# CVEs published 2020-02-08 21 CVEs were published on February 8, 2020: 0 critical, 1 high. Days are UTC. - [CVE-2012-5570](https://cve.now/CVE-2012-5570.md): The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic\_webmail" permission to r (no CVSS, Basic webmail module) - [CVE-2012-4512](https://cve.now/CVE-2012-4512.md): The CSS parser (khtml/css/cssparser.cpp) in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly (no CVSS, KDE Konqueror) - [CVE-2015-5741](https://cve.now/CVE-2015-5741.md): The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to condu (no CVSS, stdlib) - [CVE-2012-4381](https://cve.now/CVE-2012-4381.md): MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependen (no CVSS, MediaWiki) - [CVE-2012-4029](https://cve.now/CVE-2012-4029.md): Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary (no CVSS) - [CVE-2015-2207](https://cve.now/CVE-2015-2207.md): Multiple cross-site scripting (XSS) vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to (no CVSS) - [CVE-2015-3423](https://cve.now/CVE-2015-3423.md): Multiple SQL injection vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to execute arbit (no CVSS) - [CVE-2014-8739](https://cve.now/CVE-2014-8739.md): Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Cre (no CVSS, blueimp/jquery-file-upload) - [CVE-2015-2062](https://cve.now/CVE-2015-2062.md): Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to (no CVSS) - [CVE-2014-7863](https://cve.now/CVE-2014-7863.md): The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 1 (no CVSS) - [CVE-2015-1394](https://cve.now/CVE-2015-1394.md): Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users (no CVSS) - [CVE-2014-9127](https://cve.now/CVE-2014-9127.md): Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to (no CVSS) - [CVE-2014-9126](https://cve.now/CVE-2014-9126.md): Multiple cross-site scripting (XSS) vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web scri (no CVSS) - [CVE-2014-9470](https://cve.now/CVE-2014-9470.md): Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allo (no CVSS) - [CVE-2014-2225](https://cve.now/CVE-2014-2225.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow remote attackers to hija (no CVSS) - [CVE-2011-3642](https://cve.now/CVE-2011-3642.md): Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and (no CVSS) - [CVE-2019-11485](https://cve.now/CVE-2019-11485.md): apport created lock file in wrong directory (CVSS 3.3, Canonical apport) - [CVE-2019-11484](https://cve.now/CVE-2019-11484.md): Integer overflow in bson\_ensure\_space (CVSS 6.3, Canonical whoopsie) - [CVE-2019-11483](https://cve.now/CVE-2019-11483.md): Sander Bos discovered Apport mishandled crash dumps originating from containers. (CVSS 7.0, Canonical apport) - [CVE-2019-11482](https://cve.now/CVE-2019-11482.md): Race condition between reading current working directory and writing a core dump (CVSS 4.2, Canonical apport) - [CVE-2019-11481](https://cve.now/CVE-2019-11481.md): Apport reads arbitrary files if ~/.config/apport/settings is a symlink (CVSS 3.8, Canonical apport) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-02-08 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.