# CVEs published 2020-02-14

34 CVEs were published on February 14, 2020: 2 critical, 1 high. Days are UTC.

- [CVE-2020-8128](https://cve.now/CVE-2020-8128.md): An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbit (no CVSS, jsreport)
- [CVE-2019-15594](https://cve.now/CVE-2019-15594.md): GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request e (no CVSS, GitLab)
- [CVE-2020-8129](https://cve.now/CVE-2020-8129.md): An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code. (no CVSS, script-manager)
- [CVE-2019-15592](https://cve.now/CVE-2019-15592.md): GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associat (no CVSS, GitLab)
- [CVE-2019-5187](https://cve.now/CVE-2019-5187.md): An exploitable out-of-bounds write vulnerability exists in the TIFreadstripdata function of the igcore19d.dll library of Accusoft ImageGear (CVSS 9.8, Accusoft)
- [CVE-2020-6068](https://cve.now/CVE-2020-6068.md): An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll PNG pngread parser of the Accusoft ImageGear 19.5.0 library. (CVSS 9.8, Accusoft)
- [CVE-2019-4392](https://cve.now/CVE-2019-4392.md): HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access (no CVSS, IBM HCL AppScan Standard Edition)
- [CVE-2019-13967](https://cve.now/CVE-2019-13967.md): iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) via many requests to launch a compile ope (no CVSS)
- [CVE-2019-13966](https://cve.now/CVE-2019-13966.md): In iTop through 2.6.0, an XSS payload can be delivered in certain fields (such as icon) of the XML file used to build the dashboard. (no CVSS)
- [CVE-2019-13965](https://cve.now/CVE-2019-13965.md): Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via the param\_file param (no CVSS)
- [CVE-2013-4211](https://cve.now/CVE-2013-4211.md): A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remo (no CVSS, OpenX Ad Server)
- [CVE-2020-8594](https://cve.now/CVE-2020-8594.md): The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja\_forms\[recaptcha\_site\_key\], ninja\_forms\[recaptc (no CVSS)
- [CVE-2020-8843](https://cve.now/CVE-2020-8843.md): An issue was discovered in Istio 1.3 through 1.3.6. (no CVSS)
- [CVE-2020-8612](https://cve.now/CVE-2020-8612.md): In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious i (no CVSS)
- [CVE-2020-8611](https://cve.now/CVE-2020-8611.md): In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the (no CVSS)
- [CVE-2019-11215](https://cve.now/CVE-2019-11215.md): In Combodo iTop 2.2.0 through 2.6.0, if the configuration file is writable, then execution of arbitrary code can be accomplished by calling (no CVSS)
- [CVE-2019-6195](https://cve.now/CVE-2019-6195.md): An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid (CVSS 4.8, Lenovo XClarity Controller)
- [CVE-2019-6194](https://cve.now/CVE-2019-6194.md): An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that coul (CVSS 5.7, Lenovo XClarity Administrator)
- [CVE-2019-6193](https://cve.now/CVE-2019-6193.md): An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauth (CVSS 7.5, Lenovo XClarity Administrator)
- [CVE-2019-6190](https://cve.now/CVE-2019-6190.md): Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in (CVSS 5.0, Lenovo BIOS)
- [CVE-2019-19758](https://cve.now/CVE-2019-19758.md): A vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1.406.34763 and prior could allow an unauthe (CVSS 6.1, Lenovo EZ Media & Backup Center ix2 · Lenovo EZ Media & Bac…)
- [CVE-2019-19757](https://cve.now/CVE-2019-19757.md): An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripti (CVSS 5.4, Lenovo XClarity Administrator)
- [CVE-2019-19879](https://cve.now/CVE-2019-19879.md): HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions. (no CVSS)
- [CVE-2019-20045](https://cve.now/CVE-2019-20045.md): The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. (no CVSS)
- [CVE-2019-20046](https://cve.now/CVE-2019-20046.md): The Synergy Systems & Solutions PLC & RTU system has a vulnerability in HUSKY RTU 6049-E70 firmware versions 5.0 and prior. (no CVSS)
- [CVE-2018-21032](https://cve.now/CVE-2018-21032.md): A vulnerability in Hitachi Command Suite prior to 8.7.1-00 and Hitachi Automation Director prior to 8.5.0-00 allow authenticated remote user (CVSS 4.3)
- [CVE-2018-21033](https://cve.now/CVE-2018-21033.md): A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director prior to 8.6.2-00 and Hitachi Infrastructure Analyti (CVSS 5.0)
- [CVE-2019-20455](https://cve.now/CVE-2019-20455.md): Gateways/Gateway.php in Heartland & Global Payments PHP SDK before 2.0.0 does not enforce SSL certificate validations. (no CVSS, globalpayments/php-sdk)
- [CVE-2020-7251](https://cve.now/CVE-2020-7251.md): ESConfig Tool able to edit configuration for newer version (CVSS 5.0, Mcafee Endpoint Security)
- [CVE-2020-5532](https://cve.now/CVE-2020-5532.md): ilbo App (ilbo App for Android prior to version 1.1.8 and ilbo App for iOS prior to version 1.2.01) allows an attacker on the same network s (no CVSS, EXTRUN ilbo App)
- [CVE-2020-8991](https://cve.now/CVE-2020-8991.md): vg\_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pv (no CVSS)
- [CVE-2020-8992](https://cve.now/CVE-2020-8992.md): ext4\_protect\_reserved\_inode in fs/ext4/block\_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (sof (no CVSS)
- [CVE-2016-2338](https://cve.now/CVE-2016-2338.md): An exploitable heap overflow vulnerability exists in the Psych::Emitter start\_document function of Ruby. (no CVSS)
- [CVE-2019-20454](https://cve.now/CVE-2019-20454.md): An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \\X is JIT compiled and used to match specially crafted subjects i (CVSS 5.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-02-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.