# CVEs published 2020-02-06

71 CVEs were published on February 6, 2020: 1 critical, 4 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2020-8655](https://cve.now/CVE-2020-8655.md): An issue was discovered in EyesOfNetwork 5.3. (CVSS 7.8, KEV)
- [CVE-2020-8654](https://cve.now/CVE-2020-8654.md): An issue was discovered in EyesOfNetwork 5.3. (no CVSS)
- [CVE-2020-8645](https://cve.now/CVE-2020-8645.md): An issue was discovered in Simplejobscript.com SJS through 1.66. (no CVSS)
- [CVE-2020-8656](https://cve.now/CVE-2020-8656.md): An issue was discovered in EyesOfNetwork 5.3. (no CVSS)
- [CVE-2013-3638](https://cve.now/CVE-2013-3638.md): SQL injection vulnerability in Boonex Dolphin before 7.1.3 allows remote authenticated users to execute arbitrary SQL commands via the 'path (no CVSS)
- [CVE-2013-3568](https://cve.now/CVE-2013-3568.md): Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for re (no CVSS)
- [CVE-2013-3564](https://cve.now/CVE-2013-3564.md): The web interface in VideoLAN VLC media player before 2.0.7 has no access control which allows remote attackers to view directory listings v (no CVSS)
- [CVE-2013-2684](https://cve.now/CVE-2013-2684.md): Cross-site Scripting (XSS) in Cisco Linksys E4200 1.0.05 Build 7 devices allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2013-2683](https://cve.now/CVE-2013-2683.md): Cisco Linksys E4200 1.0.05 Build 7 devices contain an Information Disclosure Vulnerability which allows remote attackers to obtain private I (no CVSS)
- [CVE-2020-6760](https://cve.now/CVE-2020-6760.md): Schmid ZI 620 V400 VPN 090 routers allow an attacker to execute OS commands as root via shell metacharacters to an entry on the SSH subcomma (no CVSS)
- [CVE-2012-6341](https://cve.now/CVE-2012-6341.md): An Information Disclosure vulnerability exists in the my config file in NEtGEAR WGR614 v7 and v9, which could let a malicious user recover a (no CVSS)
- [CVE-2012-6340](https://cve.now/CVE-2012-6340.md): An Authentication vulnerability exists in NETGEAR WGR614 v7 and v9 due to a hardcoded credential used for serial programming, a related issu (no CVSS)
- [CVE-2020-8657](https://cve.now/CVE-2020-8657.md): An issue was discovered in EyesOfNetwork 5.3. (CVSS 9.8, KEV)
- [CVE-2020-5319](https://cve.now/CVE-2020-5319.md): Dell EMC Unity, Dell EMC Unity XT, and Dell EMC UnityVSA versions prior to 5.0.2.0.5.009 contain a Denial of Service vulnerability on NAS Se (CVSS 7.5, Dell Unity)
- [CVE-2020-5318](https://cve.now/CVE-2020-5318.md): Dell EMC Isilon OneFS versions 8.1.2, 8.1.0.4, 8.1.0.3, and 8.0.0.7 contain a vulnerability in some configurations. (CVSS 7.5, Dell Isilon OneFS)
- [CVE-2020-5317](https://cve.now/CVE-2020-5317.md): Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability. (CVSS 6.2, Dell Elastic Cloud Storage)
- [CVE-2012-6309](https://cve.now/CVE-2012-6309.md): A vulnerability exists in Arctic Torrent 1.4 via unspecified vectors in .torrent file handling, which could let a malicious user cause a Den (no CVSS)
- [CVE-2012-6307](https://cve.now/CVE-2012-6307.md): A vulnerability exists in JPEGsnoop 1.5.2 due to an unspecified issue in JPEG file handling, which could let a malicious user execute arbitr (no CVSS)
- [CVE-2012-6306](https://cve.now/CVE-2012-6306.md): A vulnerability exists in HCView (aka Hardcoreview) 1.4 due to a write access violation with a GIF file. (no CVSS)
- [CVE-2012-6297](https://cve.now/CVE-2012-6297.md): Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted configuration values containing shell meta-charact (no CVSS)
- [CVE-2020-7920](https://cve.now/CVE-2020-7920.md): pmm-server in Percona Monitoring and Management (PMM) 2.2.x before 2.2.1 allows unauthenticated denial of service. (no CVSS)
- [CVE-2020-5720](https://cve.now/CVE-2020-5720.md): MikroTik WinBox before 3.21 is vulnerable to a path traversal vulnerability that allows creation of arbitrary files wherevere WinBox has wri (no CVSS, MikroTik WinBox)
- [CVE-2020-8636](https://cve.now/CVE-2020-8636.md): An issue was discovered in OpServices OpMon 9.3.2 that allows Remote Code Execution . (no CVSS)
- [CVE-2019-12426](https://cve.now/CVE-2019-12426.md): an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16. (no CVSS, Apache OFBiz)
- [CVE-2020-8608](https://cve.now/CVE-2020-8608.md): In libslirp 4.1.0, as used in QEMU 4.2.0, tcp\_subr.c misuses snprintf return values, leading to a buffer overflow in later code. (no CVSS)
- [CVE-2020-7954](https://cve.now/CVE-2020-7954.md): An issue was discovered in OpServices OpMon 9.3.2. (no CVSS)
- [CVE-2020-6855](https://cve.now/CVE-2020-6855.md): A large or infinite loop vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers to parameterize hou (no CVSS)
- [CVE-2020-8772](https://cve.now/CVE-2020-8772.md): The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp\_mmb\_set\_request in init.php. (no CVSS)
- [CVE-2020-8771](https://cve.now/CVE-2020-8771.md): The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. (no CVSS)
- [CVE-2020-7953](https://cve.now/CVE-2020-7953.md): An issue was discovered in OpServices OpMon 9.3.2. (no CVSS)
- [CVE-2020-6856](https://cve.now/CVE-2020-6856.md): An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read (no CVSS)
- [CVE-2020-6767](https://cve.now/CVE-2020-6767.md): Path Traversal in Bosch Video Management System (BVMS) (CVSS 7.7, Bosch DIVAR IP · Bosch Video Management System +1)
- [CVE-2019-19800](https://cve.now/CVE-2019-19800.md): Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelper (no CVSS)
- [CVE-2019-10789](https://cve.now/CVE-2019-10789.md): All versions of curling.js are vulnerable to Command Injection via the run function. (no CVSS, curling.js · curling)
- [CVE-2013-4521](https://cve.now/CVE-2013-4521.md): RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization (no CVSS, Nuxeo Platform)
- [CVE-2020-5854](https://cve.now/CVE-2020-5854.md): On BIG-IP 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.0-11.6.5.1, the tmm crashes under certai (no CVSS, F5 BIG-IP)
- [CVE-2020-5855](https://cve.now/CVE-2020-5855.md): When the Windows Logon Integration feature is configured for all versions of BIG-IP Edge Client for Windows, unauthorized users who have phy (no CVSS, F5 Edge Client for Windows)
- [CVE-2020-5856](https://cve.now/CVE-2020-5856.md): On BIG-IP 15.0.0-15.0.1.1 and 14.1.0-14.1.2.2, while processing specifically crafted traffic using the default 'xnet' driver, Virtual Editio (no CVSS, F5 BIG-IP)
- [CVE-2019-16152](https://cve.now/CVE-2019-16152.md): A Denial of service (DoS) vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to cause FortiClient p (no CVSS, Fortinet FortiClientLinux)
- [CVE-2014-10400](https://cve.now/CVE-2014-10400.md): The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID an (no CVSS)
- [CVE-2014-10399](https://cve.now/CVE-2014-10399.md): The session.lua library in CGILua 5.1.x uses the same ID for each session, which allows remote attackers to hijack arbitrary sessions. (no CVSS)
- [CVE-2014-2875](https://cve.now/CVE-2014-2875.md): The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attacker (no CVSS)
- [CVE-2019-17652](https://cve.now/CVE-2019-17652.md): A stack buffer overflow vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to cause FortiClient proc (no CVSS, Fortinet FortiClientLinux)
- [CVE-2019-15711](https://cve.now/CVE-2019-15711.md): A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to run system commands un (no CVSS, Fortinet FortiClientLinux)
- [CVE-2014-1958](https://cve.now/CVE-2014-1958.md): Buffer overflow in the DecodePSDPixels function in coders/psd.c in ImageMagick before 6.8.8-5 might allow remote attackers to execute arbitr (no CVSS)
- [CVE-2014-2030](https://cve.now/CVE-2014-2030.md): Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause (no CVSS)
- [CVE-2013-4572](https://cve.now/CVE-2013-4572.md): The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cac (no CVSS, Wikimedia Foundation MediaWiki)
- [CVE-2013-4166](https://cve.now/CVE-2013-4166.md): The gpg\_ctx\_add\_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and ear (no CVSS, GNOME Evolution)
- [CVE-2016-1544](https://cve.now/CVE-2016-1544.md): nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion). (no CVSS, nghttp2)
- [CVE-2015-2909](https://cve.now/CVE-2015-2909.md): Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator confi (no CVSS, Dedicated Micros DV-IP Express · Dedicated Micros SD Adv… +3)
- [CVE-2014-8271](https://cve.now/CVE-2014-8271.md): Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically proximate attackers to gain privileges via a lo (no CVSS, Tianocore EDK2)
- [CVE-2015-6000](https://cve.now/CVE-2015-6000.md): Unrestricted file upload vulnerability in the Settings\_Vtiger\_CompanyDetailsSave\_Action class in modules/Settings/Vtiger/actions/CompanyDeta (no CVSS, Vtiger CRM)
- [CVE-2012-2593](https://cve.now/CVE-2012-2593.md): Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbi (no CVSS, Atmail Webmail Server)
- [CVE-2016-7524](https://cve.now/CVE-2016-7524.md): coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. (no CVSS, ImageMagick)
- [CVE-2016-7523](https://cve.now/CVE-2016-7523.md): coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. (no CVSS, ImageMagick)
- [CVE-2016-9928](https://cve.now/CVE-2016-9928.md): MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as a (no CVSS, MCabber)
- [CVE-2010-3917](https://cve.now/CVE-2010-3917.md): Google Chrome before 3.0 does not properly handle XML documents, which allows remote attackers to obtain sensitive information via a crafted (no CVSS, Google Chrome)
- [CVE-2020-5528](https://cve.now/CVE-2020-5528.md): Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4603 and earlier (Movable Type 7), Movable Type 6.5.2 and earlie (no CVSS, Six Apart Movable Type series)
- [CVE-2019-20406](https://cve.now/CVE-2019-20406.md): The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1. (no CVSS, Atlassian Confluence Data Center)
- [CVE-2019-20405](https://cve.now/CVE-2019-20405.md): The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring fla (no CVSS, Atlassian Jira Server)
- [CVE-2019-20404](https://cve.now/CVE-2019-20404.md): The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they (no CVSS, Atlassian Jira Server)
- [CVE-2019-20403](https://cve.now/CVE-2019-20403.md): The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or n (no CVSS, Atlassian Jira Server)
- [CVE-2019-20402](https://cve.now/CVE-2019-20402.md): Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without r (no CVSS, Atlassian Jira Server)
- [CVE-2019-20401](https://cve.now/CVE-2019-20401.md): Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet fin (no CVSS, Atlassian Jira Server)
- [CVE-2019-20400](https://cve.now/CVE-2019-20400.md): The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global pat (no CVSS, Atlassian Jira Server)
- [CVE-2019-20106](https://cve.now/CVE-2019-20106.md): Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before versio (no CVSS, Atlassian Jira Server and Data Center)
- [CVE-2019-20104](https://cve.now/CVE-2019-20104.md): The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perfor (no CVSS, Atlassian Crowd)
- [CVE-2020-8658](https://cve.now/CVE-2020-8658.md): The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess\_editor CSRF. (no CVSS)
- [CVE-2020-8647](https://cve.now/CVE-2020-8647.md): There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc\_do\_resize function in drivers/tty/vt/vt.c. (no CVSS)
- [CVE-2020-8648](https://cve.now/CVE-2020-8648.md): There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n\_tty\_receive\_buf\_common function in drivers/tty/n\_tty.c. (no CVSS)
- [CVE-2020-8649](https://cve.now/CVE-2020-8649.md): There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon\_invert\_region function in drivers/video/console/vgac (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-02-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.