now/CVE-2019-4451.md): IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Security Identity Manager)
- [CVE-2019-19273](https://cve.now/CVE-2019-19273.md): On Samsung mobile devices with O(8.0) and P(9.0) software and an Exynos 8895 chipset, RKP (aka the Samsung Hypervisor EL2 implementation) al (no CVSS)
- [CVE-2013-2678](https://cve.now/CVE-2013-2678.md): Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attackers to obtain sensitive (no CVSS)
- [CVE-2019-19968](https://cve.now/CVE-2019-19968.md): PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Builder components. (no CVSS)
- [CVE-2019-9674](https://cve.now/CVE-2019-9674.md): Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. (no CVSS)
- [CVE-2013-2676](https://cve.now/CVE-2013-2676.md): Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view private IP (no CVSS)
- [CVE-2013-7055](https://cve.now/CVE-2013-7055.md): D-Link DIR-100 4.03B07 has PPTP and poe information disclosure (no CVSS)
- [CVE-2013-7054](https://cve.now/CVE-2013-7054.md): D-Link DIR-100 4.03B07: cli.cgi XSS (no CVSS)
- [CVE-2013-7053](https://cve.now/CVE-2013-7053.md): D-Link DIR-100 4.03B07: cli.cgi CSRF (no CVSS)
- [CVE-2013-7052](https://cve.now/CVE-2013-7052.md): D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script (no CVSS)
- [CVE-2013-7051](https://cve.now/CVE-2013-7051.md): D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters (no CVSS)
- [CVE-2013-1422](https://cve.now/CVE-2013-1422.md): webcalendar before 1.2.7 shows the reason for a failed login (e.g., "no such user"). (no CVSS)
- [CVE-2012-5686](https://cve.now/CVE-2012-5686.md): ZPanel 10.0.1 has insufficient entropy for its password reset process. (no CVSS)
- [CVE-2011-4912](https://cve.now/CVE-2011-4912.md): Joomla! com\_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass. (no CVSS, Joomla!)
- [CVE-2012-5618](https://cve.now/CVE-2012-5618.md): Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens. (no CVSS, Ushahidi)
- [CVE-2011-3629](https://cve.now/CVE-2011-3629.md): Joomla! core 1.7.1 allows information disclosure due to weak encryption (no CVSS, Joomla! core)
- [CVE-2011-4937](https://cve.now/CVE-2011-4937.md): Joomla! 1.7.1 has core information disclosure due to inadequate error checking. (no CVSS, Joomla!)
- [CVE-2020-3939](https://cve.now/CVE-2020-3939.md): SysJust Syuan-Gu-Da-Shih -Cross-Site Scripting(XSS) (CVSS 6.1, CHANGING Syuan-Gu-Da-Shih)
- [CVE-2020-3938](https://cve.now/CVE-2020-3938.md): SysJust Syuan-Gu-Da-Shih -Request-Forgery (CVSS 9.8, CHANGING Syuan-Gu-Da-Shih)
- [CVE-2020-3937](https://cve.now/CVE-2020-3937.md): SysJust Syuan-Gu-Da-Shih-SQL injection (CVSS 8.1, CHANGING Syuan-Gu-Da-Shih)
- [CVE-2020-5236](https://cve.now/CVE-2020-5236.md): Catastrophic backtracking in regex allows Denial of Service in Waitress (CVSS 5.7, Pylons Waitress · waitress)
- [CVE-2020-5235](https://cve.now/CVE-2020-5235.md): Out-of-memory condition in Nanopb is potentially exploitable (CVSS 6.5, Nanopb)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-02-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.