# CVEs published 2020-02-05

65 CVEs were published on February 5, 2020: 1 critical, 8 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2011-1597](https://cve.now/CVE-2011-1597.md): OpenVAS Manager v2.0.3 allows plugin remote code execution. (no CVSS, OpenVAS Manager)
- [CVE-2011-1517](https://cve.now/CVE-2011-1517.md): SAP NetWeaver 7.0 allows Remote Code Execution and Denial of Service caused by an error in the DiagTraceHex() function. (no CVSS)
- [CVE-2011-1151](https://cve.now/CVE-2011-1151.md): Joomla! 1.6.0 is vulnerable to SQL Injection via the filter\_order and filer\_order\_Dir parameters. (no CVSS, Joomla!)
- [CVE-2011-1150](https://cve.now/CVE-2011-1150.md): bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter. (no CVSS, bbPress · bbpress/bbpress)
- [CVE-2020-8644](https://cve.now/CVE-2020-8644.md): PlaySMS before 1.4.3 does not sanitize inputs from a malicious string. (CVSS 9.8, KEV)
- [CVE-2013-2682](https://cve.now/CVE-2013-2682.md): Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain sensitive informatio (no CVSS)
- [CVE-2013-2681](https://cve.now/CVE-2013-2681.md): Cisco Linksys E4200 1.0.05 Build 7 devices contain a Security Bypass Vulnerability which could allow remote attackers to gain unauthorized a (no CVSS)
- [CVE-2013-2680](https://cve.now/CVE-2013-2680.md): Cisco Linksys E4200 1.0.05 Build 7 devices store passwords in cleartext allowing remote attackers to obtain sensitive information. (no CVSS)
- [CVE-2011-1069](https://cve.now/CVE-2011-1069.md): PHPShop through 0.8.1 has XSS. (no CVSS, PHPShop)
- [CVE-2011-1009](https://cve.now/CVE-2011-1009.md): Vanilla Forums 2.0.17.1 through 2.0.17.5 has XSS in /vanilla/index.php via the p parameter. (no CVSS, Vanilla Forums)
- [CVE-2020-6854](https://cve.now/CVE-2020-6854.md): A cross-site scripting (XSS) vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to inject arbit (no CVSS)
- [CVE-2011-0525](https://cve.now/CVE-2011-0525.md): Batavi before 1.0 has CSRF. (no CVSS, Batavi)
- [CVE-2020-8641](https://cve.now/CVE-2020-8641.md): Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page\_slug parameter. (no CVSS)
- [CVE-2019-20173](https://cve.now/CVE-2019-20173.md): The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php. (no CVSS)
- [CVE-2011-0220](https://cve.now/CVE-2011-0220.md): Apple Bonjour before 2011 allows a crash via a crafted multicast DNS packet. (no CVSS, Apple Bonjour)
- [CVE-2010-5304](https://cve.now/CVE-2010-5304.md): A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. (no CVSS)
- [CVE-2019-20447](https://cve.now/CVE-2019-20447.md): Jobberbase 2.0 has SQL injection via the PATH\_INFO to the jobs-in endpoint. (no CVSS)
- [CVE-2010-4815](https://cve.now/CVE-2010-4815.md): Coppermine gallery before 1.4.26 has an input validation vulnerability that allows for code execution. (no CVSS, coppermine gallery)
- [CVE-2015-5626](https://cve.now/CVE-2015-5626.md): Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09 (no CVSS, Yokogawa CENTUM CS · Yokogawa CENTUM VP +16)
- [CVE-2015-5628](https://cve.now/CVE-2015-5628.md): Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09 (no CVSS, Yokogawa CENTUM CS · Yokogawa CENTUM VP +16)
- [CVE-2015-5627](https://cve.now/CVE-2015-5627.md): Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09 (no CVSS, Yokogawa CENTUM CS · Yokogawa CENTUM VP +16)
- [CVE-2010-4662](https://cve.now/CVE-2010-4662.md): PmWiki before 2.2.21 has XSS. (no CVSS, pmwiki)
- [CVE-2020-3120](https://cve.now/CVE-2020-3120.md): Cisco FXOS, IOS XR, and NX-OS Software Cisco Discovery Protocol Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XR Software)
- [CVE-2020-3149](https://cve.now/CVE-2020-3149.md): Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Identity Services Engine Software)
- [CVE-2020-3119](https://cve.now/CVE-2020-3119.md): Cisco NX-OS Software Cisco Discovery Protocol Remote Code Execution Vulnerability (CVSS 8.8, Cisco Unified Computing System)
- [CVE-2020-3118](https://cve.now/CVE-2020-3118.md): Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability (CVSS 8.8, KEV, Cisco IOS XR Software)
- [CVE-2020-3111](https://cve.now/CVE-2020-3111.md): Cisco IP Phone Remote Code Execution and Denial of Service Vulnerability (CVSS 8.8, Cisco IP phone)
- [CVE-2020-3110](https://cve.now/CVE-2020-3110.md): Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execution and Denial of Service Vulnerability (CVSS 8.8, Cisco Video Surveillance 8000 Series IP Cameras)
- [CVE-2013-2675](https://cve.now/CVE-2013-2675.md): Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could allow remote attacker (no CVSS)
- [CVE-2020-3123](https://cve.now/CVE-2020-3123.md): A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an una (CVSS 7.5, Cisco ClamAV)
- [CVE-2019-15253](https://cve.now/CVE-2019-15253.md): Cisco Digital Network Architecture Center Stored Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Digital Network Architecture Center)
- [CVE-2015-0102](https://cve.now/CVE-2015-0102.md): IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers (no CVSS, IBM Workflow for Bluemix)
- [CVE-2020-6833](https://cve.now/CVE-2020-6833.md): An issue was discovered in GitLab EE 11.3 and later. (no CVSS)
- [CVE-2019-15126](https://cve.now/CVE-2019-15126.md): An issue was discovered on Broadcom Wi-Fi client devices. (no CVSS)
- [CVE-2020-6754](https://cve.now/CVE-2020-6754.md): dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. (no CVSS)
- [CVE-2019-12180](https://cve.now/CVE-2019-12180.md): An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. (no CVSS)
- [CVE-2019-11516](https://cve.now/CVE-2019-11516.md): An issue was discovered in the Bluetooth component of the Cypress (formerly owned by Broadcom) Wireless IoT codebase. (no CVSS)
- [CVE-2020-7966](https://cve.now/CVE-2020-7966.md): GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal. (no CVSS)
- [CVE-2020-7967](https://cve.now/CVE-2020-7967.md): GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2). (no CVSS)
- [CVE-2020-7968](https://cve.now/CVE-2020-7968.md): GitLab EE 8.0 through 12.7.2 has Incorrect Access Control. (no CVSS)
- [CVE-2020-7969](https://cve.now/CVE-2020-7969.md): GitLab EE 8.0 and later through 12.7.2 allows Information Disclosure. (no CVSS)
- [CVE-2020-7971](https://cve.now/CVE-2020-7971.md): GitLab EE 11.0 and later through 12.7.2 allows XSS. (no CVSS)
- [CVE-2020-7972](https://cve.now/CVE-2020-7972.md): GitLab EE 12.2 has Insecure Permissions (issue 2 of 2). (no CVSS)
- [CVE-2020-7973](https://cve.now/CVE-2020-7973.md): GitLab through 12.7.2 allows XSS. (no CVSS)
- [CVE-2020-7974](https://cve.now/CVE-2020-7974.md): GitLab EE 10.1 through 12.7.2 allows Information Disclosure. (no CVSS)
- [CVE-2020-6174](https://cve.now/CVE-2020-6174.md): TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature. (no CVSS, tuf)
- [CVE-2020-7976](https://cve.now/CVE-2020-7976.md): GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control. (no CVSS)
- [CVE-2013-0507](https://cve.now/CVE-2013-0507.md): IBM InfoSphere Information Server 8.1, 8.5, 8.7, 9.1 has a Session Fixation Vulnerability (no CVSS, IBM InfoSphere Information Server)
- [CVE-2020-7977](https://cve.now/CVE-2020-7977.md): GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions. (no CVSS)
- [CVE-2020-7978](https://cve.now/CVE-2020-7978.md): GitLab EE 12.6 and later through 12.7.2 allows Denial of Service. (no CVSS)
- [CVE-2019-4670](https://cve.now/CVE-2019-4670.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper dat (CVSS 6.5, IBM WebSphere Application Server)
- [CVE-2019-4616](https://cve.now/CVE-2019-4616.md): IBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or session cookies. (CVSS 4.3, IBM Cloud Automation Manager)
- [CVE-2019-4613](https://cve.now/CVE-2019-4613.md): IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized a (CVSS 4.3, IBM Planning Analytics)
- [CVE-2020-8506](https://cve.now/CVE-2020-8506.md): The Global TV application 2.3.2 for Android and 4.7.5 for iOS sends Unencrypted Analytics. (no CVSS)
- [CVE-2019-16204](https://cve.now/CVE-2019-16204.md): Brocade Fabric OS Versions before v7.4.2f, v8.2.2a, v8.1.2j and v8.2.1d could expose external passwords, common secrets or authentication ke (no CVSS, Brocade Fabric OS)
- [CVE-2019-16203](https://cve.now/CVE-2019-16203.md): Brocade Fabric OS Versions before v8.2.2a and v8.2.1d could expose the credentials of the remote ESRS server when these credentials are give (no CVSS, Brocade Fabric OS)
- [CVE-2020-8507](https://cve.now/CVE-2020-8507.md): The Citytv Video application 4.08.0 for Android and 3.35 for iOS sends Unencrypted Analytics. (no CVSS)
- [CVE-2020-6969](https://cve.now/CVE-2020-6969.md): It is possible to unmask credentials and other sensitive information on “unprotected” project files, which may allow an attacker to remotely (no CVSS, C-More Touch Panels EA9 series)
- [CVE-2020-7979](https://cve.now/CVE-2020-7979.md): GitLab EE 8.9 and later through 12.7.2 has Insecure Permission (no CVSS)
- [CVE-2020-8114](https://cve.now/CVE-2020-8114.md): GitLab EE 8.9 and later through 12.7.2 has Insecure Permission (no CVSS)
- [CVE-2020-7216](https://cve.now/CVE-2020-7216.md): An ni\_dhcp4\_parse\_response memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sendin (no CVSS)
- [CVE-2020-5208](https://cve.now/CVE-2020-5208.md): remote code execution vulnerability in ipmitool (CVSS 7.7, ipmitool)
- [CVE-2020-5237](https://cve.now/CVE-2020-5237.md): Relative Path Traversal in oneup/uploader-bundle (CVSS 8.8, 1up-lab oneup/uploader-bundle · oneup/uploader-bundle)
- [CVE-2020-8632](https://cve.now/CVE-2020-8632.md): In cloud-init through 19.4, rand\_user\_password in cloudinit/config/cc\_set\_passwords.py has a small default pwlen value, which makes it easie (no CVSS)
- [CVE-2020-8631](https://cve.now/CVE-2020-8631.md): cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-02-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.