CVEs published February 12, 2020
117 CVEs were published on February 12, 2020: 0 critical, 7 high.
- Published
- 117
- Critical
- 0
- High
- 7
- Medium
- 16
- Low
- 1
- Unrated
- 93
- Now in CISA KEV
- 0
- Fix available
- 29
Most affected products
- Jenkins project Jenkins Pipeline GitHub Notify Step Plugin…
- 3
- Atlassian Jira Server
- 2
- Digi International ConnectPort LTS 32 MEI
- 2
- Google Android
- 2
- Jenkins project Jenkins Git Parameter Plugin · org.jenkins-…
- 2
- Jenkins project Jenkins Harvest SCM Plugin · org.jenkins-ci…
- 2
- LinuxKI
- 2
- SAP SE SAP Host Agent
- 2
- SAP SE SAP Landscape Management
- 2
- SAP SE SAP NetWeaver
- 2
High 7
- CVE-2020-5241XSS/Script injection vulnerability in matestackmatestack-ui-core
- CVE-2020-1977Expedition Migration Tool: Insufficient Cross Site Request Forgery protection.Palo Alto Networks Expedition
- CVE-2020-5399CredHub does not properly enable TLS for MySQL database connectionsCloud Foundry CredHub
- CVE-2020-6186SAP Host Agent, version 7.21, allows an attacker to cause a slowdown in processing of username/password-based authentication requests of theSAP SE SAP Host Agent
- CVE-2020-6191SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAPSAP SE SAP Landscape Management
- CVE-2020-6192SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP HoSAP SE SAP Landscape Management
- CVE-2020-7046lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated
Medium, low and unrated 110
- CVE-2018-3987An exploitable information disclosure vulnerability exists in the 'Secret Chats' functionality of Rakuten Viber on Android 9.3.0.6.Rakuten Viber
- CVE-2019-5322A remotely exploitable information disclosure vulnerability is present in Aruba Intelligent Edge Switch models 5400, 3810, 2920, 2930, 2530 Aruba Intelligent Edge Switch 5400 3810 2920 2930 2530 with…
- CVE-2020-7209LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.LinuxKI
- CVE-2020-7208LinuxKI v6.0-1 and earlier is vulnerable to an XSS which is resolved in release 6.0-2.LinuxKI
- CVE-2019-18915A potential security vulnerability has been identified with certain versions of HP System Event Utility prior to version 1.4.33.HP System Event Utility
- CVE-2020-6973Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2.Digi International ConnectPort LTS 32 MEI
- CVE-2020-6975Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2.Digi International ConnectPort LTS 32 MEI
- CVE-2020-1976GlobalProtect on MacOS: Local denial-of-service (DoS) vulnerability.Palo Alto Networks GlobalProtect
- CVE-2020-1975Missing XML Validation in PAN-OS Web InterfacePalo Alto Networks PAN-OS
- CVE-2020-8955irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overfl
- CVE-2013-6022A Cross-Site Scripting (XSS) vulnerability exists in Tiki Wiki CMG Groupware 11.0 via the id paraZeroClipboard.swf, which could let a remoteTiki
- CVE-2013-5106A Code Execution vulnerability exists in select.py when using python-mode 2012-12-19.
- CVE-2013-4602A Denial of Service (infinite loop) vulnerability exists in Avira AntiVir Engine before 8.2.12.58 via an unspecified function in the PDF Sca
- CVE-2011-4908TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.Joomla! TinyBrowser Plugin
- CVE-2011-4906Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.Joomla! Tiny browser included with TinyMCE
- CVE-2020-8950The AUEPLauncher service in Radeon AMD User Experience Program Launcher through 1.0.0.1 on Windows allows elevation of privilege by placing
- CVE-2020-6185Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.5SAP SE SAP NetWeaver · SAP SE SAP S/4HANA
- CVE-2020-6181Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_SAP SE SAP NetWeaver · SAP SE SAP ABAP Platform
- CVE-2020-6183SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to the SAP SE SAP Host Agent
- CVE-2020-6184Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.SAP SE Automated Note Search Tool
- CVE-2020-6188VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP SSAP SE SAP ERP · SAP SE SAP S/4 HANA
- CVE-2020-6190Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable informationSAP SE SAP NetWeaver AS Java
- CVE-2020-6189Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give eSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6187SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input fSAP SE SAP NetWeaver
- CVE-2020-6177SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partiSAP SE SAP Mobile Platform
- CVE-2020-6193SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to execute malicious sSAP SE SAP NetWeaver
- CVE-2011-3901Android SQLite Journal before 4.0.1 has an information disclosure vulnerability.Google Android
- CVE-2011-3336regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion.Apple macOS
- CVE-2011-2499Mambo CMS through 4.6.5 has multiple XSS.Mambo CMS
- CVE-2011-2343The Bluetooth stack in Android before 2.3.6 allows a physically proximate attacker to obtain contact information via an AT phonebook transfeGoogle Android
- CVE-2020-8949Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.1
- CVE-2011-4338Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman.shaman
- CVE-2019-19192The Bluetooth Low Energy implementation on STMicroelectronics BLE Stack through 1.3.1 for STM32WB5x devices does not properly handle consecu
- CVE-2013-3725Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution.
- CVE-2019-17519The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length,
- CVE-2019-16336The Bluetooth Low Energy implementation in Cypress PSoC 4 BLE component 3.61 and earlier processes data channel frames with a payload length
- CVE-2014-3860Xilisoft Video Converter Ultimate 7.8.1 build-20140505 has a DLL Hijacking vulnerability
- CVE-2020-8947functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the ind
- CVE-2013-7286MobileIron VSP < 5.9.1 and Sentry < 5.0 has a weak password obfuscation algorithm
- CVE-2020-8946Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the /cgi-bin-ig
- CVE-2019-11867Realtek NDIS driver rt640x64.sys, file version 10.1.505.2015, fails to do any size checking on an input buffer from user space, which the dr
- CVE-2020-8945The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Dockegithub.com/proglottis/gpgme
- CVE-2012-0951A Memory Corruption Vulnerability exists in NVIDIA Graphics Drivers 29549 due to an unknown function in the file proc/driver/nvidia/registryNVIDIA graphics drivers
- CVE-2020-7957The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the s
- CVE-2011-4661A memory leak vulnerability exists in Cisco IOS before 15.2(1)T due to a memory leak in the HTTP PROXY Server process (aka CSCtu52820), whenCisco IOS
- CVE-2019-4741IBM Content Navigator 3.0CD is vulnerable to Server Side Request Forgery (SSRF).IBM Content Navigator
- CVE-2019-4431IBM Rational Publishing Engine 6.0.6 and 6.0.6.1 is vulnerable to cross-site scripting.IBM Rational Publishing Engine
- CVE-2019-4427IBM Cloud CLI 0.6.0 through 0.16.1 windows installers are signed using SHA1 certificate.IBM Cloud CLI
- CVE-2013-2637A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes
- CVE-2013-6681Tube Map Live Underground for Android before 3.0.22 has an Information Disclosure Vulnerability
- CVE-2013-6236IZON IP 2.0.2: hard-coded password vulnerability
- CVE-2013-3685A Privilege Escalation Vulnerability exists in Sprite Software Spritebud 1.3.24 and 1.3.28 and Backup 2.5.4105 and 2.5.4108 on LG Android sm
- CVE-2013-1924Commerce Skrill (Formerly Moneybookers) has an Access bypass vulnerability in all versions prior to 7.x-1.2Commerce Skrill
- CVE-2013-4395Simple Machines Forum (SMF) through 2.0.5 has XSSSMF
- CVE-2013-3494A Code Execution Vulnerability exists in UMPlayer 0.98 in wintab32.dll due to insufficient path restrictions when loading external librariesUMPlayer
- CVE-2013-4090Varnish HTTP cache before 3.0.4: ACL bug
- CVE-2013-2097ZPanel through 10.1.0 has Remote Command ExecutionZPanel
- CVE-2013-1938Zimbra 2013 has XSS in aspell.phpZimbra
- CVE-2013-1410Perforce P4web 2011.1 and 2012.1 has multiple XSS vulnerabilities
- CVE-2015-7890Multiple buffer overflows in the esa_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung S6 Edge, allow local
- CVE-2013-2010WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution VulnerabilityW3 Total Cache Plugin authors W3 Total Cache Plugin
- CVE-2020-8839Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cgi TF_submask field.
- CVE-2020-8815Improper connection handling in the base connection handler in IKTeam BearFTP before v0.3.1 allows a remote attacker to achieve denial of se
- CVE-2020-2133Jenkins Applatix Plugin 1.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed bJenkins project Jenkins Applatix Plugin · com.applatix.jenk…
- CVE-2020-2130Jenkins Harvest SCM Plugin 0.5.1 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it cJenkins project Jenkins Harvest SCM Plugin · org.jenkins-ci…
- CVE-2020-2131Jenkins Harvest SCM Plugin 0.5.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins master where they can be viJenkins project Jenkins Harvest SCM Plugin · org.jenkins-ci…
- CVE-2020-2132Jenkins Parasoft Environment Manager Plugin 2.14 and earlier stores a password unencrypted in job config.xml files on the Jenkins master wheJenkins project Jenkins Parasoft Environment Manager Plugin…
- CVE-2020-2128Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where itJenkins project Jenkins ECX Copy Data Management Plugin · c…
- CVE-2020-2129Jenkins Eagle Tester Plugin 1.0.9 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it Jenkins project Jenkins Eagle Tester Plugin · com.mobileene…
- CVE-2020-2125Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the JenkinsJenkins project Jenkins Debian Package Builder Plugin · ru.…
- CVE-2020-2126Jenkins DigitalOcean Plugin 1.1 and earlier stores a token unencrypted in the global config.xml file on the Jenkins master where it can be vJenkins project Jenkins DigitalOcean Plugin · com.dubture.j…
- CVE-2020-2127Jenkins BMC Release Package and Deployment Plugin 1.1 and earlier stores credentials unencrypted in its global configuration file on the JenJenkins project Jenkins BMC Release Package and Deployment…
- CVE-2020-2123Jenkins RadarGun Plugin 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a rJenkins project Jenkins RadarGun Plugin · org.jenkins-ci.pl…
- CVE-2020-2124Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins mastJenkins project Jenkins Dynamic Extended Choice Parameter P…
- CVE-2020-2121Jenkins Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary typesJenkins project Jenkins Google Kubernetes Engine Plugin · o…
- CVE-2020-2122Jenkins Brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored crJenkins project Jenkins Brakeman Plugin · org.jenkins-ci.pl…
- CVE-2020-2118A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with OveralJenkins project Jenkins Pipeline GitHub Notify Step Plugin…
- CVE-2020-2119Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, pJenkins project Jenkins Azure AD Plugin · org.jenkins-ci.pl…
- CVE-2020-2120Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins FitNesse Plugin · org.jenkins-ci.pl…
- CVE-2020-2116A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to anJenkins project Jenkins Pipeline GitHub Notify Step Plugin…
- CVE-2020-2117A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to Jenkins project Jenkins Pipeline GitHub Notify Step Plugin…
- CVE-2020-2114Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration foJenkins project Jenkins S3 publisher Plugin · org.jenkins-c…
- CVE-2020-2115Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins NUnit Plugin · org.jenkins-ci.plugi…
- CVE-2020-2111Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, reJenkins project Jenkins Subversion Plugin · org.jenkins-ci.…
- CVE-2020-2112Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scriptiJenkins project Jenkins Git Parameter Plugin · org.jenkins-…
- CVE-2020-2113Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scriptinJenkins project Jenkins Git Parameter Plugin · org.jenkins-…
- CVE-2020-2109Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-tranJenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…
- CVE-2020-2110Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying Jenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2015-5617SQL injection vulnerability in pub/m_pending_news/delete_pending_news.jsp in Enorth Webpublisher CMS allows remote attackers to execute arbi
- CVE-2013-7381libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.nlibnotify
- CVE-2019-19194The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR
- CVE-2019-19196The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR
- CVE-2020-8595Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass.
- CVE-2019-20100The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF).Atlassian Application Links · Atlassian Jira Server
- CVE-2019-20099The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site rAtlassian Jira Server
- CVE-2019-20098The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site Atlassian Jira Server
- CVE-2013-7378scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.hubot-scripts
- CVE-2014-4607Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to
- CVE-2009-5139The SIP implementation on the Gizmo5 software phone provides hashed credentials in a response to an invalid authentication challenge, which
- CVE-2009-5140The SIP implementation on the Linksys SPA2102 phone adapter provides hashed credentials in a response to an invalid authentication challenge
- CVE-2014-2560The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for
- CVE-2012-0810The int3 handler in the Linux kernel before 3.3 relies on a per-CPU debug stack, which allows local users to cause a denial of service (stacLinux Foundation Linux kernel
- CVE-2015-7508Heap-based buffer overflow in the bmp_decode_rle function in libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a deniLibnsbmp
- CVE-2014-8128LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attackers to cause a deniaLibTIFF
- CVE-2014-9390Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial beforemercurial · org.eclipse.jgit:org.eclipse.jgit
- CVE-2014-6262Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other products, allow remote
- CVE-2014-2595Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication
- CVE-2014-4968The WebView class and use of the WebView.addJavascriptInterface method in the Boat Browser application 8.0 and 8.0.1 for Android allow remot
- CVE-2014-0234The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which Red Hat OpenShift Enterprise
- CVE-2019-19921runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go.github.com/opencontainers/runc