# CVEs published 2020-02-07

67 CVEs were published on February 7, 2020: 2 critical, 8 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2019-17136](https://cve.now/CVE-2019-17136.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2019-13333](https://cve.now/CVE-2019-13333.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2019-13334](https://cve.now/CVE-2019-13334.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2019-17135](https://cve.now/CVE-2019-17135.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2020-8811](https://cve.now/CVE-2020-8811.md): ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures. (no CVSS)
- [CVE-2020-8812](https://cve.now/CVE-2020-8812.md): Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. (no CVSS)
- [CVE-2019-19356](https://cve.now/CVE-2019-19356.md): Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. (CVSS 7.5, KEV)
- [CVE-2019-13163](https://cve.now/CVE-2019-13163.md): The Fujitsu TLS library allows a man-in-the-middle attack. (no CVSS)
- [CVE-2020-8808](https://cve.now/CVE-2020-8808.md): The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers in CORSAIR iCUE before 3.25.60 allow local non-privileged users (including low-i (no CVSS)
- [CVE-2011-1086](https://cve.now/CVE-2011-1086.md): Cross-site scripting (XSS) vulnerability in admin/system.html in Openfiler 2.3 allows remote attackers to inject arbitrary web script or HTM (no CVSS, Openfiler)
- [CVE-2011-1085](https://cve.now/CVE-2011-1085.md): CSRF vulnerability in Smoothwall Express 3. (no CVSS, Smoothwall Express)
- [CVE-2011-1084](https://cve.now/CVE-2011-1084.md): A cross-site scripting (XSS) vulnerability in Smoothwall Express 3. (no CVSS, Smoothwall Express)
- [CVE-2020-1708](https://cve.now/CVE-2020-1708.md): It has been found in openshift-enterprise version 3.11 and all openshift-enterprise versions from 4.1 to, including 4.3, that multiple conta (CVSS 7.0, Red Hat openshift/mysql-apb)
- [CVE-2020-6770](https://cve.now/CVE-2020-6770.md): Deserialization of Untrusted Data in Bosch BVMS Mobile Video Service (CVSS 10.0, Bosch DIVAR IP · Bosch BVMS Mobile Video Service)
- [CVE-2020-6768](https://cve.now/CVE-2020-6768.md): Path Traversal in Bosch Video Management System (BVMS) (CVSS 8.6, Bosch DIVAR IP · Bosch Video Management System +1)
- [CVE-2020-8796](https://cve.now/CVE-2020-8796.md): Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server. (no CVSS)
- [CVE-2020-6769](https://cve.now/CVE-2020-6769.md): Missing Authentication for Critical Function in Bosch Video Streaming Gateway (CVSS 10.0, Bosch DIVAR IP · Bosch Video Streaming Gateway)
- [CVE-2013-3096](https://cve.now/CVE-2013-3096.md): D-Link DIR865L v1.03 suffers from an "Unauthenticated Hardware Linking" vulnerability. (no CVSS)
- [CVE-2013-3067](https://cve.now/CVE-2013-3067.md): Linksys WRT310Nv2 2.0.0.1 is vulnerable to XSS. (no CVSS)
- [CVE-2013-3091](https://cve.now/CVE-2013-3091.md): An Authentication Bypass vulnerability in Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication using "Javascript (no CVSS)
- [CVE-2014-5087](https://cve.now/CVE-2014-5087.md): A vulnerability exists in Sphider Search Engine prior to 1.3.6 due to exec calls in admin/spiderfuncs.php, which could let a remote maliciou (no CVSS)
- [CVE-2014-5091](https://cve.now/CVE-2014-5091.md): A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a mali (no CVSS)
- [CVE-2014-5278](https://cve.now/CVE-2014-5278.md): A vulnerability exists in Docker before 1.2 via container names, which may collide with and override container IDs. (no CVSS)
- [CVE-2014-5288](https://cve.now/CVE-2014-5288.md): A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages. (no CVSS)
- [CVE-2014-5468](https://cve.now/CVE-2014-5468.md): A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cfm to specify a malic (no CVSS)
- [CVE-2014-6413](https://cve.now/CVE-2014-6413.md): A Cross-site Scripting (XSS) vulnerability exists in WatchGuard XTM 11.8.3 via the poll\_name parameter in the firewall/policy script. (no CVSS)
- [CVE-2020-1768](https://cve.now/CVE-2020-1768.md): External Interface does not invalidate session (CVSS 5.4, OTRS AG OTRS)
- [CVE-2014-7224](https://cve.now/CVE-2014-7224.md): A Code Execution vulnerability exists in Android prior to 4.4.0 related to the addJavascriptInterface method and the accessibility and acces (no CVSS)
- [CVE-2019-18988](https://cve.now/CVE-2019-18988.md): TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' in (CVSS 7.0, KEV)
- [CVE-2010-4658](https://cve.now/CVE-2010-4658.md): statusnet through 2010 allows attackers to spoof syslog messages via newline injection attacks. (no CVSS, statusnet)
- [CVE-2014-9530](https://cve.now/CVE-2014-9530.md): A vulnerability exists in nw.js before 0.11.3 when calling nw methods from normal frames, which has an unspecified impact. (no CVSS)
- [CVE-2019-15606](https://cve.now/CVE-2019-15606.md): Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value compariso (no CVSS, NodeJS Node)
- [CVE-2019-15604](https://cve.now/CVE-2019-15604.md): Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate (no CVSS, NodeJS Node)
- [CVE-2020-8126](https://cve.now/CVE-2020-8126.md): A privilege escalation in the EdgeSwitch prior to version 1.7.1, an CGI script don't fully sanitize the user input resulting in local comman (no CVSS, EdgeSwitch)
- [CVE-2019-15605](https://cve.now/CVE-2019-15605.md): HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed (no CVSS, NodeJS Node)
- [CVE-2019-16155](https://cve.now/CVE-2019-16155.md): A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to overwrite system files (no CVSS, Fortinet FortiClientLinux)
- [CVE-2013-3637](https://cve.now/CVE-2013-3637.md): ProjectPier 0.8.8 does not use the Secure flag for cookies (no CVSS)
- [CVE-2013-3636](https://cve.now/CVE-2013-3636.md): ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag (no CVSS)
- [CVE-2013-3635](https://cve.now/CVE-2013-3635.md): ProjectPier 0.8.8 has stored XSS (no CVSS)
- [CVE-2013-3629](https://cve.now/CVE-2013-3629.md): ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution (no CVSS, ISPConfig)
- [CVE-2013-3628](https://cve.now/CVE-2013-3628.md): Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability (no CVSS, Zabbix)
- [CVE-2013-3591](https://cve.now/CVE-2013-3591.md): vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability (no CVSS, vTiger CRM)
- [CVE-2013-4335](https://cve.now/CVE-2013-4335.md): opOpenSocialPlugin 0.8.2.1, \> 0.9.9.2, 0.9.13, 1.2.6: Multiple XML External Entity Injection Vulnerabilities (no CVSS, opOpenSocialPlugin)
- [CVE-2013-4334](https://cve.now/CVE-2013-4334.md): opWebAPIPlugin 0.5.1, 0.4.0, and 0.1.0: XXE Vulnerabilities (no CVSS, opWebAPIPlugin)
- [CVE-2019-17268](https://cve.now/CVE-2019-17268.md): The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. (no CVSS, omniauth-weibo-oauth2)
- [CVE-2013-1202](https://cve.now/CVE-2013-1202.md): Cisco ACE A2(3.6) allows log retention DoS. (no CVSS, Cisco ACE)
- [CVE-2013-0192](https://cve.now/CVE-2013-0192.md): File Disclosure in SMF (SimpleMachines Forum) \<= 2.0.3: Forum admin can read files such as the database config. (no CVSS, SMF)
- [CVE-2012-1567](https://cve.now/CVE-2012-1567.md): LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintUpdate. (no CVSS, LinuxMint Mint)
- [CVE-2012-1566](https://cve.now/CVE-2012-1566.md): LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintNanny. (no CVSS, LinuxMint Mint)
- [CVE-2013-2009](https://cve.now/CVE-2013-2009.md): WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution (no CVSS, WP Super Cache Plugin authors WP Super Cache Plugin)
- [CVE-2020-8788](https://cve.now/CVE-2020-8788.md): Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS (and HTML injection) via the Default.aspx UserName parameter. (no CVSS)
- [CVE-2013-2008](https://cve.now/CVE-2013-2008.md): WordPress Super Cache Plugin 1.3 has XSS. (no CVSS, Super Cache Plugin authors Super Cache Plugin)
- [CVE-2019-14088](https://cve.now/CVE-2019-14088.md): Possible use after free issue while CRM is accessing the link pointer from device private data due to lack of resource protection in Snapdra (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14060](https://cve.now/CVE-2019-14060.md): Uninitialized stack data gets used If memory is not allocated for blob or if the allocated blob is less than the struct size required due to (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14063](https://cve.now/CVE-2019-14063.md): Out of bound access due to Invalid inputs to dapm mux settings which results into kernel failure in Snapdragon Auto, Snapdragon Compute, Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14051](https://cve.now/CVE-2019-14051.md): Subsequent additions performed during Module loading while allocating the memory would lead to integer overflow and then to buffer overflow (no CVSS, Qualcomm Snapdragon Industrial IOT)
- [CVE-2019-14055](https://cve.now/CVE-2019-14055.md): Possibility of use-after-free and double free because of not marking buffer as NULL after freeing can lead to dangling pointer access in Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14057](https://cve.now/CVE-2019-14057.md): Buffer Over read of codec private data while parsing an mkv file due to lack of check of buffer size before read in Snapdragon Auto, Snapdra (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14046](https://cve.now/CVE-2019-14046.md): Out of bound access while allocating memory for an array in camera due to improper validation of elements parameters in Snapdragon Auto, Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14049](https://cve.now/CVE-2019-14049.md): Stage-2 fault will occur while writing to an ION system allocation which has been assigned to non-HLOS memory which is non-standard in Snapd (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14041](https://cve.now/CVE-2019-14041.md): During listener modified response processing, a buffer overrun occurs due to lack of buffer size verification when updating message buffer w (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14044](https://cve.now/CVE-2019-14044.md): Out of bound access due to access of uninitialized memory segment in an array of pointers while normal camera open close in Snapdragon Consu (no CVSS, Qualcomm Snapdragon Consumer IOT, Snapdragon Mobile)
- [CVE-2019-14002](https://cve.now/CVE-2019-14002.md): APKs without proper permission may bind to CallEnhancementService and can lead to unauthorized access to call status in Snapdragon Auto, Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14040](https://cve.now/CVE-2019-14040.md): Using memory after being freed in qsee due to wrong implementation can lead to unexpected behavior such as execution of unknown code in Snap (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10567](https://cve.now/CVE-2019-10567.md): There is a way to deceive the GPU kernel driver into thinking there is room in the GPU ringbuffer and overwriting existing commands could al (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10590](https://cve.now/CVE-2019-10590.md): Out of bound access while parsing dts atom, which is non-standard as it does not have valid number of tracks in Snapdragon Auto, Snapdragon (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-1700](https://cve.now/CVE-2020-1700.md): A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. (CVSS 6.5, \[UNKNOWN\] ceph)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-02-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.