# CVEs published 2020-02-12

117 CVEs were published on February 12, 2020: 0 critical, 7 high. Days are UTC.

- [CVE-2020-5241](https://cve.now/CVE-2020-5241.md): XSS/Script injection vulnerability in matestack (CVSS 7.7, matestack-ui-core)
- [CVE-2018-3987](https://cve.now/CVE-2018-3987.md): An exploitable information disclosure vulnerability exists in the 'Secret Chats' functionality of Rakuten Viber on Android 9.3.0.6. (CVSS 4.2, Rakuten Viber)
- [CVE-2019-5322](https://cve.now/CVE-2019-5322.md): A remotely exploitable information disclosure vulnerability is present in Aruba Intelligent Edge Switch models 5400, 3810, 2920, 2930, 2530 (no CVSS, Aruba Intelligent Edge Switch 5400 3810 2920 2930 2530 with…)
- [CVE-2020-7209](https://cve.now/CVE-2020-7209.md): LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2. (no CVSS, LinuxKI)
- [CVE-2020-7208](https://cve.now/CVE-2020-7208.md): LinuxKI v6.0-1 and earlier is vulnerable to an XSS which is resolved in release 6.0-2. (no CVSS, LinuxKI)
- [CVE-2019-18915](https://cve.now/CVE-2019-18915.md): A potential security vulnerability has been identified with certain versions of HP System Event Utility prior to version 1.4.33. (no CVSS, HP System Event Utility)
- [CVE-2020-6973](https://cve.now/CVE-2020-6973.md): Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228\_K 08/09/2018), bios Version 1.2. (no CVSS, Digi International ConnectPort LTS 32 MEI)
- [CVE-2020-6975](https://cve.now/CVE-2020-6975.md): Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228\_K 08/09/2018), bios Version 1.2. (no CVSS, Digi International ConnectPort LTS 32 MEI)
- [CVE-2020-1977](https://cve.now/CVE-2020-1977.md): Expedition Migration Tool: Insufficient Cross Site Request Forgery protection. (CVSS 7.5, Palo Alto Networks Expedition)
- [CVE-2020-1976](https://cve.now/CVE-2020-1976.md): GlobalProtect on MacOS: Local denial-of-service (DoS) vulnerability. (CVSS 4.7, Palo Alto Networks GlobalProtect)
- [CVE-2020-1975](https://cve.now/CVE-2020-1975.md): Missing XML Validation in PAN-OS Web Interface (CVSS 6.8, Palo Alto Networks PAN-OS)
- [CVE-2020-8955](https://cve.now/CVE-2020-8955.md): irc\_mode\_channel\_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overfl (no CVSS)
- [CVE-2013-6022](https://cve.now/CVE-2013-6022.md): A Cross-Site Scripting (XSS) vulnerability exists in Tiki Wiki CMG Groupware 11.0 via the id paraZeroClipboard.swf, which could let a remote (no CVSS, Tiki)
- [CVE-2013-5106](https://cve.now/CVE-2013-5106.md): A Code Execution vulnerability exists in select.py when using python-mode 2012-12-19. (no CVSS)
- [CVE-2013-4602](https://cve.now/CVE-2013-4602.md): A Denial of Service (infinite loop) vulnerability exists in Avira AntiVir Engine before 8.2.12.58 via an unspecified function in the PDF Sca (no CVSS)
- [CVE-2011-4908](https://cve.now/CVE-2011-4908.md): TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php. (no CVSS, Joomla! TinyBrowser Plugin)
- [CVE-2011-4906](https://cve.now/CVE-2011-4906.md): Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution. (no CVSS, Joomla! Tiny browser included with TinyMCE)
- [CVE-2020-5399](https://cve.now/CVE-2020-5399.md): CredHub does not properly enable TLS for MySQL database connections (CVSS 7.6, Cloud Foundry CredHub)
- [CVE-2020-8950](https://cve.now/CVE-2020-8950.md): The AUEPLauncher service in Radeon AMD User Experience Program Launcher through 1.0.0.1 on Windows allows elevation of privilege by placing (no CVSS)
- [CVE-2020-6185](https://cve.now/CVE-2020-6185.md): Under certain conditions ABAP Online Community in SAP NetWeaver (SAP\_BASIS version 7.40) and SAP S/4HANA (SAP\_BASIS versions 7.50, 7.51, 7.5 (CVSS 5.4, SAP SE SAP NetWeaver · SAP SE SAP S/4HANA)
- [CVE-2020-6181](https://cve.now/CVE-2020-6181.md): Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP\_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP\_ (CVSS 5.8, SAP SE SAP NetWeaver · SAP SE SAP ABAP Platform)
- [CVE-2020-6186](https://cve.now/CVE-2020-6186.md): SAP Host Agent, version 7.21, allows an attacker to cause a slowdown in processing of username/password-based authentication requests of the (CVSS 7.5, SAP SE SAP Host Agent)
- [CVE-2020-6183](https://cve.now/CVE-2020-6183.md): SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to the (CVSS 5.3, SAP SE SAP Host Agent)
- [CVE-2020-6184](https://cve.now/CVE-2020-6184.md): Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP\_BASIS version 7.40) and SAP S/4HANA (SAP\_BASIS versions 7.50, 7.51, 7. (CVSS 6.1, SAP SE Automated Note Search Tool)
- [CVE-2020-6191](https://cve.now/CVE-2020-6191.md): SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP (CVSS 7.2, SAP SE SAP Landscape Management)
- [CVE-2020-6188](https://cve.now/CVE-2020-6188.md): VAT Pro-Rata reports in SAP ERP (SAP\_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP\_FIN versions 617, 618, 700, 720, 730) and SAP S (CVSS 6.3, SAP SE SAP ERP · SAP SE SAP S/4 HANA)
- [CVE-2020-6190](https://cve.now/CVE-2020-6190.md): Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information (CVSS 5.8, SAP SE SAP NetWeaver AS Java)
- [CVE-2020-6189](https://cve.now/CVE-2020-6189.md): Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give e (CVSS 5.3, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-6187](https://cve.now/CVE-2020-6187.md): SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input f (CVSS 4.9, SAP SE SAP NetWeaver)
- [CVE-2020-6177](https://cve.now/CVE-2020-6177.md): SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to parti (CVSS 4.3, SAP SE SAP Mobile Platform)
- [CVE-2020-6192](https://cve.now/CVE-2020-6192.md): SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP Ho (CVSS 7.2, SAP SE SAP Landscape Management)
- [CVE-2020-6193](https://cve.now/CVE-2020-6193.md): SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to execute malicious s (CVSS 6.1, SAP SE SAP NetWeaver)
- [CVE-2011-3901](https://cve.now/CVE-2011-3901.md): Android SQLite Journal before 4.0.1 has an information disclosure vulnerability. (no CVSS, Google Android)
- [CVE-2011-3336](https://cve.now/CVE-2011-3336.md): regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion. (no CVSS, Apple macOS)
- [CVE-2011-2499](https://cve.now/CVE-2011-2499.md): Mambo CMS through 4.6.5 has multiple XSS. (no CVSS, Mambo CMS)
- [CVE-2011-2343](https://cve.now/CVE-2011-2343.md): The Bluetooth stack in Android before 2.3.6 allows a physically proximate attacker to obtain contact information via an AT phonebook transfe (no CVSS, Google Android)
- [CVE-2020-8949](https://cve.now/CVE-2020-8949.md): Gocloud S2A\_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.1 (no CVSS)
- [CVE-2011-4338](https://cve.now/CVE-2011-4338.md): Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. (no CVSS, shaman)
- [CVE-2019-19192](https://cve.now/CVE-2019-19192.md): The Bluetooth Low Energy implementation on STMicroelectronics BLE Stack through 1.3.1 for STM32WB5x devices does not properly handle consecu (no CVSS)
- [CVE-2013-3725](https://cve.now/CVE-2013-3725.md): Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution. (no CVSS)
- [CVE-2019-17519](https://cve.now/CVE-2019-17519.md): The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, (no CVSS)
- [CVE-2019-16336](https://cve.now/CVE-2019-16336.md): The Bluetooth Low Energy implementation in Cypress PSoC 4 BLE component 3.61 and earlier processes data channel frames with a payload length (no CVSS)
- [CVE-2014-3860](https://cve.now/CVE-2014-3860.md): Xilisoft Video Converter Ultimate 7.8.1 build-20140505 has a DLL Hijacking vulnerability (no CVSS)
- [CVE-2020-8947](https://cve.now/CVE-2020-8947.md): functions\_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the ind (no CVSS)
- [CVE-2013-7286](https://cve.now/CVE-2013-7286.md): MobileIron VSP \< 5.9.1 and Sentry \< 5.0 has a weak password obfuscation algorithm (no CVSS)
- [CVE-2020-8946](https://cve.now/CVE-2020-8946.md): Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the /cgi-bin-ig (no CVSS)
- [CVE-2019-11867](https://cve.now/CVE-2019-11867.md): Realtek NDIS driver rt640x64.sys, file version 10.1.505.2015, fails to do any size checking on an input buffer from user space, which the dr (no CVSS)
- [CVE-2020-8945](https://cve.now/CVE-2020-8945.md): The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docke (no CVSS, github.com/proglottis/gpgme)
- [CVE-2012-0951](https://cve.now/CVE-2012-0951.md): A Memory Corruption Vulnerability exists in NVIDIA Graphics Drivers 29549 due to an unknown function in the file proc/driver/nvidia/registry (no CVSS, NVIDIA graphics drivers)
- [CVE-2020-7957](https://cve.now/CVE-2020-7957.md): The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the s (CVSS 3.1)
- [CVE-2011-4661](https://cve.now/CVE-2011-4661.md): A memory leak vulnerability exists in Cisco IOS before 15.2(1)T due to a memory leak in the HTTP PROXY Server process (aka CSCtu52820), when (no CVSS, Cisco IOS)
- [CVE-2020-7046](https://cve.now/CVE-2020-7046.md): lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated (CVSS 7.5)
- [CVE-2019-4741](https://cve.now/CVE-2019-4741.md): IBM Content Navigator 3.0CD is vulnerable to Server Side Request Forgery (SSRF). (CVSS 5.3, IBM Content Navigator)
- [CVE-2019-4431](https://cve.now/CVE-2019-4431.md): IBM Rational Publishing Engine 6.0.6 and 6.0.6.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Publishing Engine)
- [CVE-2019-4427](https://cve.now/CVE-2019-4427.md): IBM Cloud CLI 0.6.0 through 0.16.1 windows installers are signed using SHA1 certificate. (CVSS 5.9, IBM Cloud CLI)
- [CVE-2013-2637](https://cve.now/CVE-2013-2637.md): A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes (no CVSS)
- [CVE-2013-6681](https://cve.now/CVE-2013-6681.md): Tube Map Live Underground for Android before 3.0.22 has an Information Disclosure Vulnerability (no CVSS)
- [CVE-2013-6236](https://cve.now/CVE-2013-6236.md): IZON IP 2.0.2: hard-coded password vulnerability (no CVSS)
- [CVE-2013-3685](https://cve.now/CVE-2013-3685.md): A Privilege Escalation Vulnerability exists in Sprite Software Spritebud 1.3.24 and 1.3.28 and Backup 2.5.4105 and 2.5.4108 on LG Android sm (no CVSS)
- [CVE-2013-1924](https://cve.now/CVE-2013-1924.md): Commerce Skrill (Formerly Moneybookers) has an Access bypass vulnerability in all versions prior to 7.x-1.2 (no CVSS, Commerce Skrill)
- [CVE-2013-4395](https://cve.now/CVE-2013-4395.md): Simple Machines Forum (SMF) through 2.0.5 has XSS (no CVSS, SMF)
- [CVE-2013-3494](https://cve.now/CVE-2013-3494.md): A Code Execution Vulnerability exists in UMPlayer 0.98 in wintab32.dll due to insufficient path restrictions when loading external libraries (no CVSS, UMPlayer)
- [CVE-2013-4090](https://cve.now/CVE-2013-4090.md): Varnish HTTP cache before 3.0.4: ACL bug (no CVSS)
- [CVE-2013-2097](https://cve.now/CVE-2013-2097.md): ZPanel through 10.1.0 has Remote Command Execution (no CVSS, ZPanel)
- [CVE-2013-1938](https://cve.now/CVE-2013-1938.md): Zimbra 2013 has XSS in aspell.php (no CVSS, Zimbra)
- [CVE-2013-1410](https://cve.now/CVE-2013-1410.md): Perforce P4web 2011.1 and 2012.1 has multiple XSS vulnerabilities (no CVSS)
- [CVE-2015-7890](https://cve.now/CVE-2015-7890.md): Multiple buffer overflows in the esa\_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung S6 Edge, allow local (no CVSS)
- [CVE-2013-2010](https://cve.now/CVE-2013-2010.md): WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability (no CVSS, W3 Total Cache Plugin authors W3 Total Cache Plugin)
- [CVE-2020-8839](https://cve.now/CVE-2020-8839.md): Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cgi TF\_submask field. (no CVSS)
- [CVE-2020-8815](https://cve.now/CVE-2020-8815.md): Improper connection handling in the base connection handler in IKTeam BearFTP before v0.3.1 allows a remote attacker to achieve denial of se (no CVSS)
- [CVE-2020-2133](https://cve.now/CVE-2020-2133.md): Jenkins Applatix Plugin 1.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed b (no CVSS, Jenkins project Jenkins Applatix Plugin · com.applatix.jenk…)
- [CVE-2020-2130](https://cve.now/CVE-2020-2130.md): Jenkins Harvest SCM Plugin 0.5.1 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it c (no CVSS, Jenkins project Jenkins Harvest SCM Plugin · org.jenkins-ci…)
- [CVE-2020-2131](https://cve.now/CVE-2020-2131.md): Jenkins Harvest SCM Plugin 0.5.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins master where they can be vi (no CVSS, Jenkins project Jenkins Harvest SCM Plugin · org.jenkins-ci…)
- [CVE-2020-2132](https://cve.now/CVE-2020-2132.md): Jenkins Parasoft Environment Manager Plugin 2.14 and earlier stores a password unencrypted in job config.xml files on the Jenkins master whe (no CVSS, Jenkins project Jenkins Parasoft Environment Manager Plugin…)
- [CVE-2020-2128](https://cve.now/CVE-2020-2128.md): Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it (no CVSS, Jenkins project Jenkins ECX Copy Data Management Plugin · c…)
- [CVE-2020-2129](https://cve.now/CVE-2020-2129.md): Jenkins Eagle Tester Plugin 1.0.9 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it (no CVSS, Jenkins project Jenkins Eagle Tester Plugin · com.mobileene…)
- [CVE-2020-2125](https://cve.now/CVE-2020-2125.md): Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the Jenkins (no CVSS, Jenkins project Jenkins Debian Package Builder Plugin · ru.…)
- [CVE-2020-2126](https://cve.now/CVE-2020-2126.md): Jenkins DigitalOcean Plugin 1.1 and earlier stores a token unencrypted in the global config.xml file on the Jenkins master where it can be v (no CVSS, Jenkins project Jenkins DigitalOcean Plugin · com.dubture.j…)
- [CVE-2020-2127](https://cve.now/CVE-2020-2127.md): Jenkins BMC Release Package and Deployment Plugin 1.1 and earlier stores credentials unencrypted in its global configuration file on the Jen (no CVSS, Jenkins project Jenkins BMC Release Package and Deployment…)
- [CVE-2020-2123](https://cve.now/CVE-2020-2123.md): Jenkins RadarGun Plugin 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a r (no CVSS, Jenkins project Jenkins RadarGun Plugin · org.jenkins-ci.pl…)
- [CVE-2020-2124](https://cve.now/CVE-2020-2124.md): Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins mast (no CVSS, Jenkins project Jenkins Dynamic Extended Choice Parameter P…)
- [CVE-2020-2121](https://cve.now/CVE-2020-2121.md): Jenkins Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types (no CVSS, Jenkins project Jenkins Google Kubernetes Engine Plugin · o…)
- [CVE-2020-2122](https://cve.now/CVE-2020-2122.md): Jenkins Brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored cr (no CVSS, Jenkins project Jenkins Brakeman Plugin · org.jenkins-ci.pl…)
- [CVE-2020-2118](https://cve.now/CVE-2020-2118.md): A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier in form-related methods allowed users with Overal (no CVSS, Jenkins project Jenkins Pipeline GitHub Notify Step Plugin…)
- [CVE-2020-2119](https://cve.now/CVE-2020-2119.md): Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, p (no CVSS, Jenkins project Jenkins Azure AD Plugin · org.jenkins-ci.pl…)
- [CVE-2020-2120](https://cve.now/CVE-2020-2120.md): Jenkins FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins FitNesse Plugin · org.jenkins-ci.pl…)
- [CVE-2020-2116](https://cve.now/CVE-2020-2116.md): A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an (no CVSS, Jenkins project Jenkins Pipeline GitHub Notify Step Plugin…)
- [CVE-2020-2117](https://cve.now/CVE-2020-2117.md): A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to (no CVSS, Jenkins project Jenkins Pipeline GitHub Notify Step Plugin…)
- [CVE-2020-2114](https://cve.now/CVE-2020-2114.md): Jenkins S3 publisher Plugin 0.11.4 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration fo (no CVSS, Jenkins project Jenkins S3 publisher Plugin · org.jenkins-c…)
- [CVE-2020-2115](https://cve.now/CVE-2020-2115.md): Jenkins NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins NUnit Plugin · org.jenkins-ci.plugi…)
- [CVE-2020-2111](https://cve.now/CVE-2020-2111.md): Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, re (no CVSS, Jenkins project Jenkins Subversion Plugin · org.jenkins-ci.…)
- [CVE-2020-2112](https://cve.now/CVE-2020-2112.md): Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scripti (no CVSS, Jenkins project Jenkins Git Parameter Plugin · org.jenkins-…)
- [CVE-2020-2113](https://cve.now/CVE-2020-2113.md): Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scriptin (no CVSS, Jenkins project Jenkins Git Parameter Plugin · org.jenkins-…)
- [CVE-2020-2109](https://cve.now/CVE-2020-2109.md): Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-tran (no CVSS, Jenkins project Jenkins Pipeline: Groovy Plugin · org.jenki…)
- [CVE-2020-2110](https://cve.now/CVE-2020-2110.md): Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2015-5617](https://cve.now/CVE-2015-5617.md): SQL injection vulnerability in pub/m\_pending\_news/delete\_pending\_news.jsp in Enorth Webpublisher CMS allows remote attackers to execute arbi (no CVSS)
- [CVE-2013-7381](https://cve.now/CVE-2013-7381.md): libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.n (no CVSS, libnotify)
- [CVE-2019-19194](https://cve.now/CVE-2019-19194.md): The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR (no CVSS)
- [CVE-2019-19196](https://cve.now/CVE-2019-19196.md): The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR (no CVSS)
- [CVE-2020-8595](https://cve.now/CVE-2020-8595.md): Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. (no CVSS)
- [CVE-2019-20100](https://cve.now/CVE-2019-20100.md): The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). (no CVSS, Atlassian Application Links · Atlassian Jira Server)
- [CVE-2019-20099](https://cve.now/CVE-2019-20099.md): The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site r (no CVSS, Atlassian Jira Server)
- [CVE-2019-20098](https://cve.now/CVE-2019-20098.md): The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site (no CVSS, Atlassian Jira Server)
- [CVE-2013-7378](https://cve.now/CVE-2013-7378.md): scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands. (no CVSS, hubot-scripts)
- [CVE-2014-4607](https://cve.now/CVE-2014-4607.md): Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to (no CVSS)
- [CVE-2009-5139](https://cve.now/CVE-2009-5139.md): The SIP implementation on the Gizmo5 software phone provides hashed credentials in a response to an invalid authentication challenge, which (no CVSS)
- [CVE-2009-5140](https://cve.now/CVE-2009-5140.md): The SIP implementation on the Linksys SPA2102 phone adapter provides hashed credentials in a response to an invalid authentication challenge (no CVSS)
- [CVE-2014-2560](https://cve.now/CVE-2014-2560.md): The PhonerLite phone before 2.15 provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for (no CVSS)
- [CVE-2012-0810](https://cve.now/CVE-2012-0810.md): The int3 handler in the Linux kernel before 3.3 relies on a per-CPU debug stack, which allows local users to cause a denial of service (stac (no CVSS, Linux Foundation Linux kernel)
- [CVE-2015-7508](https://cve.now/CVE-2015-7508.md): Heap-based buffer overflow in the bmp\_decode\_rle function in libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a deni (no CVSS, Libnsbmp)
- [CVE-2014-8128](https://cve.now/CVE-2014-8128.md): LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attackers to cause a denia (no CVSS, LibTIFF)
- [CVE-2014-9390](https://cve.now/CVE-2014-9390.md): Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before (no CVSS, mercurial · org.eclipse.jgit:org.eclipse.jgit)
- [CVE-2014-6262](https://cve.now/CVE-2014-6262.md): Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other products, allow remote (no CVSS)
- [CVE-2014-2595](https://cve.now/CVE-2014-2595.md): Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication (no CVSS)
- [CVE-2014-4968](https://cve.now/CVE-2014-4968.md): The WebView class and use of the WebView.addJavascriptInterface method in the Boat Browser application 8.0 and 8.0.1 for Android allow remot (no CVSS)
- [CVE-2014-0234](https://cve.now/CVE-2014-0234.md): The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which (no CVSS, Red Hat OpenShift Enterprise)
- [CVE-2019-19921](https://cve.now/CVE-2019-19921.md): runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs\_linux.go. (no CVSS, github.com/opencontainers/runc)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-02-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.