CVEs published February 6, 2020
71 CVEs were published on February 6, 2020: 1 critical, 4 high. 2 are now in CISA KEV.
- Published
- 71
- Critical
- 1
- High
- 4
- Medium
- 1
- Low
- 0
- Unrated
- 65
- Now in CISA KEV
- 2
- Fix available
- 12
Most affected products
- Atlassian Jira Server
- 6
- Fortinet FortiClientLinux
- 3
- F5 BIG-IP
- 2
- ImageMagick
- 2
- Apache OFBiz
- 1
- Atlassian Confluence Data Center
- 1
- Atlassian Crowd
- 1
- Atlassian Jira Server and Data Center
- 1
- Atmail Webmail Server
- 1
- Bosch DIVAR IP · Bosch Video Management System +1
- 1
Critical 1
High 4
- CVE-2020-8655An issue was discovered in EyesOfNetwork 5.3.
- CVE-2020-5319Dell EMC Unity, Dell EMC Unity XT, and Dell EMC UnityVSA versions prior to 5.0.2.0.5.009 contain a Denial of Service vulnerability on NAS SeDell Unity
- CVE-2020-5318Dell EMC Isilon OneFS versions 8.1.2, 8.1.0.4, 8.1.0.3, and 8.0.0.7 contain a vulnerability in some configurations.Dell Isilon OneFS
- CVE-2020-6767Path Traversal in Bosch Video Management System (BVMS)Bosch DIVAR IP · Bosch Video Management System +1
Medium, low and unrated 66
- CVE-2020-8654An issue was discovered in EyesOfNetwork 5.3.
- CVE-2020-8645An issue was discovered in Simplejobscript.com SJS through 1.66.
- CVE-2020-8656An issue was discovered in EyesOfNetwork 5.3.
- CVE-2013-3638SQL injection vulnerability in Boonex Dolphin before 7.1.3 allows remote authenticated users to execute arbitrary SQL commands via the 'path
- CVE-2013-3568Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for re
- CVE-2013-3564The web interface in VideoLAN VLC media player before 2.0.7 has no access control which allows remote attackers to view directory listings v
- CVE-2013-2684Cross-site Scripting (XSS) in Cisco Linksys E4200 1.0.05 Build 7 devices allows remote attackers to inject arbitrary web script or HTML via
- CVE-2013-2683Cisco Linksys E4200 1.0.05 Build 7 devices contain an Information Disclosure Vulnerability which allows remote attackers to obtain private I
- CVE-2020-6760Schmid ZI 620 V400 VPN 090 routers allow an attacker to execute OS commands as root via shell metacharacters to an entry on the SSH subcomma
- CVE-2012-6341An Information Disclosure vulnerability exists in the my config file in NEtGEAR WGR614 v7 and v9, which could let a malicious user recover a
- CVE-2012-6340An Authentication vulnerability exists in NETGEAR WGR614 v7 and v9 due to a hardcoded credential used for serial programming, a related issu
- CVE-2020-5317Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability.Dell Elastic Cloud Storage
- CVE-2012-6309A vulnerability exists in Arctic Torrent 1.4 via unspecified vectors in .torrent file handling, which could let a malicious user cause a Den
- CVE-2012-6307A vulnerability exists in JPEGsnoop 1.5.2 due to an unspecified issue in JPEG file handling, which could let a malicious user execute arbitr
- CVE-2012-6306A vulnerability exists in HCView (aka Hardcoreview) 1.4 due to a write access violation with a GIF file.
- CVE-2012-6297Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted configuration values containing shell meta-charact
- CVE-2020-7920pmm-server in Percona Monitoring and Management (PMM) 2.2.x before 2.2.1 allows unauthenticated denial of service.
- CVE-2020-5720MikroTik WinBox before 3.21 is vulnerable to a path traversal vulnerability that allows creation of arbitrary files wherevere WinBox has wriMikroTik WinBox
- CVE-2020-8636An issue was discovered in OpServices OpMon 9.3.2 that allows Remote Code Execution .
- CVE-2019-12426an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.Apache OFBiz
- CVE-2020-8608In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.
- CVE-2020-7954An issue was discovered in OpServices OpMon 9.3.2.
- CVE-2020-6855A large or infinite loop vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to parameterize hou
- CVE-2020-8772The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php.
- CVE-2020-8771The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass.
- CVE-2020-7953An issue was discovered in OpServices OpMon 9.3.2.
- CVE-2020-6856An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read
- CVE-2019-19800Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelper
- CVE-2019-10789All versions of curling.js are vulnerable to Command Injection via the run function.curling.js · curling
- CVE-2013-4521RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization Nuxeo Platform
- CVE-2020-5854On BIG-IP 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.0-11.6.5.1, the tmm crashes under certaiF5 BIG-IP
- CVE-2020-5855When the Windows Logon Integration feature is configured for all versions of BIG-IP Edge Client for Windows, unauthorized users who have phyF5 Edge Client for Windows
- CVE-2020-5856On BIG-IP 15.0.0-15.0.1.1 and 14.1.0-14.1.2.2, while processing specifically crafted traffic using the default 'xnet' driver, Virtual EditioF5 BIG-IP
- CVE-2019-16152A Denial of service (DoS) vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to cause FortiClient pFortinet FortiClientLinux
- CVE-2014-10400The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID an
- CVE-2014-10399The session.lua library in CGILua 5.1.x uses the same ID for each session, which allows remote attackers to hijack arbitrary sessions.
- CVE-2014-2875The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attacker
- CVE-2019-17652A stack buffer overflow vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to cause FortiClient procFortinet FortiClientLinux
- CVE-2019-15711A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to run system commands unFortinet FortiClientLinux
- CVE-2014-1958Buffer overflow in the DecodePSDPixels function in coders/psd.c in ImageMagick before 6.8.8-5 might allow remote attackers to execute arbitr
- CVE-2014-2030Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause
- CVE-2013-4572The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cacWikimedia Foundation MediaWiki
- CVE-2013-4166The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earGNOME Evolution
- CVE-2016-1544nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).nghttp2
- CVE-2015-2909Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator confiDedicated Micros DV-IP Express · Dedicated Micros SD Adv… +3
- CVE-2014-8271Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically proximate attackers to gain privileges via a loTianocore EDK2
- CVE-2015-6000Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetaVtiger CRM
- CVE-2012-2593Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbiAtmail Webmail Server
- CVE-2016-7524coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.ImageMagick
- CVE-2016-7523coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.ImageMagick
- CVE-2016-9928MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as aMCabber
- CVE-2010-3917Google Chrome before 3.0 does not properly handle XML documents, which allows remote attackers to obtain sensitive information via a craftedGoogle Chrome
- CVE-2020-5528Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4603 and earlier (Movable Type 7), Movable Type 6.5.2 and earlieSix Apart Movable Type series
- CVE-2019-20406The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.Atlassian Confluence Data Center
- CVE-2019-20405The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flaAtlassian Jira Server
- CVE-2019-20404The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles theyAtlassian Jira Server
- CVE-2019-20403The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or nAtlassian Jira Server
- CVE-2019-20402Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without rAtlassian Jira Server
- CVE-2019-20401Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finAtlassian Jira Server
- CVE-2019-20400The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global patAtlassian Jira Server
- CVE-2019-20106Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before versioAtlassian Jira Server and Data Center
- CVE-2019-20104The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perforAtlassian Crowd
- CVE-2020-8658The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF.
- CVE-2020-8647There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c.
- CVE-2020-8648There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c.
- CVE-2020-8649There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgac