CVEs published February 5, 2020
65 CVEs were published on February 5, 2020: 1 critical, 8 high. 2 are now in CISA KEV.
- Published
- 65
- Critical
- 1
- High
- 8
- Medium
- 5
- Low
- 0
- Unrated
- 51
- Now in CISA KEV
- 2
- Fix available
- 9
Most affected products
- Yokogawa CENTUM CS · Yokogawa CENTUM VP +16
- 3
- Brocade Fabric OS
- 2
- Cisco IOS XR Software
- 2
- 1up-lab oneup/uploader-bundle · oneup/uploader-bundle
- 1
- Apple Bonjour
- 1
- Batavi
- 1
- bbPress · bbpress/bbpress
- 1
- C-More Touch Panels EA9 series
- 1
- Cisco ClamAV
- 1
- Cisco Digital Network Architecture Center
- 1
Critical 1
High 8
- CVE-2020-3120Cisco FXOS, IOS XR, and NX-OS Software Cisco Discovery Protocol Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2020-3119Cisco NX-OS Software Cisco Discovery Protocol Remote Code Execution VulnerabilityCisco Unified Computing System
- CVE-2020-3118Cisco IOS XR Software Cisco Discovery Protocol Format String VulnerabilityCisco IOS XR Software
- CVE-2020-3111Cisco IP Phone Remote Code Execution and Denial of Service VulnerabilityCisco IP phone
- CVE-2020-3110Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execution and Denial of Service VulnerabilityCisco Video Surveillance 8000 Series IP Cameras
- CVE-2020-3123A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unaCisco ClamAV
- CVE-2020-5208remote code execution vulnerability in ipmitoolipmitool
- CVE-2020-5237Relative Path Traversal in oneup/uploader-bundle1up-lab oneup/uploader-bundle · oneup/uploader-bundle
Medium, low and unrated 56
- CVE-2011-1597OpenVAS Manager v2.0.3 allows plugin remote code execution.OpenVAS Manager
- CVE-2011-1517SAP NetWeaver 7.0 allows Remote Code Execution and Denial of Service caused by an error in the DiagTraceHex() function.
- CVE-2011-1151Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters.Joomla!
- CVE-2011-1150bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter.bbPress · bbpress/bbpress
- CVE-2013-2682Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain sensitive informatio
- CVE-2013-2681Cisco Linksys E4200 1.0.05 Build 7 devices contain a Security Bypass Vulnerability which could allow remote attackers to gain unauthorized a
- CVE-2013-2680Cisco Linksys E4200 1.0.05 Build 7 devices store passwords in cleartext allowing remote attackers to obtain sensitive information.
- CVE-2011-1069PHPShop through 0.8.1 has XSS.PHPShop
- CVE-2011-1009Vanilla Forums 2.0.17.1 through 2.0.17.5 has XSS in /vanilla/index.php via the p parameter.Vanilla Forums
- CVE-2020-6854A cross-site scripting (XSS) vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to inject arbit
- CVE-2011-0525Batavi before 1.0 has CSRF.Batavi
- CVE-2020-8641Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page_slug parameter.
- CVE-2019-20173The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.
- CVE-2011-0220Apple Bonjour before 2011 allows a crash via a crafted multicast DNS packet.Apple Bonjour
- CVE-2010-5304A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message.
- CVE-2019-20447Jobberbase 2.0 has SQL injection via the PATH_INFO to the jobs-in endpoint.
- CVE-2010-4815Coppermine gallery before 1.4.26 has an input validation vulnerability that allows for code execution.coppermine gallery
- CVE-2015-5626Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09Yokogawa CENTUM CS · Yokogawa CENTUM VP +16
- CVE-2015-5628Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09Yokogawa CENTUM CS · Yokogawa CENTUM VP +16
- CVE-2015-5627Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09Yokogawa CENTUM CS · Yokogawa CENTUM VP +16
- CVE-2010-4662PmWiki before 2.2.21 has XSS.pmwiki
- CVE-2020-3149Cisco Identity Services Engine Stored Cross-Site Scripting VulnerabilityCisco Identity Services Engine Software
- CVE-2013-2675Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could allow remote attacker
- CVE-2019-15253Cisco Digital Network Architecture Center Stored Cross-Site Scripting VulnerabilityCisco Digital Network Architecture Center
- CVE-2015-0102IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackersIBM Workflow for Bluemix
- CVE-2020-6833An issue was discovered in GitLab EE 11.3 and later.
- CVE-2019-15126An issue was discovered on Broadcom Wi-Fi client devices.
- CVE-2020-6754dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control.
- CVE-2019-12180An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5.
- CVE-2019-11516An issue was discovered in the Bluetooth component of the Cypress (formerly owned by Broadcom) Wireless IoT codebase.
- CVE-2020-7966GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal.
- CVE-2020-7967GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2).
- CVE-2020-7968GitLab EE 8.0 through 12.7.2 has Incorrect Access Control.
- CVE-2020-7969GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure.
- CVE-2020-7971GitLab EE 11.0 and later through 12.7.2 allows XSS.
- CVE-2020-7972GitLab EE 12.2 has Insecure Permissions (issue 2 of 2).
- CVE-2020-7973GitLab through 12.7.2 allows XSS.
- CVE-2020-7974GitLab EE 10.1 through 12.7.2 allows Information Disclosure.
- CVE-2020-6174TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.tuf
- CVE-2020-7976GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control.
- CVE-2013-0507IBM InfoSphere Information Server 8.1, 8.5, 8.7, 9.1 has a Session Fixation VulnerabilityIBM InfoSphere Information Server
- CVE-2020-7977GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions.
- CVE-2020-7978GitLab EE 12.6 and later through 12.7.2 allows Denial of Service.
- CVE-2019-4670IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper datIBM WebSphere Application Server
- CVE-2019-4616IBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or session cookies.IBM Cloud Automation Manager
- CVE-2019-4613IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized aIBM Planning Analytics
- CVE-2020-8506The Global TV application 2.3.2 for Android and 4.7.5 for iOS sends Unencrypted Analytics.
- CVE-2019-16204Brocade Fabric OS Versions before v7.4.2f, v8.2.2a, v8.1.2j and v8.2.1d could expose external passwords, common secrets or authentication keBrocade Fabric OS
- CVE-2019-16203Brocade Fabric OS Versions before v8.2.2a and v8.2.1d could expose the credentials of the remote ESRS server when these credentials are giveBrocade Fabric OS
- CVE-2020-8507The Citytv Video application 4.08.0 for Android and 3.35 for iOS sends Unencrypted Analytics.
- CVE-2020-6969It is possible to unmask credentials and other sensitive information on “unprotected” project files, which may allow an attacker to remotelyC-More Touch Panels EA9 series
- CVE-2020-7979GitLab EE 8.9 and later through 12.7.2 has Insecure Permission
- CVE-2020-8114GitLab EE 8.9 and later through 12.7.2 has Insecure Permission
- CVE-2020-7216An ni_dhcp4_parse_response memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sendin
- CVE-2020-8632In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easie
- CVE-2020-8631cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because