# CVEs published 2020-02-10

56 CVEs were published on February 10, 2020: 1 critical, 1 high. Days are UTC.

- [CVE-2016-5710](https://cve.now/CVE-2016-5710.md): NetApp Snap Creator Framework before 4.3P1 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors. (no CVSS)
- [CVE-2019-14514](https://cve.now/CVE-2019-14514.md): An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. (no CVSS)
- [CVE-2020-8596](https://cve.now/CVE-2020-8596.md): participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vul (no CVSS)
- [CVE-2020-7217](https://cve.now/CVE-2020-7217.md): An ni\_dhcp4\_fsm\_process\_dhcp4\_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service (no CVSS)
- [CVE-2017-18642](https://cve.now/CVE-2017-18642.md): Syska Smart Bulb devices through 2017-08-06 receive RGB parameters over cleartext Bluetooth Low Energy (BLE), leading to sniffing, reverse e (no CVSS)
- [CVE-2019-19195](https://cve.now/CVE-2019-19195.md): The Bluetooth Low Energy implementation on Microchip Technology BluSDK Smart through 6.2 for ATSAMB11 devices does not properly restrict lin (no CVSS)
- [CVE-2019-19193](https://cve.now/CVE-2019-19193.md): The Bluetooth Low Energy peripheral implementation on Texas Instruments SIMPLELINK-CC2640R2-SDK through 3.30.00.20 and BLE-STACK through 1.5 (no CVSS)
- [CVE-2019-17520](https://cve.now/CVE-2019-17520.md): The Bluetooth Low Energy implementation on Texas Instruments SDK through 3.30.00.20 for CC2640R2 devices does not properly restrict the SM P (no CVSS)
- [CVE-2020-8841](https://cve.now/CVE-2020-8841.md): An issue was discovered in TestLink 1.9.19. (no CVSS)
- [CVE-2019-17518](https://cve.now/CVE-2019-17518.md): The Bluetooth Low Energy implementation on Dialog Semiconductor SDK through 1.0.14.1081 for DA1468x devices responds to link layer packets w (no CVSS)
- [CVE-2019-17517](https://cve.now/CVE-2019-17517.md): The Bluetooth Low Energy implementation on Dialog Semiconductor SDK through 5.0.4 for DA14580/1/2/3 devices does not properly restrict the L (no CVSS)
- [CVE-2019-17061](https://cve.now/CVE-2019-17061.md): The Bluetooth Low Energy (BLE) stack implementation on Cypress PSoC 4 through 3.62 devices does not properly restrict the BLE Link Layer hea (no CVSS)
- [CVE-2019-17060](https://cve.now/CVE-2019-17060.md): The Bluetooth Low Energy (BLE) stack implementation on the NXP KW41Z (based on the MCUXpresso SDK with Bluetooth Low Energy Driver 2.2.1 and (no CVSS)
- [CVE-2020-8840](https://cve.now/CVE-2020-8840.md): FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyedi (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2019-17137](https://cve.now/CVE-2019-17137.md): This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware ver (CVSS 9.4, NETGEAR AC1200)
- [CVE-2019-6744](https://cve.now/CVE-2019-6744.md): This vulnerability allows local attackers to disclose sensitive information on affected installations of Samsung Knox 1.2.02.39 on Samsung G (CVSS 4.3, Samsung Knox)
- [CVE-2019-13321](https://cve.now/CVE-2019-13321.md): This vulnerability allows network adjacent attackers to execute arbitrary code on affected installations of Xiaomi Browser Prior to 10.4.0. (CVSS 5.5, Xiaomi Browser)
- [CVE-2019-13322](https://cve.now/CVE-2019-13322.md): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Browser Prior to 10.4.0. (CVSS 7.5, Xiaomi Browser)
- [CVE-2019-19668](https://cve.now/CVE-2019-19668.md): A CSRF vulnerability exists in the File Types component of Web File Manager in Rumpus FTP 8.2.9.1 that allows an attacker to add or delete t (no CVSS)
- [CVE-2019-19669](https://cve.now/CVE-2019-19669.md): A CSRF vulnerability exists in the Upload Center Forms Component of Web File Manager in Rumpus FTP 8.2.9.1. (no CVSS)
- [CVE-2019-19670](https://cve.now/CVE-2019-19670.md): A HTTP Response Splitting vulnerability was identified in the Web Settings Component of Web File Manager in Rumpus FTP Server 8.2.9.1. (no CVSS)
- [CVE-2019-19667](https://cve.now/CVE-2019-19667.md): A CSRF vulnerability exists in the Block Clients component of Web File Manager in Rumpus FTP 8.2.9.1 that could allow an attacker to whiteli (no CVSS)
- [CVE-2019-19666](https://cve.now/CVE-2019-19666.md): A CSRF vulnerability exists in the Event Notices Settings of Web File Manager in Rumpus FTP 8.2.9.1. (no CVSS)
- [CVE-2019-19661](https://cve.now/CVE-2019-19661.md): A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1, related to RumpusLoginUserName and snp. (no CVSS)
- [CVE-2019-19662](https://cve.now/CVE-2019-19662.md): A CSRF vulnerability exists in the Web File Manager's Create/Delete Accounts functionality of Rumpus FTP Server 8.2.9.1. (no CVSS)
- [CVE-2019-19664](https://cve.now/CVE-2019-19664.md): A CSRF vulnerability exists in the Web Settings of Web File Manager in Rumpus FTP 8.2.9.1. (no CVSS)
- [CVE-2013-2109](https://cve.now/CVE-2013-2109.md): WordPress plugin wp-cleanfix has Remote Code Execution (no CVSS, wp-cleanfix authors wp-cleanfix)
- [CVE-2013-2108](https://cve.now/CVE-2013-2108.md): WordPress WP Cleanfix Plugin 2.4.4 has CSRF (no CVSS, WP Cleanfix Plugin authors WP Cleanfix Plugin)
- [CVE-2019-19665](https://cve.now/CVE-2019-19665.md): A CSRF vulnerability exists in the FTP Settings of Web File Manager in Rumpus FTP 8.2.9.1. (no CVSS)
- [CVE-2019-19663](https://cve.now/CVE-2019-19663.md): A CSRF vulnerability exists in the Folder Sets Settings of Web File Manager in Rumpus FTP 8.2.9.1. (no CVSS)
- [CVE-2019-19659](https://cve.now/CVE-2019-19659.md): A CSRF vulnerability exists in the Web File Manager's Edit Accounts functionality of Rumpus FTP Server 8.2.9.1. (no CVSS)
- [CVE-2012-5828](https://cve.now/CVE-2012-5828.md): BlackBerry PlayBook before 2.1 has an Information Disclosure Vulnerability via a Web browser component error (no CVSS)
- [CVE-2019-19660](https://cve.now/CVE-2019-19660.md): A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1. (no CVSS)
- [CVE-2012-2204](https://cve.now/CVE-2012-2204.md): InfoSphere Guardium aix\_ktap module: DoS (no CVSS, InfoSphere Guardium)
- [CVE-2012-1994](https://cve.now/CVE-2012-1994.md): HP Systems Insight Manager before 7.0 allows a remote user on adjacent network to access information (no CVSS, HP Systems Insight Manager)
- [CVE-2020-8089](https://cve.now/CVE-2020-8089.md): Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group\_list page. (no CVSS)
- [CVE-2012-6449](https://cve.now/CVE-2012-6449.md): The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability. (no CVSS)
- [CVE-2014-5083](https://cve.now/CVE-2014-5083.md): A Command Execution vulnerability exists in Sphider before 1.3.6 due to insufficient sanitization of fwrite to conf.php, which could let a r (no CVSS)
- [CVE-2012-6611](https://cve.now/CVE-2012-6611.md): An issue was discovered in Polycom Web Management Interface G3/HDX 8000 HD with Durango 2.6.0 4740 software and embedded Polycom Linux Devel (no CVSS)
- [CVE-2019-20451](https://cve.now/CVE-2019-20451.md): The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk (no CVSS)
- [CVE-2014-5084](https://cve.now/CVE-2014-5084.md): A Command Execution vulnerability exists in Sphider Pro 3.2 due to insufficient sanitization of fwrite, which could let a remote malicious u (no CVSS)
- [CVE-2014-5085](https://cve.now/CVE-2014-5085.md): A Command Execution vulnerability exists in Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, which could let a remot (no CVSS)
- [CVE-2020-1697](https://cve.now/CVE-2020-1697.md): It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not vali (CVSS 6.1, Red Hat keycloak · org.keycloak:keycloak-core)
- [CVE-2014-5086](https://cve.now/CVE-2014-5086.md): A Command Execution vulnerability exists in Sphider Pro, and Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, which (no CVSS)
- [CVE-2013-1353](https://cve.now/CVE-2013-1353.md): Orange HRM 2.7.1 allows XSS via the vacancy name. (no CVSS)
- [CVE-2012-6666](https://cve.now/CVE-2012-6666.md): vBSeo before 3.6.0PL2 allows XSS via the member.php u parameter. (no CVSS)
- [CVE-2019-20060](https://cve.now/CVE-2019-20060.md): MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. (no CVSS)
- [CVE-2019-20061](https://cve.now/CVE-2019-20061.md): The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the (system-picked) password if this email is sent in clea (no CVSS)
- [CVE-2019-20062](https://cve.now/CVE-2019-20062.md): MFScripts YetiShare v3.5.2 through v4.5.4 might allow an attacker to reset a password by using a leaked hash (the hash never expires until u (no CVSS)
- [CVE-2019-20059](https://cve.now/CVE-2019-20059.md): payment\_manage.ajax.php and various \*\_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly insert values from the sSortDir\_0 (no CVSS)
- [CVE-2020-8825](https://cve.now/CVE-2020-8825.md): index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS. (no CVSS)
- [CVE-2020-7060](https://cve.now/CVE-2020-7060.md): global buffer-overflow in mbfl\_filt\_conv\_big5\_wchar (CVSS 6.5, PHP Group PHP)
- [CVE-2020-7059](https://cve.now/CVE-2020-7059.md): OOB read in php\_strip\_tags\_ex (CVSS 6.5, PHP Group PHP)
- [CVE-2020-8823](https://cve.now/CVE-2020-8823.md): htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter. (no CVSS, sockjs)
- [CVE-2020-8822](https://cve.now/CVE-2020-8822.md): Digi TransPort WR21 5.2.2.3, WR44 5.1.6.4, and WR44v2 5.1.6.9 devices allow stored XSS in the web application. (no CVSS)
- [CVE-2017-18641](https://cve.now/CVE-2017-18641.md): In LXC 2.0, many template scripts download code over cleartext HTTP, and omit a digital-signature check, before running it to bootstrap cont (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-02-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.