CVEs published February 7, 2020
67 CVEs were published on February 7, 2020: 2 critical, 8 high. 2 are now in CISA KEV.
- Published
- 67
- Critical
- 2
- High
- 8
- Medium
- 2
- Low
- 0
- Unrated
- 55
- Now in CISA KEV
- 2
- Fix available
- 4
Most affected products
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 12
- Foxit PhantomPDF
- 4
- NodeJS Node
- 3
- LinuxMint Mint
- 2
- Smoothwall Express
- 2
- [UNKNOWN] ceph
- 1
- Bosch DIVAR IP · Bosch BVMS Mobile Video Service
- 1
- Bosch DIVAR IP · Bosch Video Management System +1
- 1
- Bosch DIVAR IP · Bosch Video Streaming Gateway
- 1
- Cisco ACE
- 1
Critical 2
High 8
- CVE-2019-17136This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723.Foxit PhantomPDF
- CVE-2019-13333This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723.Foxit PhantomPDF
- CVE-2019-13334This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723.Foxit PhantomPDF
- CVE-2019-17135This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723.Foxit PhantomPDF
- CVE-2019-19356Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page.
- CVE-2020-1708It has been found in openshift-enterprise version 3.11 and all openshift-enterprise versions from 4.1 to, including 4.3, that multiple contaRed Hat openshift/mysql-apb
- CVE-2020-6768Path Traversal in Bosch Video Management System (BVMS)Bosch DIVAR IP · Bosch Video Management System +1
- CVE-2019-18988TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' in
Medium, low and unrated 57
- CVE-2020-8811ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures.
- CVE-2020-8812Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor.
- CVE-2019-13163The Fujitsu TLS library allows a man-in-the-middle attack.
- CVE-2020-8808The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers in CORSAIR iCUE before 3.25.60 allow local non-privileged users (including low-i
- CVE-2011-1086Cross-site scripting (XSS) vulnerability in admin/system.html in Openfiler 2.3 allows remote attackers to inject arbitrary web script or HTMOpenfiler
- CVE-2011-1085CSRF vulnerability in Smoothwall Express 3.Smoothwall Express
- CVE-2011-1084A cross-site scripting (XSS) vulnerability in Smoothwall Express 3.Smoothwall Express
- CVE-2020-8796Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server.
- CVE-2013-3096D-Link DIR865L v1.03 suffers from an "Unauthenticated Hardware Linking" vulnerability.
- CVE-2013-3067Linksys WRT310Nv2 2.0.0.1 is vulnerable to XSS.
- CVE-2013-3091An Authentication Bypass vulnerability in Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication using "Javascript
- CVE-2014-5087A vulnerability exists in Sphider Search Engine prior to 1.3.6 due to exec calls in admin/spiderfuncs.php, which could let a remote maliciou
- CVE-2014-5091A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a mali
- CVE-2014-5278A vulnerability exists in Docker before 1.2 via container names, which may collide with and override container IDs.
- CVE-2014-5288A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages.
- CVE-2014-5468A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cfm to specify a malic
- CVE-2014-6413A Cross-site Scripting (XSS) vulnerability exists in WatchGuard XTM 11.8.3 via the poll_name parameter in the firewall/policy script.
- CVE-2020-1768External Interface does not invalidate sessionOTRS AG OTRS
- CVE-2014-7224A Code Execution vulnerability exists in Android prior to 4.4.0 related to the addJavascriptInterface method and the accessibility and acces
- CVE-2010-4658statusnet through 2010 allows attackers to spoof syslog messages via newline injection attacks.statusnet
- CVE-2014-9530A vulnerability exists in nw.js before 0.11.3 when calling nw methods from normal frames, which has an unspecified impact.
- CVE-2019-15606Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisoNodeJS Node
- CVE-2019-15604Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificateNodeJS Node
- CVE-2020-8126A privilege escalation in the EdgeSwitch prior to version 1.7.1, an CGI script don't fully sanitize the user input resulting in local commanEdgeSwitch
- CVE-2019-15605HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformedNodeJS Node
- CVE-2019-16155A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to overwrite system files Fortinet FortiClientLinux
- CVE-2013-3637ProjectPier 0.8.8 does not use the Secure flag for cookies
- CVE-2013-3636ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag
- CVE-2013-3635ProjectPier 0.8.8 has stored XSS
- CVE-2013-3629ISPConfig 3.0.5.2 has Arbitrary PHP Code ExecutionISPConfig
- CVE-2013-3628Zabbix 2.0.9 has an Arbitrary Command Execution VulnerabilityZabbix
- CVE-2013-3591vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution VulnerabilityvTiger CRM
- CVE-2013-4335opOpenSocialPlugin 0.8.2.1, > 0.9.9.2, 0.9.13, 1.2.6: Multiple XML External Entity Injection VulnerabilitiesopOpenSocialPlugin
- CVE-2013-4334opWebAPIPlugin 0.5.1, 0.4.0, and 0.1.0: XXE VulnerabilitiesopWebAPIPlugin
- CVE-2019-17268The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.omniauth-weibo-oauth2
- CVE-2013-1202Cisco ACE A2(3.6) allows log retention DoS.Cisco ACE
- CVE-2013-0192File Disclosure in SMF (SimpleMachines Forum) <= 2.0.3: Forum admin can read files such as the database config.SMF
- CVE-2012-1567LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintUpdate.LinuxMint Mint
- CVE-2012-1566LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintNanny.LinuxMint Mint
- CVE-2013-2009WordPress WP Super Cache Plugin 1.2 has Remote PHP Code ExecutionWP Super Cache Plugin authors WP Super Cache Plugin
- CVE-2020-8788Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS (and HTML injection) via the Default.aspx UserName parameter.
- CVE-2013-2008WordPress Super Cache Plugin 1.3 has XSS.Super Cache Plugin authors Super Cache Plugin
- CVE-2019-14088Possible use after free issue while CRM is accessing the link pointer from device private data due to lack of resource protection in SnapdraQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14060Uninitialized stack data gets used If memory is not allocated for blob or if the allocated blob is less than the struct size required due toQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14063Out of bound access due to Invalid inputs to dapm mux settings which results into kernel failure in Snapdragon Auto, Snapdragon Compute, SnaQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14051Subsequent additions performed during Module loading while allocating the memory would lead to integer overflow and then to buffer overflow Qualcomm Snapdragon Industrial IOT
- CVE-2019-14055Possibility of use-after-free and double free because of not marking buffer as NULL after freeing can lead to dangling pointer access in SnaQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14057Buffer Over read of codec private data while parsing an mkv file due to lack of check of buffer size before read in Snapdragon Auto, SnapdraQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14046Out of bound access while allocating memory for an array in camera due to improper validation of elements parameters in Snapdragon Auto, SnaQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14049Stage-2 fault will occur while writing to an ION system allocation which has been assigned to non-HLOS memory which is non-standard in SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14041During listener modified response processing, a buffer overrun occurs due to lack of buffer size verification when updating message buffer wQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14044Out of bound access due to access of uninitialized memory segment in an array of pointers while normal camera open close in Snapdragon ConsuQualcomm Snapdragon Consumer IOT, Snapdragon Mobile
- CVE-2019-14002APKs without proper permission may bind to CallEnhancementService and can lead to unauthorized access to call status in Snapdragon Auto, SnaQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-14040Using memory after being freed in qsee due to wrong implementation can lead to unexpected behavior such as execution of unknown code in SnapQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10567There is a way to deceive the GPU kernel driver into thinking there is room in the GPU ringbuffer and overwriting existing commands could alQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2019-10590Out of bound access while parsing dts atom, which is non-standard as it does not have valid number of tracks in Snapdragon Auto, Snapdragon Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-1700A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects.[UNKNOWN] ceph